Ron was asking if anyone had more details about the OTHER addresses that Sobig tried to contact:
67.164.250.26/8998 129.244.36.194/8998 67.73.60.121/8998 218.146.139.246/8998 66.169.84.77/8998 Other people have seen the same thing. The exact circumstances are still unknown (at least to me). Is this a newer, or older, variant of Sobig? Were these copies of Sobig that were contacted and given a new list? What is/was on these five machines? There is apparently some "official" interest in answering these questions, if some of the people who have contacted me privately are to be believed. I wonder if we'll ever get the whole story. Oh, and keep in mind that Sobig does it again on Sunday, and on Friday and Sunday for the next two weeks. Still lots of opportunities for mischief. Jerry -----Original Message----- From: Paul Schmehl [mailto:[EMAIL PROTECTED] Sent: Saturday, August 23, 2003 10:34 AM To: [EMAIL PROTECTED] Subject: RE: [Full-Disclosure] Sobig has a surprise... <snip> > > Anyone have more details to the other addresses? > {{{sigh}}} They've been posted here more than once. They're on the Sophos website. But here they are again, taken from my logs, so these are verified IPs that Sobig.f was contacting on 8998/UDP: <snip repost of information that was not being requested> Confidentiality Notice: This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
