Thanks guys--that's reassuring to know. The log only says suspicious tcp data and then gives the port number that it was trying to access h3r3tic, not sure if I can get it to give any more specific data on the type of request--will check it out and do the whois too--I seem to remember that there are different whois for different countries?