Chasing a narq for The Crazed Asylum (TCA) by Corner Deli FTP
1 of 1 file
scytale
- Browsers may flag this download as unwanted or malicious. If unsure, scan it with VirusTotal.
-
Last modified Jan 30, 2014 6:09:26 PM
MD5 checksum 29fb93690dca42f1d99cc947ff7c0320
Mime type ASCII text, with CRLF line terminators
Download tcd2.txt
Size 1 kB
Final hop in narc-email return path:
Received: from [128.84.214.150] by send1b; Wed, 04 Feb 1998 19:48:14
PST
Name: TOMCAT.CADIF.CORNELL.EDU
Address: 128.84.214.150
http://cadif.cornell.edu = Holister Computer Labs, where scytale works
--------------------------------------------------------------------
>From narc-email:
250- | 2 | 8m 58s | 1/1.2M | /incoming/utils/Compression.Plus.v5.0.32-Bit.F |
drwxrwxrwx 2 frznwate RISC 1024 Feb 5 03:14
Compression.Plus.v5.0.32-Bit.For.VB-GPF
rftpd uses GMT, thats 10:14pm EST, + 9 mins = Feb 4th approx 10:23pm EST
when the new/ls was done
Feb 4 21:51:59 gorchfock in.ftpd[32695]: connect from 128.253.185.63
Feb 4 21:52:53 gorchfock in.ftpd[32718]: connect from 128.253.185.63
Feb 4 21:53:08 gorchfock in.ftpd[32725]: connect from 128.253.185.63
Feb 4 22:07:14 gorchfock in.fingerd[314]: connect from 128.253.185.63
--------------------------------------------------------------------
<chor> thanks man, i just hope this whole thing blows over
[0:21] <sCytale> yeah me too
<chor> so how well do you know your cositeops?
[0:23] <sCytale> not very well
[0:35] <sCytale> does chor knows the e-mail was sent from cornell?
<chor> yes
<chor> i hope that was the right window
<chor> otherwise, i htink you've just incriminated yourself
<chor> you do know that i know you work in the hollister labs, right?
----------------------------------------------------------------------