What follows is a sample email of the sort that is sent to the
list, NIPC, and CERT teams. It contains only information that is
publically available about the defacement.
Date: Fri, 12 Nov 2002 00:41:52 -0600 From: staff <firstname.lastname@example.org> To: email@example.com Subject: [defaced] www.example.com by skr1pt k1dd13 Defaced domain: www.example.com Site Title: Example Site Mirror: http://www.attrition.org/mirror/attrition/2002/11/12/www.example.com Defaced by: skr1pt k1dd13 Operating System: Windows NT4 Web Server: Microsoft-IIS/4.0 Potentially offensive content on defaced page. =-= This notice is being mailed as we take the mirror. It may not appear on the actual mirror at http://www.attrition.org/mirror/attrition/ for a short time. Defaced subscriber count: 1351 Total mirrors archived on Attrition: 6609 To unsubscribe: mail firstname.lastname@example.org with 'unsubscribe defaced' in the BODY of the mail.
From: email@example.com Date: Thu, 06 Jul 2000 14:27:44 -0400 To: staff <firstname.lastname@example.org> Subject: Re: Third party notification: www.example.org has been defaced. X-Mailer: Mozilla 4.7 [en] (WinNT; U) Thank you for contacting the NIPC we appreciate your interests and information is physical/cyber threatts and will forward information to the appropriate people. Sincerely, NIPC Watch and Warning Unit