From owner-freebsd-security  Sun Jun 23 20:46:59 1996
Return-Path: owner-security
Received: (from root@localhost)
          by freefall.freebsd.org (8.7.5/8.7.3) id UAA18438
          for security-outgoing; Sun, 23 Jun 1996 20:46:59 -0700 (PDT)
Received: from sequent.kiae.su (sequent.kiae.su [193.125.152.6])
          by freefall.freebsd.org (8.7.5/8.7.3) with SMTP id UAA18432;
          Sun, 23 Jun 1996 20:46:54 -0700 (PDT)
Received: by sequent.kiae.su id AA26559
  (5.65.kiae-2 ); Mon, 24 Jun 1996 07:40:24 +0400
Received: by sequent.KIAE.su (UUMAIL/2.0); Mon, 24 Jun 96 07:40:24 +0400
Received: (from ache@localhost) by nagual.ru (8.7.5/8.7.3) id HAA00490; Mon, 24 Jun 1996 07:35:40 +0400 (MSD)
Message-Id: <199606240335.HAA00490@nagual.ru>
Subject: Re: I need help on this one - please help me track this guy down!
To: jkh@time.cdrom.com (Jordan K. Hubbard)
Date: Mon, 24 Jun 1996 07:35:39 +0400 (MSD)
Cc: hasty@rah.star-gate.com, hackers@FreeBSD.org, security@FreeBSD.org
In-Reply-To: <8378.835580425@time.cdrom.com> from "Jordan K. Hubbard" at "Jun 23, 96 06:40:25 pm"
From: =?KOI8-R?Q?=E1=CE=C4=D2=C5=CA_=FE=C5=D2=CE=CF=D7?= (Andrey A. Chernov) <ache@nagual.ru>
X-Class: Fast
X-Mailer: ELM [version 2.4ME+ PL22 (25)]
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: owner-security@FreeBSD.org
X-Loop: FreeBSD.org
Precedence: bulk

> > Also since "you" were logged in , try to look in the logs for a 
> > a loggin session of a foreign host and I would report the incident  to the
> > FBI 8)
> 
> All we have are the "last" logs, which show:
> 
> jkh       ttyp2    a235.pu.ru       Sun Jun 23 16:50 - 17:18  (00:28)
> jkh       ttyp3    a235.pu.ru       Sun Jun 23 15:00 - 15:34  (00:33)
> 
> If someone at the russian site could help correlate this time (PST) to
> the local time at wherever a235.ru.pu came in from, we could at least
> narrow down which user(s) it might have been.

This address is SLIP line somewhere in StPetersburg's University.
Local StPetersbug time is equal to Moscow time: GMT+4 now.
You can search/ask domain owner somewhere
at http://www.ripn.net/nic/NICHomePage.html

-- 
Andrey A. Chernov
<ache@nagual.ru>
http://www.nagual.ru/~ache/