We also tagged this as a compromised host on 12/29/2008. It was scanning our darknets for TCP 6129. Cheers, -- steve -- Stephen Gill, Chief Scientist, Team Cymru http://www.cymru.com | +1 312 924 4023 | gillsr at cymru.com