Date: Fri, 15 Nov 2002 00:20:39 -0500 (EST)
To: victims:  ;
From: Rob.Russell@Canada.Com
Subject: Attempted network compromise.



Hello there.

For your reference, I am sending this EMail to the following addresses:  
security[at]gte.net, tudor[at]pcnet.ro, mihai[at]pcnet.ro,
IHALLEY[at]cavaliertelephone.com, jberry[at]NETACS.NET,
abuse[at]verizon.net, JuppP[at]ottawapolice.ca, nipc.watch[at]fbi.gov 

At [14/Nov/2002:22:24:40 -0500], I noticed a network intrusion attempt on 
my IP address 66.12.48.142.

You are receiving this EMail because I believe that the attack originated 
from within your network, from a compromised computer within your scope of 
responsibility, or because I believe you to be an interested party.  If I 
am in error, please accept my apologies.

Based on my preliminary investigation, I believe that the culprit resides 
in Romania, on the PCNET network.  I believe that the culprit is in the 
process of building a network of compromised hosts for resale for the 
purposes of distributed denial of service attacks, anonymous network 
intrusions, and other forms of childish fun.

I have catalogued the intrusion attempt at http://administra.tion.ca/moron
- with my server logs, including 3 IP addresses used in the attempt.  One
of these IP addresses, I believe to be the attacker's true source IP
address, and the other two of compromised systems used as a staging point
for further attacks.

My contact information is as follows:
Robert Russell
807-1725 Riverside Dr.
Ottawa, ON, Canada K1G 0E6
(613) 261-7541

Please don't heasitate to contact me for further information or 
assistance.

Thanks,

-- 
    Rob.Russell@Canada.Com, Unicorn of Usenet & Bastard of Bandwidth
"If my son wants to be a pimp when he grows up, that's fine with me.  I
hope he's a good one and enjoys it and doesn't get caught. I'll support
him in this. But if he wants to be a network administrator, he's out of
the house and not part of my family." Steve Wozniak, http://www.woz.org