Also, in respect to World of Warcraft (Only notify list I'm on), I saw another deleting quite a bit, as I was saying this morning in #winehq, I recorded deletions by Roop, no clue if they might actually be legit, but there was a lot deleted, so I thought I might throw that out there,
<br><br><div><span class="gmail_quote">On 5/23/07, <b class="gmail_sendername">Jan Zerebecki</b>
<<a href="mailto:jan.wine@zerebecki.de" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">jan.wine@zerebecki.de</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Please do _only_ address replies to this email to
<br><a href="mailto:wine-devel@winehq.org" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">wine-devel@winehq.org</a> ! Remove all other recipients from To and<br>Cc !<br><br>Work is currently underway to restore the state of the Appdb to
<br>the backup of May 22 07:00 CST.
<br><br>This morning ( TZ +0200 ) someone used the account "Molle<br>Bestefich" to vandalize the Appdb. He was also seen on IRC and on<br>the wiki. His IP was identified on all three, logs are available.<br>See towards the end of this mail for IRC log snippet and whois on
<br>his IP. Please contact me first if you intend to contact abuse or<br>police personal regarding this, so we don't cause headaches or<br>duplicate work. We do not yet know how this person got access to<br>Molle Bestefich his account.
<br><br>I received 4454 emails about deletes or other actions by the<br>account "Molle Bestefich". Send between "Date: Tue, 22 May 2007<br>21:43:46 -0500" and "Date: Tue, 22 May 2007 22:18:55 -0500". (2
<br>mails sent by the Appdb in that date range were legit actions.) I<br>don't know if these are all, because admin-accounts were<br>explicitly deleted and thus the notification to them stopped.<br><br>The following applications where mentioned in these notification emails:
<br>Adobe Illustrator<br>Battlefield 1942<br>Battlefield 2<br>Battlefield 2142<br>Call of Duty 2<br>Call of Duty<br>Checkpoint Firewall-1 Policy editor<br>Command & Conquer 3: Tiberium Wars<br>Counter-Strike: Source<br>
Day of Defeat: Source<br>Deus Ex<br>Diablo II<br>EVE Online<br>F.E.A.R.: First Encounter Assault Recon<br>Final Fantasy XI Online<br>Guild Wars<br>IDA Pro<br>Photoshop<br>S.T.A.L.K.E.R. : Shadow of Chernobyl<br>Soldat<br>
Steam<br>Supreme Commander<br>The Elder Scrolls IV: Oblivion<br>Trillian<br>World of Warcraft<br>PunkBuster<br>Rune<br>Igowin<br>Age of Empires<br>Age of Mythology<br>Black & White<br>Brothers in Arms<br>Flash<br>FlatOut
<br>.NET Framework<br>Lotus Notes<br><br>Some notifcations didn't contain a application of version, here<br>the Message-Id-s of some examples (this is probably a bug in the<br>Appdb code):<br>screen shot<br>Message-Id: <
<a href="mailto:E1HqgpS-0008Ay-OM@wine.codeweavers.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">E1HqgpS-0008Ay-OM@wine.codeweavers.com</a>><br>test result<br>Message-Id: <<a href="mailto:E1Hqgs7-0001iH-S7@wine.codeweavers.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
E1Hqgs7-0001iH-S7@wine.codeweavers.com
</a>><br>monitor<br>Message-Id: <<a href="mailto:E1HqgsD-0001mW-It@wine.codeweavers.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">E1HqgsD-0001mW-It@wine.codeweavers.com</a>><br>bug<br>
Message-Id: <<a href="mailto:E1HqhDT-0003xe-GS@wine.codeweavers.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
E1HqhDT-0003xe-GS@wine.codeweavers.com</a>><br><br>One message about a rejected bug link seemed like these type of<br>message don't contain any information:<br>Message-Id: <<a href="mailto:E1Hqh5W-0000QE-UG@wine.codeweavers.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
E1Hqh5W-0000QE-UG@wine.codeweavers.com</a>><br><br><br>On IRC from the #winehq channel:<br>Mai 23 05:27:14 --> noerrorsfound_ (n=<a href="mailto:nicholas@h10.66.119.64.ip.alltel.net" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
nicholas@h10.66.119.64.ip.alltel.net
</a>) has joined #winehq<br>[unrelated stuff deleted]<br>Mai 23 06:21:37 --- noerrorsfound_ is now known as molle-molle-moll<br>Mai 23 06:21:41 <molle-molle-moll> molle molle molle<br>Mai 23 06:21:42 <molle-molle-moll> molle
<br>Mai 23 06:21:51 <molle-molle-moll> molle<br>Mai 23 06:22:03 <molle-molle-moll> mole string<br>Mai 23 06:22:18 <molle-molle-moll> hello give thank<br>Mai 23 06:22:18 <-- Amorphous has kicked molle-molle-moll from #winehq (Amorphous)
<br><br>/whois output:<br>[06:22:38] --- [molle-molle-moll] (n=<a href="mailto:nicholas@h10.66.119.64.ip.alltel.net" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">nicholas@h10.66.119.64.ip.alltel.net
</a>) : Nicholas<br>[06:22:38] --- [whoismolle-molle-moll] <a href="http://irc.freenode.net" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
irc.freenode.net</a> :<a href="http://freenode.net/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">http://freenode.net/</a><br>[06:22:38] --- [molle-molle-moll] End of WHOIS list.<br><br><br>2007-05-23T06:50:15+0200 $ whois
<a href="http://64.119.66.10" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">64.119.66.10</a>
<br>OrgName: Windstream Communications Inc<br>OrgID: WINDS-6<br>Address: 4001 Rodney Parham Rd<br>City: Little Rock<br>StateProv: AR<br>PostalCode: 72212<br>Country: US<br><br>NetRange: <a href="http://64.119.64.0" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
64.119.64.0</a> - <a href="http://64.119.79.255" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">64.119.79.255</a><br>CIDR: <a href="http://64.119.64.0/20" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
64.119.64.0/20</a><br>NetName: WINDSTREAM-COMMUNICATIONS<br>NetHandle: NET-64-119-64-0-1<br>Parent: NET-64-0-0-0-0
<br>NetType: Direct Allocation<br>NameServer: <a href="http://NS1-AUTH.WINDSTREAM.NET" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">NS1-AUTH.WINDSTREAM.NET</a><br>NameServer: <a href="http://NS2-AUTH.WINDSTREAM.NET" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
NS2-AUTH.WINDSTREAM.NET</a><br>NameServer: <a href="http://NS3-AUTH.WINDSTREAM.NET" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
NS3-AUTH.WINDSTREAM.NET</a><br>NameServer: <a href="http://NS4-AUTH.WINDSTREAM.NET" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">NS4-AUTH.WINDSTREAM.NET</a><br>Comment: ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE
<br>RegDate: 2001-08-24<br>Updated: 2007-02-26
<br><br>OrgAbuseHandle: WINDS1-ARIN<br>OrgAbuseName: Windstream Abuse<br>OrgAbusePhone: +1-888-292-3827<br>OrgAbuseEmail: <a href="mailto:abuse@windstream.net" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
abuse@windstream.net</a><br><br>OrgTechHandle: WINDS-ARIN
<br>OrgTechName: Windstream Communications Inc<br>OrgTechPhone: +1-800-990-4449<br>OrgTechEmail: <a href="mailto:ipadmin@windstream.net" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">ipadmin@windstream.net
</a><br><br># ARIN WHOIS database, last updated 2007-05-22 19:10
<br># Enter ? for additional hints on searching ARIN's WHOIS database.<br><br><br><br></blockquote></div><br><br clear="all"><br>-- <br>Cheers,<br>Bryan