North American Network Operators Group
Date Prev | Date Next |
Date Index |
Thread Index |
Author Index |
Historical
Re: Disabling QAZ (was Re: Port 139 scans)
- From: Dan Hollis
- Date: Fri Sep 29 16:16:09 2000
On Fri, 29 Sep 2000, Mike Lewinski wrote:
> the e-mail or not. I believe that this SMTP isn't actually responsible for
> _any_ legitimate mail, a check on MX records for yeah.net shows that it's
> not listed there. Perhaps the attackers have modified the MTA itself now to
> hide their tracks, making it look like that address has been disabled (the
> virus doesn't know this, and will keep trying to send at every reboot, btw).
How about asking the tier1's to null0 route that chinese MTA?
We are blocking 139/tcp and 7597/tcp on our borders.
-Dan
|
