[48036] in North American Network Operators' Group
mssql worm, contact info for postone.com
daemon@ATHENA.MIT.EDU (Johannes Ullrich)
Tue May 21 10:21:24 2002
Date: Tue, 21 May 2002 10:15:01 -0400
Message-Id: <20020521101501.10b3fc9f.jullrich@sans.org>
From: "Johannes Ullrich" <jullrich@sans.org>
To: nanog@merit.edu
X-Euclidian-Scanner-Mail-From: jullrich@sans.org via server
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Errors-To: owner-nanog-outgoing@merit.edu
The new sql worm we started covering yesterday is sending
password lists to ixltd@postone.com . Just a quick heads
up that you may want to watch stuff sent to that address.
Anybody here from Singapore? postone.com is registered to
a singapore company.
--
---------------------------------------------------------------
jullrich@sans.org Collaborative Intrusion Detection
join http://www.dshield.org
