MIT has quite the number of subdomains. I myself found that a server I managed had been exploited via Roundcube a few years ago and saw that the domain http://

MIT has quite the number of subdomains. I myself found that a server I managed had been exploited via Roundcube a few years ago and saw that the domain http://esi.mit.edu/ http://esi.mit.edu/, running on Drupal or something then, had been hacked by the same people (tracked back the source via the Apache HTTP logs, came from a Drupal instance that had been hacked) - links to bad websites could be found hidden in the source code to presumably improve their Google ranking. I notified ESI and they took it down. I can't imagine that with the number of subdomains MIT has that this could have been all that difficult or noteworthy.