[Dshield] RR and MIS Servers
pobox2 at pinn.net
Tue Mar 19 13:17:21 GMT 2002
That is a problem, we're on an affiliate of RR and get battered from
that direction for sure. I've done resverse port 80 header lookups on
lots of them and 9 times out of 10 it'll be a MIS machine doing the
dirty work. That in itself should tell you something about the role of
MIS servers in this. It's not likely anyone's home but they're
probably slave machines or code red agents.
I knew zilch when I first got here, I listened, complained about being
hacked, got lots of good advice, did lots of serious investigating from
tips I recieved and have come quite far in a few months.
More information about the list