[Snort-users] weird readme.eml attempt

Basil Saragoza snortlst at ...125...
Mon Mar 25 12:09:48 EST 2002


Please take a look at the decoded payload.
I have an mailbox in hotmail-snortlsts at ...5386...
I remmeber I asked a couple of questions regarding readme.eml a month ago
and I have answers regarding that topic in my mailbox. Everytime I fire up
Outlook Express I get the aler in snort in snort regarding the
readme.eml.attempt and according to payload I think it looks at my mailbox
in hotmail and alerts me regarding the mesasage there. How should I relate
to this?

eml attempt</m:subject>
<m:date>2002-03-12T04:49:24</m:date>
<D:getcontentlength>18040</D:getcontentlength>
</D:prop>
<D:status>HTTP/1.1 200 OK</D:status>
</D:propstat>
</D:response>
<D:response>
<D:href>http://pav1.oe.hotmail.com/cgi-bin/hmdata/snortlst@...125.../folde
rs/ACTIVE/MSG1015929915.91</D:href>
<D:propstat>
<D:prop>
<hm:read>1</hm:read>
<m:to></m:to>
<m:from>Roberto Suarez Soto</m:from>
<m:subject>Re: [Snort-users] WEB-MISC readme.eml attempt</m:subject>
<m:date>2002-03-12T10:45:15</m:date>
<D:getcontentlength>3458</D:




More information about the Snort-users mailing list