Previous period

Next period

282 messages starting Feb 28 01 and ending Mar 28 01
Date index | Thread index | Author index

• AW: 1080 Incidents Axel Westerhold (Feb 28)
• Honeynet Project - Scan of the Month Lance Spitzner (Feb 28)
• Microsoft Windows ME and TCP/5000 Eric Fagan (Feb 28)
  • Re: Microsoft Windows ME and TCP/5000 George Bakos (Mar 01)
  • Re: Microsoft Windows ME and TCP/5000 Todd A. Garrison (Mar 01)
    • Re: Microsoft Windows ME and TCP/5000 V. L-M (Mar 02)
      • Re: Microsoft Windows ME and TCP/5000 Jeff Pults (Mar 05)
      • Apache logs John A. Kotulak (Mar 05)
      • Re: Apache logs Pedro Ortale Neto (Mar 05)
  • <Possible follow-ups>
  • Re: Microsoft Windows ME and TCP/5000 Bock, John (ISS San Francisco) (Mar 02)
    • Re: Microsoft Windows ME and TCP/5000 Joe Matusiewicz (Mar 02)
      • Re: Microsoft Windows ME and TCP/5000 Eric Fagan (Mar 05)
  • Re: Microsoft Windows ME and TCP/5000 Vachon, Scott (Mar 05)
    • Re: Microsoft Windows ME and TCP/5000 Magus Ba'al (Mar 09)
  • Re: Microsoft Windows ME and TCP/5000 Timothy Lyons (Mar 06)
• Re: Web Server Folder Traversal Johan.Augustsson (Mar 01)
• Lots of rpc.statd probes lately Frank Louwers (Mar 01)
  • Re: Lots of rpc.statd probes lately Steve Stearns (Mar 01)
  • <Possible follow-ups>
  • Re: Lots of rpc.statd probes lately James Paterson (Mar 01)
  • Re: Lots of rpc.statd probes lately Justin Shore (Mar 01)
    • Re: Lots of rpc.statd probes lately Joseph Nicholas Yarbrough (Mar 02)
• Re: 1080 Incidents Joe Moll (Mar 01)
  • Re: 1080 Incidents Jan Muenther (Mar 01)
  • <Possible follow-ups>
  • Re: 1080 Incidents David Kennedy CISSP (Mar 22)
• DNS UDP Dos Attack? James Kelty (Mar 02)
  • Re: DNS UDP Dos Attack? Wlodek (Mar 02)
    • Re: DNS UDP Dos Attack? Aaron Schultz (Mar 03)
    • FROM port 137 TO port 137 Bryan Bradsby (Mar 03)
  • Re: DNS UDP Dos Attack? Gary Maltzen (Mar 04)
• How to cope with, uhm, "mentally challenged" abuse personnel? Ralf G. R. Bergs (Mar 03)
  • Re: How to cope with, uhm, "mentally challenged" abuse personnel? Utopian Admin (Mar 03)
    • Re: How to cope with, uhm, "mentally challenged" abuse personnel? Ralf G. R. Bergs (Mar 06)
  • Re: How to cope with, uhm, "mentally challenged" abuse personnel? Blake Frantz (Mar 03)
    • Re: How to cope with, uhm, "mentally challenged" abuse personnel? Ralf G. R. Bergs (Mar 06)
  • Re: How to cope with, uhm, "mentally challenged" abuse personnel? Gary Maltzen (Mar 04)
    • Re: How to cope with, uhm, "mentally challenged" abuse personnel? Ralf G. R. Bergs (Mar 06)
  • Re: How to cope with, uhm, "mentally challenged" abuse personnel? Nicholas Bachmann (Mar 06)
  • <Possible follow-ups>
  • FW: How to cope with, uhm, "mentally challenged" abuse personnel? Tyrannis Von Nettesheim (Mar 05)
  • Re: How to cope with, uhm, "mentally challenged" abuse personnel? Ralf G. R. Bergs (Mar 06)
    • Re: How to cope with, uhm, "mentally challenged" abuse personnel? Travis Pugh (Mar 06)
  • Re: How to cope with, uhm, "mentally challenged" abuse personnel? Justin Shore (Mar 06)
• Dead Thread Alfred Huger (Mar 03)
• Continued DoS seen on BIND8.2.2p7 Paul Makepeace (Mar 03)
  • Re: Continued DoS seen on BIND8.2.2p7 Ryan Russell (Mar 04)
    • Re: Continued DoS seen on BIND8.2.2p7 Valdis Kletnieks (Mar 04)
  • Message not available
    • Re: Continued DoS seen on BIND8.2.2p7 Paul Makepeace (Mar 04)
• Re: FROM port 137 TO port 137 Erwin Geirnaert (Mar 05)
• SNMP Scans Crist Clark (Mar 05)
  • <Possible follow-ups>
  • Re: SNMP Scans H Carvey (Mar 11)
    • Re: SNMP Scans Omar Herrera (Mar 12)
      • Re: SNMP Scans MadHat (Mar 13)
  • Re: SNMP Scans Chris Schuler (Mar 13)
    • Re: SNMP Scans John Oliver (Mar 14)
    • Port 111 Scans (odd single IP# probes too) Bryan Andersen (Mar 14)
      • Re: Port 111 Scans (odd single IP# probes too) Scott Nursten (Mar 15)
      • Re: Port 111 Scans (odd single IP# probes too) Rob Kouwenberg (Mar 15)
    • Re: SNMP Scans John (Mar 14)
    • Re: SNMP Scans Eric Kimminau (Mar 14)
    • Re: SNMP Scans Golden_Eternity (Mar 15)
• Abuse John (Mar 05)
  • Re: Abuse E, M (Mar 05)
• Is this traffic normal? Archi2K Archi2K (Mar 06)
• DNS Probe and (?) Exploit Attempt Crist Clark (Mar 06)
• Is this distributed SubSeven? Glenn Forbes Fleming Larratt (Mar 06)
  • Re: Is this distributed SubSeven? Russell Fulton (Mar 06)
    • Re: Is this distributed SubSeven? Glenn Forbes Fleming Larratt (Mar 07)
      • Re: Is this distributed SubSeven? Russell Fulton (Mar 07)
• Port scanning from Iran John Oliver (Mar 07)
• two machines hack through rpc.statd Vegard Svanberg (Mar 07)
  • Re: two machines hack through rpc.statd Ryan Russell (Mar 07)
    • Re: two machines hack through rpc.statd Vegard Svanberg (Mar 08)
  • Re: two machines hack through rpc.statd Vegard Svanberg (Mar 08)
  • <Possible follow-ups>
  • Re: two machines hack through rpc.statd Timothy Lyons (Mar 07)
  • Re: two machines hack through rpc.statd Justin Shore (Mar 07)
• blackholing t-dialin.net? sympatico.ca? Jose Nazario (Mar 07)
  • Re: blackholing t-dialin.net? sympatico.ca? Daniel R. Warner (Mar 07)
  • AW: blackholing t-dialin.net? sympatico.ca? Jens Thiel (Mar 07)
  • Re: blackholing t-dialin.net? sympatico.ca? Steffen Dettmer (Mar 09)
  • <Possible follow-ups>
  • Re: blackholing t-dialin.net? sympatico.ca? Bill Royds (Mar 07)
  • Re: blackholing t-dialin.net? sympatico.ca? Robert G. Ferrell (Mar 08)
    • Re: blackholing t-dialin.net? sympatico.ca? Jose Nazario (Mar 08)
• SYN/ACK probe attempt to TCP 3072? SIU Credit Union IS Dept (Mar 07)
  • Re: SYN/ACK probe attempt to TCP 3072? Valdis Kletnieks (Mar 08)
• Probes on Port 500? -mat- filid brandy (Mar 08)
  • Re: Probes on Port 500? Jason Witty (Mar 08)
  • Re: Probes on Port 500? Jose Nazario (Mar 08)
  • Re: Probes on Port 500? -mat- filid brandy (Mar 09)
  • <Possible follow-ups>
  • Re: Probes on Port 500? Suzanne . Hernandez (Mar 08)
• OS Fingerprinting or best route determination? Portnoy, Gary (Mar 08)
  • <Possible follow-ups>
  • Re: OS Fingerprinting or best route determination? Paul BOYER (Mar 23)
• Re: Statefull inspection on IDS - Stick Joe Klemencic (Mar 08)
• Stick DOS Curley Mr Eric P (Mar 08)
  • Re: Stick DOS Jose Nazario (Mar 08)
  • <Possible follow-ups>
  • Re: Stick DOS Cortez (Mar 09)
    • Re: Stick DOS David Brumley (Mar 09)
• Vacation Troller, Ignore. Alfred Huger (Mar 08)
  • <Possible follow-ups>
  • Vacation Troller, Ignore. Alfred Huger (Mar 20)
• invalid ack with F R A bits set Michiel van der Kraats (Mar 08)
• Somewhat Interesting NIPC Alert Alfred Huger (Mar 08)
• Antionline.com Alfred Huger (Mar 08)
  • Re: Antionline.com Jason Lewis (Mar 09)
• Strange accumulation of scans from Korea (KORNET/HANANET) Ralf G. R. Bergs (Mar 09)
  • Re: Strange accumulation of scans from Korea (KORNET/HANANET) John (Mar 09)
    • Re: Strange accumulation of scans from Korea (KORNET/HANANET) Ralf G. R. Bergs (Mar 14)
      • Aggresive RPC & DNS scans from Korean hosts Joseph Nicholas Yarbrough (Mar 20)
      • Re: Aggresive RPC & DNS scans from Korean hosts dano (Mar 20)
      • Re: Aggresive RPC & DNS scans from Korean hosts Matt W. (Mar 20)
• DoS, Portscan? Portnoy, Gary (Mar 09)
• new(?) windows irc ddos trojan Pete Schmitt (Mar 10)
  • Re: new(?) windows irc ddos trojan Ryan Russell (Mar 10)
• Beware: Latest Version Of Subseven is released... James Cox (Mar 10)
  • Re: Beware: Latest Version Of Subseven is released... Thierry (Mar 11)
    • Re: Beware: Latest Version Of Subseven is released... Brian McWilliams (Mar 11)
      • Re: Beware: Latest Version Of Subseven is released... Gossi The Dog (Mar 12)
  • <Possible follow-ups>
  • Re: Beware: Latest Version Of Subseven is released... Timothy Lyons (Mar 11)
• What is this "imapd: port 2368 service init"? Hugo van Galen (Mar 12)
  • Re: What is this "imapd: port 2368 service init"? Derek Kwan (Mar 12)
• ProFTPD Scan? Kurth Bemis (Mar 12)
  • Re: ProFTPD Scan? Janek Shein (Mar 12)
  • Re: ProFTPD Scan? X (Mar 12)
  • Re: ProFTPD Scan? Jose Nazario (Mar 12)
  • Re: ProFTPD Scan? Steven J. Hill (Mar 13)
    • Re: ProFTPD Scan? Kurth Bemis (Mar 14)
    • Re: ProFTPD Scan? Rik van Riel (Mar 20)
  • Re: ProFTPD Scan? Mike Stilson (Mar 14)
  • <Possible follow-ups>
  • Re: ProFTPD Scan? Guillaume.COURTOIS (Mar 15)
• ICMP Strangeness Portnoy, Gary (Mar 13)
• KNARK rootkit tmiller (Mar 13)
• XMAS scan E, M (Mar 13)
  • <Possible follow-ups>
  • Re: XMAS scan Los, Ralph (Mar 14)
• Strange ARP scan... Chris Hobbs (Mar 13)
  • Re: Strange ARP scan... Ryan Russell (Mar 14)
  • <Possible follow-ups>
  • Re: Strange ARP scan... Justin Shore (Mar 14)
• port 445 mbrown (Mar 14)
• KRNIC Harlan S. Barney, Jr. (Mar 14)
  • Re: KRNIC David Brumley (Mar 14)
  • <Possible follow-ups>
  • KRNIC Harlan S. Barney, Jr. (Mar 14)
• Re: Port 111 Scans (odd single IP# probes too) Grant, Richard (Mar 14)
• odd ICMP Traffic - TSR scan Russell Fulton (Mar 14)
  • Re: odd ICMP Traffic - TSR scan Joe Matusiewicz (Mar 15)
• Re: RedHat 6.2 box exploited - analysis of attacker activity xflare (Mar 14)
• discard 9/udp sink null Golden_Eternity (Mar 15)
• more sunRCP scans from korea... fire-eyes (Mar 16)
  • Re: more sunRCP scans from korea... George Bakos (Mar 17)
• Domain probes from 210.103.181.1 fire-eyes (Mar 17)
• More Probes from Korea Alan J Wright (Mar 18)
• Strange port 23 traffic Costas Karafasoulis (Mar 18)
  • Re: Strange port 23 traffic Ray Simard (Mar 19)
  • <Possible follow-ups>
  • Re: Strange port 23 traffic Bill Royds (Mar 19)
    • Re: Strange port 23 traffic Greg A. Woods (Mar 19)
• cancerserver Burak DAYIOGLU (Mar 19)
  • Re: cancerserver dor (Mar 19)
• UDP Traceroutes? Portnoy, Gary (Mar 19)
  • <Possible follow-ups>
  • Re: UDP Traceroutes? Lampe, John W. (Mar 19)
  • Re: UDP Traceroutes? Portnoy, Gary (Mar 19)
• MX RR for China CERT invalid :-( Ralf G. R. Bergs (Mar 19)
  • Re: MX RR for China CERT invalid :-( Russell Fulton (Mar 19)
• Honeynet Project Forensic Challenge results challenge (Mar 19)
• Gateway.dll? Drew Smith (Mar 19)
  • Re: Gateway.dll? QNT Beheer/NOC (Mar 20)
• IIS Unicode attack decode ROBERT DEMAIN (Mar 20)
  • Re: IIS Unicode attack decode Derek Kwan (Mar 20)
  • <Possible follow-ups>
  • Re: IIS Unicode attack decode Portnoy, Gary (Mar 20)
  • Re: IIS Unicode attack decode ROBERT DEMAIN (Mar 20)
• More Korean probes Yotam Rubin (Mar 20)
  • Re: More Korean probes Ian Hall-Beyer (Mar 21)
• odd DNS scan Joe Moll (Mar 20)
• gte.net Peter Masloch (Mar 20)
  • Re: gte.net Jay D. Dyson (Mar 20)
  • Re: gte.net Jose Nazario (Mar 20)
  • Re: gte.net Digital Overdrive (Mar 21)
    • Re: gte.net Michael DeSimone (Mar 21)
      • Re: gte.net Angi and Tim (Mar 22)
• What's the tool? Sean Brown (Mar 20)
  • Re: What's the tool? Krister (Mar 20)
  • Re: What's the tool? H C (Mar 20)
  • <Possible follow-ups>
  • Re: What's the tool? gattaca (Mar 21)
  • Re: What's the tool? Greg Owen (Mar 21)
• hungry guys form 203.232.4.4 wlodek (Mar 20)
  • <Possible follow-ups>
  • Re: hungry guys form 203.232.4.4 Cortez (Mar 22)
• portmap 11/tcp scan every 30 seconds, source port 4435 Golden_Eternity (Mar 21)
• SV: Aggresive RPC & DNS scans from Korean hosts Mike Blomgren (Mar 21)
• gte.net update Peter Masloch (Mar 21)
• Linux box 'infected' with RK15 Sean Kelly (Mar 21)
  • Re: Linux box 'infected' with RK15 Sean Kelly (Mar 22)
    • Re: Linux box 'infected' with RK15 Thomas Roessler (Mar 23)
  • Re: Linux box 'infected' with RK15 Jim Roland (Mar 22)
  • <Possible follow-ups>
  • Re: Linux box 'infected' with RK15 Miller, Toby (Mar 21)
  • Re: Linux box 'infected' with RK15 Miller, Toby (Mar 22)
  • Re: Linux box 'infected' with RK15 Sean Kelly (Mar 23)
    • Re: Linux box 'infected' with RK15 Neal Dias (Mar 23)
• http activity Burak DAYIOGLU (Mar 21)
  • Re: http activity Hugo van der Kooij (Mar 21)
  • Re: http activity Michael Katz (Mar 21)
  • <Possible follow-ups>
  • Re: http activity Justin Shore (Mar 21)
    • Re: http activity sgtphou (Mar 23)
• netcraft.com John Oliver (Mar 21)
  • bsd-gw attempted (?) buffer overflow Lew E. Lefton (Mar 23)
• "closed-port" backdoors Andreas Hasenack (Mar 21)
  • Virus sig? John R. Sciandra (Mar 22)
  • Re: "closed-port" backdoors Alexander Reelsen (Mar 22)
  • Re: "closed-port" backdoors Fernando Cardoso (Mar 22)
  • Re: "closed-port" backdoors Valdis Kletnieks (Mar 22)
    • Re: "closed-port" backdoors Andreas Hasenack (Mar 22)
  • Re: "closed-port" backdoors Joe Boyle (Mar 22)
  • <Possible follow-ups>
  • Re: "closed-port" backdoors Frank Knobbe (Mar 22)
    • Re: "closed-port" backdoors Andreas Hasenack (Mar 22)
  • Re: "closed-port" backdoors M ixter (Mar 23)
• BIND worm. Scott A. McIntyre (Mar 22)
  • Re: BIND worm. Neil Davey (Mar 23)
  • Re: BIND worm. Andreas Östling (Mar 23)
    • Re: BIND worm. Carl A. Adams (Mar 23)
  • <Possible follow-ups>
  • Re: BIND worm. Booth, David CWT-MSP (Mar 23)
• odd UDP source port 500 dst port 500 traffic fire-eyes (Mar 23)
  • Re: odd UDP source port 500 dst port 500 traffic Rick Payne (Mar 23)
• Re: CVX? Re: Scans of 21536 Paul BOYER (Mar 23)
• More scans from .ru Paul Taylor (Mar 23)
  • Re: More scans from .ru Vladimir Ivaschenko (Mar 23)
• Administrivia Alfred Huger (Mar 23)
• Lion Worm/crew.tgz Alfred Huger (Mar 23)
  • Re: Lion Worm/crew.tgz David Brumley (Mar 23)
  • Re: Lion Worm/crew.tgz Andreas Östling (Mar 23)
  • Re: Lion Worm/crew.tgz Joshua Krage (Mar 23)
    • Re: Lion Worm/crew.tgz Neil Long (Mar 24)
  • Re: Lion Worm/crew.tgz Michael H. Warfield (Mar 24)
    • Re: Lion Worm/crew.tgz Andreas Östling (Mar 24)
      • Re: Lion Worm/crew.tgz Michael H. Warfield (Mar 24)
      • Re: Lion Worm/crew.tgz Dave Dittrich (Mar 26)
  • Re: Lion Worm/crew.tgz John Jasen (Mar 26)
    • Re: Lion Worm/crew.tgz Cooper (Mar 26)
      • Re: Lion Worm/crew.tgz John Jasen (Mar 26)
      • Re: Lion Worm/crew.tgz Daniel Martin (Mar 26)
      • Re: Lion Worm/crew.tgz Cooper (Mar 26)
      • Message not available
      • Re: Lion Worm/crew.tgz Chris Keladis (Mar 26)
  • <Possible follow-ups>
  • Re: Lion Worm/crew.tgz Roberto (Mar 24)
    • Lion Worm/crew.tgz/suspect bind versions Lawrence Frewin of Accommodation.com (Mar 24)
      • Re: Lion Worm/crew.tgz/suspect bind versions Valdis Kletnieks (Mar 26)
      • Re: Lion Worm/crew.tgz/suspect bind versions Lucian Hudin (Mar 27)
      • Re: Lion Worm/crew.tgz/suspect bind versions Valdis Kletnieks (Mar 27)
• About the Russians.. Alfred Huger (Mar 23)
  • Re: About the Russians.. Meritt James (Mar 24)
    • Re: About the Russians.. Rik van Riel (Mar 24)
• New scanning tool? Portnoy, Gary (Mar 23)
  • Re: New scanning tool? Wozz (Mar 23)
• stranges response for Linux => 2.2.15 Eduardo Romero (Mar 24)
• lion worm Jonathan Rickman (Mar 24)
• Attempted DNS queries. Yotam Rubin (Mar 25)
  • Re: Attempted DNS queries. Mark Lastdrager (Mar 25)
  • <Possible follow-ups>
  • Re: Attempted DNS queries. Alfred Huger (Mar 25)
• SecurityFocus' ARIS (Attack Registry & Intelligence Service) Analyzer Elias Levy (Mar 25)
• "Authentication" attempts?? Los, Ralph (Mar 25)
  • Re: "Authentication" attempts?? Peter Moody (Mar 26)
    • Re: "Authentication" attempts?? Valdis Kletnieks (Mar 26)
  • Re: "Authentication" attempts?? Chris Ess (Mar 26)
  • <Possible follow-ups>
  • Re: "Authentication" attempts?? Portnoy, Gary (Mar 26)
• Re: udp bindshell exploit? Jonathan Rickman (Mar 26)
• chkrootkit - lion tamer Talisker (Mar 26)
• Re: udp bindshell exploit? -- yes Stephen Bannasch (Mar 26)
• Source IP Address Isn't A Conclusion... Tyrannis Von Nettesheim (Mar 26)
• UDP Port 9 - "play" (tcpdump included) Golden_Eternity (Mar 26)
• strange, strange stuff Max Gribov (Mar 26)
  • Re: strange, strange stuff Hugo van der Kooij (Mar 26)
    • Re: strange, strange stuff Peter Moody (Mar 27)
    • Re: strange, strange stuff Erik (Mar 28)
  • Re: strange, strange stuff Jason Boyer (Mar 27)
• More rootkit defense Phil Stracchino (Mar 27)
  • Message not available
    • Re: More rootkit defense Phil Stracchino (Mar 27)
      • Re: More rootkit defense gabriel rosenkoetter (Mar 28)
      • Re: More rootkit defense Phil Stracchino (Mar 28)
      • Re: More rootkit defense gabriel rosenkoetter (Mar 28)
  • Message not available
    • Re: More rootkit defense Phil Stracchino (Mar 28)
• Is my IP Address being spoofed? Matthew Collins (Mar 27)
  • <Possible follow-ups>
  • Re: Is my IP Address being spoofed? Bill Royds (Mar 28)
• BIND scan data Jeffrey D. Carter (Mar 27)
• Strange scans against IRC->ICP ports from Yugoslavia??? Ralf G. R. Bergs (Mar 27)
• Surge in probes or coincidence? Dave Elfering (Mar 28)
  • Re: Surge in probes or coincidence? Phil Stracchino (Mar 28)
• ICQ Users a target Again! Lee Hetherington (Mar 28)
  • Re: ICQ Users a target Again! claymore (Mar 28)
  • Re: ICQ Users a target Again! Hugo van der Kooij (Mar 28)
• Lion TCPdump Trace Joshua Krage (Mar 28)
• Synflooders A.L.Lambert (Mar 28)

Previous period

Next period