[nsp-sec] DDoS against 213.27.239.85 (paging L3+NTT)

[Chris Morrow]

On Thu, 31 Jan 2008, Stephen Gill wrote:

>>> BTW, google you might want to look at this address if you haven't already:
>>>
>>> morgan.rx at gmail.com
>
>> asking to have this killed off...
>
> There might be some interesting stuff in there for LE if it hasn't been
> closed a long time ago already.

lea of course has to ask for it :( but sure. I doubt we actually RM 
anything in these cases.

>
>>> weee.. uhm, any idea what form the query gets to? we may get lucky and be
>>> able to disable this query... maybe. (like what is 'gstring' and maybe you
>>> have all the code for this problem which might make this easier? :) )
>
> Please see:
>
> http://www.vsm.gov.tr/pwnd/bot.txt

ah, I had dl'd the other links in the last email :( I'll have a look and 
see if we can do something about the query pattern even :)