Security Incidents: by thread

• RSS Feed
• About List
• All Lists

Previous period

Next period

302 messages starting Feb 13 90 and ending May 31 00
Date index | Thread index | Author index

• Large DNS scans from 211.53.208.178 alann lopes (Apr 28)
  • Re: Large DNS scans from 211.53.208.178 Seth Georgion (Apr 30)
    • Re: Large DNS scans from 211.53.208.178 Richard Stevenson (May 02)
  • Re: Large DNS scans from 211.53.208.178 Bryan Seitz (Apr 30)
  • Strange 33434/UDP traffic from MS W2k with Active Directory Eugene Taylashev (May 01)
  • more weird traceroutes Donald McLachlan (May 02)
    • Re: more weird traceroutes Chad Thunberg (May 02)
  • <Possible follow-ups>
  • Re: Large DNS scans from 211.53.208.178 Fernando Cardoso (May 02)
    • Re: Large DNS scans from 211.53.208.178 Russell Fulton (May 02)
  • Re: Large DNS scans from 211.53.208.178 Ed Padin (May 02)
    • Re: Large DNS scans from 211.53.208.178 Keith McCammon (May 03)
    • Re: Large DNS scans from 211.53.208.178 David B. Bukowski (May 03)
  • Re: Large DNS scans from 211.53.208.178 sigipp () WELLA COM BR (May 03)
    • Re: Large DNS scans from 211.53.208.178 Seth Georgion (May 03)
      • Re: Large DNS scans from 211.53.208.178 Greg A. Woods (May 08)
  • Re: Large DNS scans from 211.53.208.178 Chen, Dave (May 03)
  • Re: Large DNS scans from 211.53.208.178 Igor Gashinsky (May 03)
    • Re: Large DNS scans from 211.53.208.178 Keith Owens (May 06)
• Re: huge scans from www.oix.com Richard Bejtlich (Apr 28)
  • <Possible follow-ups>
  • Re: huge scans from www.oix.com Robert D. Elliott (Apr 29)
• Re: Weird traceroutes Richard Bejtlich (Apr 28)
• Re: I am popular today... Dirk Koopman (Apr 29)
  • Re: I am popular today... Rod MacPherson (May 02)
  • <Possible follow-ups>
  • Re: I am popular today... Dirk Koopman (Apr 29)
  • Re: I am popular today... Ed Padin (May 03)
• Scanning. Is it dangerous? Sarunas Krivickas (Apr 29)
  • Re: Scanning. Is it dangerous? Sebastian (May 01)
  • Re: Scanning. Is it dangerous? Roelof Temmingh (May 01)
  • DNS Probes Damian Gerow (May 01)
  • Re: Scanning. Is it dangerous? John D. Burkett (May 01)
    • Re: Scanning. Is it dangerous? Rune Kristian Viken (May 07)
  • Re: Scanning. Is it dangerous? Ryan Russell (May 01)
    • Re: Scanning. Is it dangerous? jms (May 02)
      • Re: Scanning. Is it dangerous? Jose Nazario (May 03)
    • Scanning. Is it a consumer right? ethan preston (May 02)
  • Re: Scanning. Is it dangerous? Russell Fulton (May 01)
  • <Possible follow-ups>
  • Re: Scanning. Is it dangerous? -reply Joseph, Lorne (May 01)
  • Re: Scanning. Is it dangerous? Don Tansey (May 01)
  • Re: Scanning. Is it dangerous? Igor Gashinsky (May 02)
• large number of probes from 210.97.123.3 Jonathan (Apr 30)
  • large number of probes from 210.97.123.3 kj (Apr 30)
  • <Possible follow-ups>
  • Re: large number of probes from 210.97.123.3 Luff, Darryl (May 01)
• Re: Source code to mstream, a DDoS tool Dave Dittrich (May 01)
• Re: traffic logging Scott McClelland (May 01)
  • <Possible follow-ups>
  • Re: traffic logging Damian Gerow (May 03)
    • Re: traffic logging spiff (May 08)
      • Re: traffic logging Craig H. Rowland (May 08)
      • Re: traffic logging Jason Baker (May 08)
  • Re: traffic logging Robert G. Ferrell (May 03)
    • Re: traffic logging Erich Meier (May 04)
  • Re: traffic logging Damian Gerow (May 09)
• Re: Analysis: AboveNet attacks Richard Bejtlich (May 01)
  • Re: Analysis: AboveNet attacks Robert Graham (May 02)
    • Re: Analysis: AboveNet attacks Ville (May 06)
  • Re: Analysis: AboveNet attacks Paul Cardon (May 02)
  • <Possible follow-ups>
  • Re: Analysis: AboveNet attacks Laura Taylor (May 03)
  • Re: Analysis: AboveNet attacks Robert G. Ferrell (May 04)
    • Re: Analysis: AboveNet attacks Filip M. Gieszczykiewicz (May 08)
• Re: Lots netbios scans (udp 137) Ben Laws (May 01)
  • Re: Lots netbios scans (udp 137) Greg A. Woods (May 03)
    • Re: Lots netbios scans (udp 137) Bryan Andersen (May 03)
    • odd message showing up logs... Josh Burroughs (May 04)
      • Re: odd message showing up logs... Rick Redman (May 06)
      • amd exploit(ed)? Paulo Ribeiro (May 07)
      • Re: amd exploit(ed)? Mike Murray (May 08)
      • Re: amd exploit(ed)? Erich Meier (May 09)
      • Re: amd exploit(ed)? Jim Zajkowski (May 09)
      • Re: odd message showing up logs... Robert Graham (May 07)
    • Port 109 Scans Eric Maiwald (May 04)
      • Re: Port 109 Scans Stone (May 06)
    • Re: Lots netbios scans (udp 137) Erich Meier (May 04)
      • Re: Lots netbios scans (udp 137) Greg A. Woods (May 04)
    • Oversized packets Paulo Ribeiro (May 04)
      • Re: Oversized packets Keith Owens (May 06)
• Is this something important? Ram'on Reyes Carri'on (May 03)
  • <Possible follow-ups>
  • Re: Is this something important? Bill Royds (May 03)
• Re: Strange 33434/UDP traffic from MS W2k with Active Directory Robert G. Ferrell (May 03)
• UDP port 22 Ed Padin (May 03)
  • Re: UDP port 22 Robert Graham (May 03)
  • <Possible follow-ups>
  • Re: UDP port 22 Hedberg, Eric (May 03)
• New game using port 1470? Stuart Staniford (May 03)
  • Re: New game using port 1470? Oliver Sturm (May 08)
  • <Possible follow-ups>
  • Re: New game using port 1470? Louis-Eric Simard (May 07)
• Re: Scanning. Is it a consumer right? Don Tansey (May 03)
• [Fwd: wu-ftp segfault] Bryan Andersen (May 04)
  • Re: [Fwd: wu-ftp segfault] Philip Champon (May 07)
• IL0VEY0U worm Elias Levy (May 04)
  • <Possible follow-ups>
  • Re: IL0VEY0U worm Elias Levy (May 04)
    • Re: IL0VEY0U worm Elias Levy (May 04)
      • Re: IL0VEY0U worm Elias Levy (May 04)
      • Re: IL0VEY0U worm Elias Levy (May 05)
• Sparse ICMP/ACK Scans to Broadcast Addresses Stephen P. Berry (May 05)
  • Re: Sparse ICMP/ACK Scans to Broadcast Addresses Granquist, Lamont (May 07)
    • Re: Sparse ICMP/ACK Scans to Broadcast Addresses Stephen P. Berry (May 08)
• Re: more weird traceroutes Security Guru (May 06)
• Re: odd message showing up logs... Jeremy Gaddis (May 06)
• Re: Port 109 Scans Ed Padin (May 08)
  • <Possible follow-ups>
  • Re: Port 109 Scans Eric Maiwald (May 08)
  • Re: Port 109 Scans Security Guru (May 09)
  • Re: Port 109 Scans Stephen P. Berry (May 09)
  • Re: Port 109 Scans Stephen P. Berry (May 10)
• Automated, Distributed Port Scan E. Larry Lidz (May 08)
  • Re: Automated, Distributed Port Scan Martin Ixter (May 09)
    • Re: Automated, Distributed Port Scan Jose Nazario (May 10)
    • IP Black list? Stuart Staniford (May 11)
      • Re: IP Black list? Travis Pugh (May 15)
      • Re: IP Black list? Jose Nazario (May 15)
      • Re: IP Black list? Paul L Schmehl (May 15)
      • Re: IP Black list? Travis Pugh (May 16)
      • Re: IP Black list? Sebastien Berube (May 15)
      • Odd scans of tcp port 12345 Russell Fulton (May 15)
      • Re: Odd scans of tcp port 12345 Shadow Boxer (May 16)
      • New or Variant Port 109 Scans Stephen P. Berry (May 15)
      • Re: IP Black list? Patrick van Zweden (May 15)
      • TCP low port scan Jose Nazario (May 15)
      • Re: IP Black list? Joe McAlerney (May 15)
      • Re: IP Black list? Omachonu Ogali (May 15)
      • Re: IP Black list? Emre (May 15)
      • Re: IP Black list? Ex Machina (May 15)
      • Re: IP Black list? Keith Owens (May 16)
  • <Possible follow-ups>
  • Re: Automated, Distributed Port Scan Ed Padin (May 09)
  • Re: Automated, Distributed Port Scan Antonio Montes (May 10)
• UDP 27910 - from SCREAMING-NET (UK) pOoTer (May 08)
  • Re: UDP 27910 - from SCREAMING-NET (UK) Jason Witty (May 09)
• TCP Port 2888 Jens Hektor (May 09)
  • <Possible follow-ups>
  • Re: TCP Port 2888 Paul Pot (May 10)
    • Re: TCP Port 2888 Jens Hektor (May 10)
• More fun stuff from demon internet (ICMP/120 ?) Ed Padin (May 09)
  • source port zero scans against DNS servers dorqus (May 12)
  • Re: More fun stuff from demon internet (ICMP/120 ?) thomas lakofski (May 12)
• Scans from reserved addresses?? Ralf Günthner (May 10)
  • Scans dedicated to DNS servers. jacques (Feb 13)
  • Re: Scans from reserved addresses?? Bryan Andersen (May 11)
• Suspicious files in Solaris (fwd) Dave Dittrich (May 10)
  • Re: Suspicious files in Solaris (fwd) Robert van der Meulen (May 15)
  • Re: Suspicious files in Solaris (fwd) Sean Sosik-Hamor (May 15)
  • Korea a classic ? was: IP blacklist Jens Hektor (May 15)
  • Re: Suspicious files in Solaris (fwd) Michael H. Warfield (May 15)
• Antw: Re: Scans from reserved addresses?? Ralf Günthner (May 11)
  • <Possible follow-ups>
  • Re: Antw: Re: Scans from reserved addresses?? Bryan Andersen (May 11)
• UDP scan? Joe McAlerney (May 11)
  • <Possible follow-ups>
  • Re: UDP scan? Robert G. Ferrell (May 16)
• Am I Hacked?? Â÷ÁÖÇ (May 11)
  • Re: Am I Hacked?? dorqus (May 15)
    • Re: Am I Hacked?? Noel Koethe (May 15)
  • Bugtraq Stats for the last 3 years available now. Alfred Huger (May 15)
  • <Possible follow-ups>
  • Re: Am I Hacked?? Fernando Cardoso (May 15)
• Re: IP Black list? Adam Kirby (May 15)
  • Re: IP Black list? -- NONONONONONONONO!!! Michael Merideth (May 15)
    • Re: IP Black list? -- NONONONONONONONO!!! Paul L Schmehl (May 16)
      • Re: IP Black list? -- NONONONONONONONO!!! Michael Merideth (May 16)
      • R: LJK2 rootkit? Andrea Vettori (May 17)
      • Lance Spitzner Audio interview on Forensics and Honeypots Alfred Huger (May 17)
    • Re: IP Black list? -- NONONONONONONONO!!! Richard Johnson (May 16)
  • IP Black list - GET REAL Roelof Temmingh (May 15)
  • Re: IP Black list? Jon Lewis (May 15)
  • <Possible follow-ups>
  • Re: IP Black list? Ed Padin (May 15)
    • Re: IP Black list? jms (May 14)
      • Re: IP Black list? (Track yes, Block no) Bryan Andersen (May 16)
    • You can now track Bugtraq via software (fwd) Alfred Huger (May 15)
  • Re: IP Black list? Mike Shannon (May 15)
    • LJK2 rootkit? Felix Schueren (May 16)
      • Re: LJK2 rootkit? Jose Nazario (May 16)
      • IP blacklists phi-incident () EXORSUS NET (May 16)
      • Re: LJK2 rootkit? Omachonu Ogali (May 16)
      • Re: LJK2 rootkit? Jose Nazario (May 18)
      • Re: LJK2 rootkit? Omachonu Ogali (May 18)
      • Re: LJK2 rootkit? Jens Hektor (May 17)
      • Re: LJK2 rootkit? Egon Barfuß jun. (May 17)
      • Korea Damian Gerow (May 17)
    • Re: IP Black list? Ryan Russell (May 16)
      • Re: IP Black list? Tabor J. Wells (May 16)
  • Re: IP Black list? Luff, Darryl (May 15)
    • Re: IP Black list? Michael Damm (May 15)
      • Re: IP Black list? jms (May 15)
      • TCP/IP options flags? Matt Beck (May 16)
      • unapproved update from [166.93.60.5].61946 James Ankenbrandt (May 17)
      • Re: unapproved update from [166.93.60.5].61946 Jon Lewis (May 18)
  • Re: IP Black list? Volker Werth [VWSoft] (May 16)
  • Re: IP Black list? Elliot Perrin (May 16)
    • Sniffer files Wozz (May 16)
      • Re: Sniffer files Randy Janinda (May 18)
      • Re: Sniffer files Robert Graham (May 18)
    • Re: IP Black list? Paul L Schmehl (May 16)
    • Re: IP Black list? Joe McAlerney (May 16)
  • Re: IP Black list? Robert G. Ferrell (May 16)
  • Re: IP Black list? Tarkington, William (W.) (May 16)
  • Re: IP Black list? Elliot Perrin (May 17)
• Re: Korea a classic ? was: IP blacklist Doglus Cho (May 15)
  • Re: Korea a classic ? was: IP blacklist Jens Hektor (May 16)
    • Re: Korea a classic ? was: IP blacklist Russell Fulton (May 16)
      • Re: Korea a classic ? was: IP blacklist Jane DelFavero (May 18)
  • Strange logs and scans. Lic. Rodolfo Gonzalez Gonzalez (May 17)
    • Re: Strange logs and scans. * * (May 19)
    • While we're on viruses... Keith McCammon (May 19)
  • <Possible follow-ups>
  • Re: Korea a classic ? was: IP blacklist Doglus Cho (May 16)
  • Re: Korea a classic ? was: IP blacklist Cho, Douglas (May 17)
• There is now a Focus area to go with this mailing list Alfred Huger (May 16)
• CGI Raping a.k.a How to Target a DoS at a single Site. Thierry Zoller (May 17)
• Remote DNS update attempts Keith Owens (May 17)
• Re: LJK2 rootkit? Felix Schueren (May 17)
  • Re: LJK2 rootkit? Chad Thunberg (May 18)
  • <Possible follow-ups>
  • Re: LJK2 rootkit? . Hecix (May 19)
• hiding attachment extensions Volker Werth [VWSoft] (May 18)
  • <Possible follow-ups>
  • Re: hiding attachment extensions illu5i0n () HUSHMAIL COM (May 19)
  • Re: hiding attachment extensions Dan Schrader (May 23)
• Another odd UDP scan - new trojan? Neil Long (May 18)
  • Re: Another odd UDP scan - new trojan? Pierre Vandevenne (May 18)
  • Re: Another odd UDP scan - new trojan? Robert Graham (May 18)
  • Re: Another odd UDP scan - new trojan? M J (May 19)
• Unidentified Trojan? Richard Ginski (May 18)
  • Unidentified Trojan? -- Hope this helps James Wilson (May 19)
  • price.doc.exe illu5i0n () HUSHMAIL COM (May 19)
    • Re: price.doc.exe barry.net (May 22)
  • Portscan X.Y.Z.100 - X.Y.Z.254, various ports Jens Hektor (May 20)
  • Two scans (Klogin and a trojan?) Jose Nazario (May 21)
  • Know Your Enemy: A Forensics Analysis Lance Spitzner (May 21)
  • <Possible follow-ups>
  • Re: Unidentified Trojan? Elliot Perrin (May 18)
  • Re: Unidentified Trojan? Bill Royds (May 18)
  • Unidentified Trojan? Richard Ginski (May 19)
• Audio Interview with Martin Roesch Director of Forensic Systems at Hiverworld and author of Snort. Alfred Huger (May 18)
• Re: unapproved update from [166.93.60.5].61946 Teri Bidwell (May 18)
  • Re: unapproved update from [166.93.60.5].61946 Chris Brenton (May 20)
  • <Possible follow-ups>
  • Re: unapproved update from [166.93.60.5].61946 Suzanne.Hernandez () GUNTER AF MIL (May 19)
• Re: While we're on viruses.... gM (May 18)
• udp traffic to port 137 tobias wigand (May 19)
  • network.exe -- was -- Re: udp traffic to port 137 Walt (May 20)
  • Hmmm... named again. Bugtraq List (May 22)
  • Slow scan Jens Hektor (May 22)
    • Re: Slow scan, the rest of the story Jens Hektor (May 24)
  • Re: udp traffic to port 137 Robert Saraceno, Jr. (May 22)
• Anyone have a copy of the New LoveYou code! Rich Dube (May 19)
• VRFY 000.000@my.domain Eduardo Escalante (May 19)
  • <Possible follow-ups>
  • Re: VRFY 000.000@my.domain Mark Tinberg (May 22)
  • Re: VRFY 000.000@my.domain Lisa Saarloos (May 23)
    • Re: VRFY 000.000@my.domain Ben Laws (May 23)
• Re: While we're on viruses... Mohammed Al-Shehri (May 20)
  • <Possible follow-ups>
  • Re: While we're on viruses... William Miller (May 20)
• Unusual UDP access attempts. Aussie (May 20)
  • Re: Unusual UDP access attempts. Richard Bejtlich (May 22)
• Re: Unidentified Trojan? -- Hope this helps Simple Nomad (May 22)
• price.doc.exe &quot;What it Is&quot; Nichols, Scott (May 22)
• Spoofed ICMP &quot;destination unreachable&quot; - DOS? Ken Eichman (May 22)
  • Microsoft version.binding us now? Bill Marquette (May 26)
    • New DoS attack Jeff Calvert (May 28)
    • Re: Microsoft version.binding us now? Erich Meier (May 29)
  • Re: Spoofed ICMP Richard Bejtlich (May 27)
  • Re: Spoofed ICMP &quot;destination unreachable&quot; - DOS? Steve Reid (May 27)
  • <Possible follow-ups>
  • Re: Spoofed ICMP &quot;destination unreachable&quot; - DOS? Aussie (May 24)
    • ICMP attack in progress? Lic. Rodolfo Gonzalez Gonzalez (May 25)
      • Re: ICMP attack in progress? Crist J. Clark (May 25)
      • Re: ICMP attack in progress? Jason Storm (May 26)
    • afs3 exploit?? elijah wright (May 25)
      • Strange Happenings @Home Fred Hirsch (May 30)
    • AMDROCKS Jim Williams (May 25)
      • Attacks on port 25 Vincent Lim (May 25)
      • Re: Attacks on port 25 Ryan Russell (May 26)
      • Re: Attacks on port 25 Bill Lavalette (May 28)
      • Re: Attacks on port 25 RayW (May 29)
      • invalid icmp in linux? Eric LeBlanc (May 27)
      • Re: invalid icmp in linux? Jose Nazario (May 28)
      • weird scan pattern Joe H (May 28)
      • Re: weird scan pattern Russell Fulton (May 29)
      • IDS: Scan of the week Lance Spitzner (May 30)
      • 5 scans of 12345 in a couple of hours. AUSCERT#36349 Russell Fulton (May 31)
      • Taiwan server compromise Claudiu Costin (May 26)
      • Re: Taiwan server compromise Vortex (May 26)
      • port 44767 activity Nathan Fain (May 28)
      • Re: AMDROCKS Alejandro (May 26)
      • Re: AMDROCKS J. S. Townsley (May 26)
      • Re: AMDROCKS Lance Spitzner (May 26)
      • Re: AMDROCKS Matthew F. Caldwell (May 26)
      • CERT's Handbook for Computer Security Incident Response Teams (CSIRTs) Elias Levy (May 26)
• Re: Slow scan Brian Battle (May 22)
  • <Possible follow-ups>
  • Re: Slow scan Parkin, Miles (May 23)
  • Re: Slow scan Lampe, John W. (May 23)
    • Re: Slow scan Daniel Roesen (May 24)
• Fw: Critical data found in log files. Chris West (May 23)
  • Re: Fw: Critical data found in log files. spaceork (May 23)
• 216.65.124.73 / sexwebsites.com admin spanno (May 23)
  • <Possible follow-ups>
  • Re: 216.65.124.73 / sexwebsites.com admin Richard Ginski (May 24)
• tcp port 8000 from ss06.live365.com Robert Joosten (May 23)
  • Re: tcp port 8000 from ss06.live365.com meijin (May 24)
  • Re: tcp port 8000 from ss06.live365.com gabriel rosenkoetter (May 24)
  • Word Virus? Joseph Addison (May 24)
  • <Possible follow-ups>
  • Re: tcp port 8000 from ss06.live365.com Alex McCubbin (May 24)
• Re: Two scans (Klogin and a trojan?) Dan Schrader (May 23)
• Re: Port Scans omkharan arasaratnam (May 24)
  • Re: Port Scans Robert Saraceno, Jr. (May 24)
• PORTSCAN virus? Geo. (May 24)
  • Re: PORTSCAN virus? Steve (May 25)
  • Re: PORTSCAN virus? James Wilson (May 25)
• IIS4 Logs Daniel K. Boyd (May 24)
  • Single packet per IP# port 137 scan Bryan Andersen (May 25)
  • incident input re: FBI Laura Taylor (May 25)
  • Re: IIS4 Logs M J (May 25)
  • <Possible follow-ups>
  • Re: IIS4 Logs rain forest puppy (May 25)
• Re: CRACK Omachonu Ogali (May 25)
  • Re: CRACK Gordon Messmer (May 25)
• Re: ICMP attack in progress? Ryan Casey (May 26)
• Re: Attacks on port 25 Vincent Lim (May 29)
• Re: Microsoft version.binding us now? Erich Meier (May 30)

Previous period

Next period