Previous period

Next period

195 messages starting Sep 02 02 and ending Sep 30 02
Date index | Thread index | Author index

• RE: [incidents] Bots hitting my web server? Rob Keown (Sep 02)
• Any tcp/608 activity? Andrey G. Sergeev (AKA Andris) (Sep 02)
  • Re: Any tcp/608 activity? Johannes Ullrich (Sep 02)
  • <Possible follow-ups>
  • RE: Any tcp/608 activity? Garramone, Michael (CCI-Las Vegas) (Sep 04)
  • RE: Any tcp/608 activity? Garramone, Michael (CCI-Las Vegas) (Sep 05)
• Re: What's going on here? Valdis . Kletnieks (Sep 02)
• Strange back-orifice looking scan... Jeff Kell (Sep 04)
  • <Possible follow-ups>
  • Re: Strange back-orifice looking scan... KoRe MeLtDoWn (Sep 05)
    • Re: Strange back-orifice looking scan... Jeff Kell (Sep 05)
  • Re: Strange back-orifice looking scan... Neil Dickey (Sep 05)
    • Re: Strange back-orifice looking scan... Scott Nursten (Sep 11)
• new type of formmail probes Russell Fulton (Sep 05)
  • Re: new type of formmail probes sunzi (Sep 05)
  • Re: new type of formmail probes Kerry Thompson (Sep 05)
  • Re: new type of formmail probes Soeren Ziehe (Sep 06)
• Odd sendmail behavior Etaoin Shrdlu (Sep 05)
  • Re: Odd sendmail behavior Jay D. Dyson (Sep 05)
  • Re: Odd sendmail behavior Michael Katz (Sep 05)
    • Re: Re: Odd sendmail behavior Nigel Frankcom (Sep 05)
      • Re: Odd sendmail behavior Etaoin Shrdlu (Sep 05)
• Q328691 ? Bronek Kozicki (Sep 06)
  • Re: Q328691 ? H C (Sep 06)
    • Re: Q328691 ? Jonathan Rickman (Sep 06)
      • Re: Q328691 ? Nick FitzGerald (Sep 09)
    • Re: Q328691 ? Baribault, Gary (Sep 06)
    • Re: Q328691 ? sunzi (Sep 09)
  • Re: Q328691 ? Joe Blatz (Sep 06)
    • Re: Q328691 ? Jon (Sep 09)
    • Re: Q328691 ? HggdH (Sep 09)
  • Re: Q328691 ? Valdis . Kletnieks (Sep 06)
  • <Possible follow-ups>
  • RE: Q328691 ? Byrne, David (Sep 09)
  • Re: Q328691 ? Security (Sep 09)
    • Re: Q328691 ? sunzi (Sep 09)
  • Re: SV: Q328691 ? H C (Sep 09)
  • Re: Q328691 ? Bernt Lervik (Sep 09)
    • RE: Q328691 ? Jason Coombs (Sep 09)
  • Re: Q328691 ? Bronek Kozicki (Sep 09)
    • Re: Q328691 ? H C (Sep 09)
  • Re: SV: Q328691 ? jennifer smith (Sep 09)
    • Re: SV: Q328691 ? H C (Sep 09)
  • RE: Q328691 ? Byrne, David (Sep 10)
  • Re: Q328691 ? Kyle Lai (Sep 11)
• Lame website scanner scanning subnets zeno (Sep 06)
• IH FAQ Shaheem Motlekar (Sep 09)
• weird b.cgi HalbaSus (Sep 09)
  • Re: weird b.cgi Roger Thompson (Sep 09)
    • Re: weird b.cgi HalbaSus (Sep 10)
• Possible PHP worm ? Mark Ng (Sep 09)
• Code Red / Nimda Antidote? Clinton Smith (Sep 09)
  • Re: Code Red / Nimda Antidote? Brad Arlt (Sep 09)
  • Re: Code Red / Nimda Antidote? Roger Thompson (Sep 09)
    • Re: Code Red / Nimda Antidote? Johannes Ullrich (Sep 09)
  • Re: Code Red / Nimda Antidote? Jay D. Dyson (Sep 10)
• remote kernel exploits? andy_mn (Sep 09)
  • Re: [Full-Disclosure] remote kernel exploits? Azerail (Sep 09)
  • Re: remote kernel exploits? Jose Nazario (Sep 09)
  • Re: remote kernel exploits? Stephen (Sep 10)
  • <Possible follow-ups>
  • RE: remote kernel exploits? Yonatan Bokovza (Sep 10)
• prisoner.iana.org Diver8 (Sep 09)
  • <Possible follow-ups>
  • RE: prisoner.iana.org David Vincent (Sep 09)
  • RE: prisoner.iana.org Carey, Steve T ISD (Sep 09)
    • Re: prisoner.iana.org kent (Sep 10)
• UDP port 22321 Greg Schmidt (Sep 09)
  • <Possible follow-ups>
  • RE: UDP port 22321 Jeremy Junginger (Sep 09)
    • Re: UDP port 22321 David U. (Sep 10)
• UDP flood on port 2001 Arnold Yancha (Sep 10)
  • Re: UDP flood on port 2001 Michael Katz (Sep 10)
    • Re: UDP flood on port 2001 Arnold Yancha (Sep 11)
  • <Possible follow-ups>
  • RE: UDP flood on port 2001 Garbrecht, Frederick (Sep 10)
  • Re: UDP flood on port 2001 KoRe MeLtDoWn (Sep 11)
• possible ssh hack Ver Allan Sumabat (Sep 10)
  • Re: possible ssh hack Alvin Oga (Sep 10)
  • Re: possible ssh hack Adam Bultman (Sep 10)
  • RE: possible ssh hack Loki (Sep 11)
  • RE: possible ssh hack Loki (Sep 11)
• What's the tool? (iis, ftp, 57/tcp) Scott A. McIntyre (Sep 11)
• Interesting packets Jeremy Junginger (Sep 16)
  • <Possible follow-ups>
  • RE: Interesting packets Boyan Krosnov (Sep 17)
  • RE: Interesting packets Semerjian, Ohanes (Sep 18)
    • Re: Interesting packets Marcelo Barbosa Lima (Sep 17)
• Re: slaper trafic james (Sep 16)
  • Re: slaper trafic Jose Nazario (Sep 17)
  • Re: slaper trafic Denis Dimick (Sep 17)
  • Re: slaper trafic Jeff (Sep 17)
  • Re: slaper trafic Michael Katz (Sep 18)
• non worm ssl attacks Russell Fulton (Sep 17)
  • Re: [unisog] non worm ssl attacks Christian Wilson (Sep 17)
• Good practicle php attack example zeno (Sep 17)
  • Re: Good practicle php attack example Harald Finnaas (Sep 18)
  • <Possible follow-ups>
  • Re: Good practicle php attack example Steven M. Christey (Sep 19)
  • Re: Good practicle php attack example Steven M. Christey (Sep 22)
• Another Nimda attack?? Eugene Chua Yew Gin (Sep 17)
  • Re: Another Nimda attack?? Roger Thompson (Sep 18)
• Win2K Advaned Server compromise report available Curt Wilson (Sep 17)
• Analysis of Modap worm Mario van Velzen (Sep 17)
  • Re: Analysis of Modap worm Paul Wouters (Sep 24)
• Huge Autoexec.bat Matthew S Barnes (Sep 18)
  • Re: Huge Autoexec.bat Nick FitzGerald (Sep 17)
  • Re: Huge Autoexec.bat Chris Norris (Sep 18)
• What's on udp/2002 ? Guido Van De Velde (Sep 18)
  • Re: What's on udp/2002 ? rewt (Sep 18)
    • Re: What's on udp/2002 ? Nick FitzGerald (Sep 18)
  • Re: What's on udp/2002 ? Jay D. Dyson (Sep 18)
    • Re: What's on udp/2002 ? Kurt Seifried (Sep 18)
  • Re: What's on udp/2002 ? Russell Harding (Sep 18)
  • Re: What's on udp/2002 ? Nick FitzGerald (Sep 18)
  • Re: What's on udp/2002 ? Johannes Ullrich (Sep 18)
  • Re: What's on udp/2002 ? Jose Nazario (Sep 18)
  • Re: What's on udp/2002 ? Guido Van De Velde (Sep 18)
  • <Possible follow-ups>
  • RE: What's on udp/2002 ? Matthew F. Caldwell (Sep 18)
• Thank you all for your responses to "Huge Autoexec.bat" Matthew S Barnes (Sep 18)
• Linux Slapper Worm and Linksys James Williams (Sep 19)
  • Re: Linux Slapper Worm and Linksys Johannes Ullrich (Sep 19)
  • <Possible follow-ups>
  • Re: Linux Slapper Worm and Linksys Mike Lewinski (Sep 19)
    • Re: Linux Slapper Worm and Linksys Pavel Lozhkin (Sep 20)
• new IIS worm? (rcp lsass.exe) Christian Mock (Sep 22)
  • Re: new IIS worm? (rcp lsass.exe) Björn Wallentinus (Sep 22)
  • Re: new IIS worm? (rcp lsass.exe) Michael Thompson (Sep 23)
    • Re: new IIS worm? (rcp lsass.exe) Nick FitzGerald (Sep 24)
  • Re: new IIS worm? (rcp lsass.exe) Mike Lewinski (Sep 23)
    • Re: new IIS worm? (rcp lsass.exe) Lasse Sundström (Sep 24)
  • Re: new IIS worm? (rcp lsass.exe) Nick FitzGerald (Sep 23)
  • <Possible follow-ups>
  • Re: new IIS worm? (rcp lsass.exe) Mike Lewinski (Sep 23)
  • Re: new IIS worm? (rcp lsass.exe) pj (Sep 24)
  • RE: new IIS worm? (rcp lsass.exe) Bellenger, Bruno (Paris) (Sep 24)
    • Slapper worm DoS james (Sep 24)
  • Re: new IIS worm? (rcp lsass.exe) Mike Lewinski (Sep 24)
    • Re: new IIS worm? (rcp lsass.exe) Eloy A. Paris (Sep 24)
  • RE: new IIS worm? (rcp lsass.exe) Mark Challender (Sep 24)
  • Re: new IIS worm? (rcp lsass.exe) zeno (Sep 24)
    • Re: new IIS worm? (rcp lsass.exe) James Williams (Sep 24)
    • RE: new IIS worm? (rcp lsass.exe) Ben Timby (Sep 24)
    • Re: new IIS worm? (rcp lsass.exe) sunzi (Sep 25)
    • Re: new IIS worm? (rcp lsass.exe) Nick FitzGerald (Sep 25)
      • Re: new IIS worm? (rcp lsass.exe) Faisal Ashraf (Sep 26)
    • Re: new IIS worm? (rcp lsass.exe) Christoph Puppe (Sep 25)
  • Re: new IIS worm? (rcp lsass.exe) zeno (Sep 24)
  • RE: new IIS worm? (rcp lsass.exe) John Campbell (Sep 24)
  • RE: new IIS worm? (rcp lsass.exe) Dostie, Joe (Sep 25)
  • RE: new IIS worm? (rcp lsass.exe) webbi (Sep 25)
  • RE: new IIS worm? (rcp lsass.exe) John Campbell (Sep 25)
  • Re: new IIS worm? (rcp lsass.exe) zeno (Sep 25)
  • RE: new IIS worm? (rcp lsass.exe) Gaydosh, Adam (Sep 25)
  • RE: new IIS worm? (rcp lsass.exe) David LeBlanc (Sep 26)
  • RE: new IIS worm? (rcp lsass.exe) Dallas Jordan (Sep 26)
  • RE: new IIS worm? (rcp lsass.exe) Bax . Plemons (Sep 26)
  • Re: new IIS worm? (rcp lsass.exe) Muhammad Faisal Rauf Danka (Sep 27)
• New variants of Slapper worm using UDP ports other than 2002 today -- 1978 and 4156 -- (and they were apparently active yesterday as well) H. Morrow Long (Sep 22)
  • Re: New variants of Slapper worm using UDP ports other than 2002 today -- 1978 and 4156 -- (and they were apparently active yesterday as well) Tom Sands (Sep 24)
• "Worm riders" on 4156? Anton Chuvakin, Ph.D., GCIA (Sep 24)
• slapper worm varient "cinik" James P. Kinney III (Sep 25)
  • Re: slapper worm varient "cinik" Anton A. Chuvakin (Sep 25)
    • Re: slapper worm varient "cinik" Mark (Sep 26)
      • Re: slapper worm varient "cinik" James P. Kinney III (Sep 26)
• New worm? Norbert Bollow (Sep 25)
• Modap Worm Infection and Subsequent Scanning Gordon Chamberlin (Sep 25)
  • Re: Modap Worm Infection and Subsequent Scanning Glenn Forbes Fleming Larratt (Sep 26)
    • Re: Modap Worm Infection and Subsequent Scanning Valdis . Kletnieks (Sep 27)
• Port 11890 Scott Nursten (Sep 26)
• AIM-based worm? Troy Ablan (Sep 26)
  • Re: AIM-based worm? De Velopment (Sep 27)
    • Re: AIM-based worm? Troy Ablan (Sep 27)
      • Re: AIM-based worm? Midkaemia (Sep 29)
  • Re: AIM-based worm? Adam Young (Sep 27)
  • <Possible follow-ups>
  • RE: AIM-based worm? webbi (Sep 27)
  • RE: AIM-based worm? Ralph Emery (Sep 27)
  • RE: AIM-based worm? MH Michael Hammer (5304) (Sep 27)
  • RE: AIM-based worm? x x (Sep 27)
    • Re: AIM-based worm? skipper (Sep 28)
  • RE: AIM-based worm? Ron Yount (Sep 27)
• VS: slapper worm varient "cinik" Toni Heinonen (Sep 27)
• RE: E-Card Remote Code Execution Scam Jonathan A. Zdziarski (Sep 28)
  • RE: E-Card Remote Code Execution Scam Jason Robertson (Sep 29)
  • <Possible follow-ups>
  • E-Card Remote Code Execution Scam Jonathan A. Zdziarski (Sep 28)
    • Re: E-Card Remote Code Execution Scam Jeff Jirsa (Sep 29)
    • Re: E-Card Remote Code Execution Scam Axel Pettinger (Sep 29)
    • RE: E-Card Remote Code Execution Scam Fulton Preston (Sep 29)
      • RE: E-Card Remote Code Execution Scam Jonathan A. Zdziarski (Sep 29)
      • RE: E-Card Remote Code Execution Scam Fulton Preston (Sep 29)
    • RE: E-Card Remote Code Execution Scam H.Karrenbeld (Sep 29)
• Snake in the grass sf (Sep 28)
  • RE: Snake in the grass list subscriber (Sep 29)
• Unusual volume: UDP:137 probes John Sage (Sep 29)
  • <Possible follow-ups>
  • RE: Unusual volume: UDP:137 probes Mark Forsyth (Sep 30)
    • Re: Unusual volume: UDP:137 probes Emeric Miszti (Sep 30)
    • RE: Unusual volume: UDP:137 probes Brett Procter (Sep 30)
    • RE: Unusual volume: UDP:137 probes fingers (Sep 30)
    • Re: Unusual volume: UDP:137 probes Scott McGee (Sep 30)
    • Re: Unusual volume: UDP:137 probes Scott McGee (Sep 30)
  • RE: Unusual volume: UDP:137 probes Mark Forsyth (Sep 30)
• Increase in SSH scans Robert Rich (Sep 30)
  • WinXP integrated packet filtering Maxime Ducharme (Sep 30)
  • <Possible follow-ups>
  • RE: Increase in SSH scans Keith T. Morgan (Sep 30)
• RE: Port 608/trojan/spam Garramone, Michael (CCI-Las Vegas) (Sep 30)
• FW: DNS servers outbound connections. Philip Bartholomew (Sep 30)

Previous period

Next period