The new sql worm we started covering yesterday is sending password lists to ixltd@postone.com . Just a quick heads up that you may want to watch stuff sent to that address. Anybody here from Singapore? postone.com is registered to a singapore company. -- --------------------------------------------------------------- jullrich@sans.org Collaborative Intrusion Detection join http://www.dshield.org