[31583] in North American Network Operators' Group
Re: Disabling QAZ (was Re: Port 139 scans)
daemon@ATHENA.MIT.EDU (Dan Hollis)
Fri Sep 29 16:14:52 2000
Date: Fri, 29 Sep 2000 13:12:45 -0700 (PDT)
From: Dan Hollis <goemon@sasami.anime.net>
To: "'nanog@merit.edu'" <nanog@merit.edu>
Message-ID: <Pine.LNX.4.21.0009291312370.16988-100000@anime.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Errors-To: owner-nanog-outgoing@merit.edu
On Fri, 29 Sep 2000, Mike Lewinski wrote:
> the e-mail or not. I believe that this SMTP isn't actually responsible for
> _any_ legitimate mail, a check on MX records for yeah.net shows that it's
> not listed there. Perhaps the attackers have modified the MTA itself now to
> hide their tracks, making it look like that address has been disabled (the
> virus doesn't know this, and will keep trying to send at every reboot, btw).
How about asking the tier1's to null0 route that chinese MTA?
We are blocking 139/tcp and 7597/tcp on our borders.
-Dan
