MPIA 15 459 1133 - · Dst: Type: icmp time exceeded in-transit [tos OxcO] /-----, -----\ > > > > > > > > > ® . MPIA 15 459 11302/17/99 , !

$Page 1: MPIA 15 459 1133 - · Dst: Type: icmp time exceeded in-transit [tos OxcO] /-----, -----\ > > > > > > > > > ® . MPIA 15 459 11302/17/99 , !$
---- "- ,

FEE 08 ' 99 08: 41At'1 DHtvlH PERSmlNEL H· -"0.- Forwarded message _

Date: Thu, 21 Jan 1999 20:24:34 -oaoo From: Vu Tran <[email protected]> To: [email protected]. [email protected], bat [email protected],

[email protected], [email protected], WlJ [email protected], [email protected], air.JTlanB1@hotmail,com, khema @gl.umbc,edu, ajoshU1 @gl.umbe.edu, iloshu1 @gl.umbe.edu, mam [email protected], [email protected], [email protected], summa [email protected], [email protected], [email protected], syed . [email protected],

. [email protected], [email protected], [email protected], [email protected], ms [email protected]

SUbJect: Re: Hae lee .

Can anyone \oerify this information? I'm having a hard ti ,belie'otng this. I was a classmate of her's in Califomia, before she mow Ito Maine(in case anyone's WOndering). I don't want to belie'S in the WOrst . ntil someone's giwn me some solid proof .... 1 just don't know what to b I$VQ right now ... .. Vu Tran [email protected]

Message-Imrsn H.

[email protected] <[email protected]> Llate: Wednesday. January 20, 19999:38 AM Subject: Re: Hae Lee

>Well I guess I Should let you know as well, Since you a concemed and > every thing. I guess you talk to Hae. over the net or some "'ing, but she >won't be on there anymore. She was stabbed to death r .t week at >Woodlawn High Schoo/. Ewn though she was rushed t ! the hospital there >was too much blood lost and they could not S8\9 her in .me. Sony >about the sad news, but , feel you Should now and not wsts your time on >the intemet trying to find, because she is no longer Withs. May GOd her. .

---'--'-- Headers --.-____ , ______ •

P.l

Return-Path: <[email protected]> Recei\led: from rfy-yb04.mx.aoLcom (rly-yb04.mail.aol.co . f172.1S.146.4J> by air-yb03.mail.a I COrR(VS6,24) with SMi'P; Fa, 05 Feb 1999 14:27:14 -0500 ReceilJ!d: from pOhLacpub.duke.edu (pohLacpub.duke.edu {152.3.233.64j}

by (8.8 SIS. 8. 5JAOL4.0.0)

------------------ ---------------- ------_¥ ---MPIA 15 459 1132

MPIA 15 459 1133

Whois Query Results

Registrant: GeoCities

1918 Main street, Third Floor santa Monica, CA 90405-1030

Domain Name: GEOCITIES.COM

Administrative Contact, Technic 11 Contact, Zone Contact: Administrator, DNS (AD226-0 '§) [email protected] (310) 827-3700

Fax- (310) 827-8177 Billing Contact:

Administrator, DNS [email protected] (310) 827-3700

Fax- (310) 827-8177

Record last updated on 05-May-9 Database last updated on

Domain servers in listed order:

NS2.GEOCITIES.COM NS.GEOCITIES.COM NS.EXODUS.NET NS2.EXODUS.NET

The InterNIC Registration Service non-military and non-US Governmen Other associated whois servers:

American Registry for Internet European IP Address Allocation Asia Pacific IP Address Alloca US Military US Government

http://www.internic.netlcgi-bin/whois

08:14:18 EST.

.111. 43.200

.79.230.10

I

i database contains ONLY Domains and contacts.

I I rumbers - whois.arin.net i - whois.ripe.net

- whois.apnic.net - whois.nic.mil - whois.nic.gov

2/17/99 MPIA 15 459 1134

Whois Query Results

Registrant: Yahoo (YAHOO-DOM)

3400 Central Expressway, Santa Clara, CA 95051

Domain YAHOO.COM

Administrative Contact, Technic I Contact, Zone Contact: Hanley, John P (JPH17) not'[email protected] +1 408 530 5002

Billing Contact: Hanley, John P (JPH17) +1 408 530 5002

Record last updated on 14-Feb-Database last updated on 17-Fe

Domain servers in listed

NS1.YAHOO.COM NS2.DCA.YAHOO.COM NS5.DCX.YAHOO.COM NS.EUROPE.YAHOO.COM

The InterNIC Registration Service non-military and non-US Governmen Other associated whois servers:

American Registry for Internet European IP Address Allocation Asia Pacific IP Address Alloca US Military US Government

http://www.internic.net/cgi-binlwhois

08:14:18 EST.

I database contains ONLY I Domains and contacts.

- whois.arin.net - whois.ripe.net - whois.apnic.net - whois.nic.mil - whois.nic.gov

2117/99 MPIA 15 459 1135

w nOlS

Whois Query Results

Registrant: Hotmail Corporation

1290 Oakmead Parkway, Suite 218 Sunnyvale, CA 94086

Domain Name: HOTMAIL.COM

Administrative Contact, Technic Contact, Zone Contact: Delucchi, Randy r 408-222-7037 (FAX) 408-222-7

Billing Contact: I

Delucchi, Randy CBD3J_Ol) r COM 408-222-7037 (FAX) 408-222-7

Record last updated on 12-Dec-9 I

Database last updated on 17-Feb 199 08: 14: 18 EST.


NS.EXODUS.NET NS2.EXODUS.NET

I. 0

The InterNIC Registration Services non-military and non-US Government Other associated whois servers:

American Registry for Internet European IP Address Allocations Asia Pacific IP Address Allocat US Military US Government

http://www.internic.net/cgi-binlwhois

'I'database contains ONLY pomains and contacts.


... _--.. ...

2/17/99 MPIA 15 459 1136

Whois Query Results

Registrant: Uni versi ty of Maryland Baltimore Co·· nty (1!!il'Lc:- DOI1l

1000 Hilltop Circle Baltimore, MD 21250

Domain Name: UMBC.EDU

Administrative Contact: Suess, John J (JJS41) jack (410)455-2582

Technical Contact, Zone Contact:; Dinkin, Daniel A da (410)455-3631 .

Billing Contact: Suess, John J (JJS{l) jack (410)455-2582

I

Record last updated on 19-Jan-9 I

Database last updated on 17-Feb 199 08:14:18 EST.


UMBC3.UMBC.EDU UMBC4.UMBC.EDU UMBC5.UMBC.EDU DNS.SLU.EDU

.85.1.3

.85.1.4

.85.1_._§.

.13tJ·25

The InterNIC Registration Services database contains ONLY non-military and non-US Government Domains and contacts. Other associated whois servers:

American Registry for Internet umbers European IP Address Allocations Asia Pacific IP Address Allocat'ons US Military . US Government


http://www.internic.net/cgi-binlwhois 2117/99 MPIA 15 459 1137

WhOlS \,luery KeSUltS

Whois Query Results

Registrant: MindSpring Enterprises, Inc. (PIPE INE4-DOM)

1430 West Peachtree Street NE Suite 400 Atlanta, GA 30309 USA

Domain Name: PIPELINE.COM

Administrative Contact: MindSpring Abuse (!1A127::.QF.G 404-815-0770

Fax- 404-815-8805 Technical Contact, Zone Contact

[email protected]

Hostmaster (HOS272-0RG) ho [email protected] 404-815-0770

Fax- 404-815-8805 Billing Contact:

Domain Billing omain.billing@MINDSPRING. M 888-932-1997

Fax- - 404-287-0883

Record last updated on 09-May-9 Database last updated on 17-Feb 99 08:14:18 EST.


ITCHY.MINDSPRING.NET SCRATCHY.MINDSPRING.NET BURDELL.CC.GATECH.EDU

20 .69.200.210 -' 69 . 2

13 .207.3.207


American Registry for Internet umbers European IP Address Allocations Asia Pacific IP Address Allocat'ons US Military US Government


http://www.internic.net/cgi-binlwhois 2117/99 MPIA 15 459 1138

VV IlU 1:S \.lu\;;ry

Whois Query Results

Registrant: NETCOM On-Line Communication Servic s, Inc (NETCOM-QOM)

2 N Second Street San Jose, CA 95113 US

Domain Name: NETCOM.COM

Administrative Contact: NETCOM Abuse Department (408) 881-1810

Technical Contact, Zone Contact:

[email protected]

NETCOM Hostmaster (NETCOM;- .) [email protected]. T 888-698-HELP

Fax- -408-881-3336 Billing Contact:

NETCOM Accounts Payable dns-billing@NETC .COM (408) 881-3328

Record last updated on 14-Sep-9 Database last updated on 17-Feb 99 08:14:18 EST.


AS1.NETCOM.COM AS2.NETCOM.COM AS3.NETCOM.COM AS4.NETCOM.COM


American Registry for Internet umbers European IP Address Allocations Asia Pacific IP Address Allocat'ons US Military US Government

http://www.internic.netlcgi-binlwhois


2/17199 MPIA 15 459 1139

w no IS Kesu!ts 1 Vl 1

Whois Query Results

Registrant: America Online (AOL-DOM)

22000 AOL Way Dulles, VA 20166 US

Domain Name: AOL.COM

Administrative Contact, AOL Domain Administration (703) 265-4670

Zone Contact, 'lling Contact: [email protected]

Record last updated Database last updated on 08:14:18 EST.


DNS-01.NS.AOL.COM DNS-02.NS.AOL.COM

The InterNIC Registration Services database contains ONLY non-military and non-US Governmen Domains and contacts. Other associated whois servers:

American Registry for Internet Numbers European IP Address Allocations Asia Pacific IP Address Alloca ions US Military US Government

http://www.internic.neticgi-binlwhois


2117/99 MPIA 15 459 1140

Security 160299-1 1

Category: Security

Security 160299-1 1 Security 160299-1 Rec'd copy of subpoena for "Any and All log data pertaining to di lup connection identified as pp 062.dialup.umbc.edu on 01/20/99 @ 9:36:44

Name: ppp-062.dialup.umbc.edu Address: 130.85.97.62

Mark's records:

The following log entries indicate tha tnadee1 was using that IP add ss at 9:26am on January 20, 1999. I can not find are ord of this user in PH. Rob sa that the records may be lost. The telephone number hat this user dialed in from, on J nuary 20, 1999, was 410-744

Wed Jan 20 01 :16:18 1999 NAS-Identifier = 130.85.2.204 NAS-Port = 3 User-Name = "tnadee1" Client-Port-DNIS = "7191094" Caller-Id = "410744 Acct-Status-Type = 3 Acct-Authentic = RADI US User-Service = Framed-User Acct-Session-Id = "00006381" Framed-Protocol = PPP Framed-Address = 130.85.97.6 Acct-Delay-Time = 0

Wed Jan 2011:29:321999 NAS-Identifier = 130.85.2.204 NAS-Port = 3 User-Name = "tnadee1" Client-Port-DNIS = "7191094" Caller-Id = "4107443933" Acct-Status-Type = Stop Acct-Authentic = RADIUS User-Service = Framed-User Acct-Session-Id = "00006381" Framed-Protocol = PPP Framed-Address = 130.85.97.6 Acct-Input-Octets = 979129 Acct-Output-Octets = 15262314 Acct-Input-Packets = 16587 Acct-Output-Packets = 32832

MPIA 15 459 1141

Security 160299-1 1

Acct-Session-Time = 36797 Acct-Delay-Time = 0

Time: 07:49:46.951567 Src: resnet-32.resnet.umbc.edu.192 Dst: www.hotmail.com.pop-3 Type: S

Time: 07:49:47.533046 Src: resnet-32.resnet.umbc.edu.192 Dst: www.hotmail.com.pop-3 Type:S



Time: 08:00:45.075542 Src: cisco2-dw.umbc.edu Dst: www.hotmail.com Type: icmp

• .

time exceeded in-transit

Time: 08:01 :28.254645 Src: cisco2-dw.umbc.edu Dst: www.hotmail.com Type: icmp


--------------------------------------Time: 08:02:08.727341 Src: cisco2-dw.umbc.edu Dst: www.hotmail.com Type: icmp


--------------------------------------Time: 08:52:43.775241 Src: rsm1.umbc.edu Dst: www.hotmail.com Type: icmp time exceeded

2 MPIA 15 459 1142

Security 160299-1 1

in-transit [tos OxcO]

Security 160299-1 2

Time: 08:52:44.030615 Src: rsm1.umbc.edu Dst: www.hotmaiLcom Type: icmp

time exceeded in-transit [tos OxcO]

\ --------------------------------------Time: 08:52:44.317893 Src: rsm1.umbc.edu Dst: www.hotmaiLcom Type: icmp


Time: 09:07:14.263754 Src: rsm1.umbc.edu Dst: www.hotmaiLcom Type: icmp


Time: 09:36:35.144417 Src: umbc9.umbc.edu.5497 Dst: www.hotmail.com.finger Type:S

Time: 10:01 :30.634501 Src: rsm1.umbc.edu Dst: www.hotmaiLcom Type: icmp


Time: 10:18:14.415584 Src: saturn.umbc.edu Dst: www.hotmaiLcom Type: icmp

time exceeded in-transit [tos

3 MPIA 15 459 1143

Security 160299-1 1

OxcO] /-------, -------------------------------------------

Note the finger of hotmail.c m from umbc9 at 09:36 5.

ph> query name="nade*"

name: tahir nadeem curriculum: bs ifsm

homepage: http://www.gl.u bc.edu/-ntahir11 email to: [email protected] ([email protected])

\

name: nader momeni curriculum: undc

email to: [email protected] [email protected])

name: bhatti nadeem email to: [email protected] (n [email protected])

name: hosni nader email to: [email protected] (n [email protected])

name: kilada nader curriculum: undc

email to: [email protected] (nk [email protected])

ph> query alias=ntahir1 return all

alias: ntahir1 name: tahir nadeem

email: [email protected] curriculum: bs ifsm

type: person validated: 1998/11/22

created: 1996/09/04 homepage: http://www.gLumbc.edu/ ntahir1/

group: research vms_uic: 13389.80

vms_username: ntahir1 unix_uid: 13389

inst_created: 96/9/5 res_created: 1998/9/28 afs_created: 1998/06/15

[andy@gecko] January 45 > "tnadee ntahir grep ntahir 160299-1.syslog.dump

MPIA 15 459 1144

Security 160299-1 1

Jan 2001:18:28 umbc9Iogin[18E37]: failed: [email protected] p.umbc.edu as ntahir1 A[OB Jan 2001 :18:36 umbc9 login[18€ 37]: as ntahir1

5 MPIA 15 459 1145

IVlessage

Read Message a attachment 1

Message - Q9w_nload

From: "Vu Tran" <[email protected] >Add to Address To: "Bill Ritz" <[email protected]>

Subject: Re: Rae Lee Date: Wed, 17 Feb 1999 18:49:28 -080

Back to l!lbox

hoose Folder -

Thank you for informing me .... The time I e-mailedeverne.it was a hoax, but I'm saddened that she di die afterall ... I'll be thought this was a hoax as well, btl checked Yahoo's news and confirmed it for myself. I'm aware Ii that the police hasn't re information regarding the cause of death according to the on published on 2/12/99, but if it ha been released, may I ask murdered? If you can't, please let me know when you do information publically. Thank you or your time.

Sincerely, Vu Tran Hayward, CA

-----Original Message-----From: Bill Ritz <[email protected] To: Date: Wednesday, February 17, 1999 Subject: Hae Lee

I

ipelipe.com> 4:12 PM

>Comments regarding your email >The information that you were >contact me tomorrow regarding

senf on January 21, 1999 ... gi n is true; she is deceas her death.

> > > >Detective Ritz >Baltimore City >601 E. Fayette >Baltimore, MD >410-396-2100 > > > >

Homicide Unit Street 21202

>

>Get your free @yahoo.com address >

.. .IwmailLetter.py?Pyt=Tym&YY=835&bo =Inbox&message=9201_2174

nest, I adlines,

ased any 'ne article ow she was

the

Please

7_915_1187_0&s02/18/99 MPIA 15 459 1129

Compose

Compose Mail

use commas between addresses

To:

Subject: Cc:

o Save copy of outgoing message to

omments regarding your email 1999 ...

information that you were Please contact me

ctive Ritz timore City

601 E. Fayette timore, MD

10-396-2100

Homicide Unit Street 21202

o Use Signature ® plain text 0 html tags

on January 21,

is true; she is row regarding her

Attachments: Requires MSIE 4 or the MSIE

Copyright © 1997-99 Yahoo! Inc. All rights .. o<!,o ... ",n

http://f6 . mail. yahoo. YY=30766

raI:;l;; 1. V1. 1.

2/17/99 MPIA 15 459 1130

Mall :sena .La!:>,",.l V.l.l

Mail Sent

Your mail (Hae Lee) has been sent.

You can return to your or you can lew messages in your other fold s by using the left-hand navigation bar.

Copyright © 1997-99 Yahoo fIne. All rights rese

, !

http://f6.mail.yahoo.com/py/wmailMessagebion.py?Pyt=Tym&YY=8540 2117/99 MPIA 15 459 1131

Documents

MPIA 15 459 1133 - · Dst: Type: icmp time exceeded in-transit [tos OxcO] /-----, -----\ > > > > > > > > > ® . MPIA 15 459 11302/17/99 , !