Every WSI/Datashack customer who requests IPMI and doesn't secure it, if you can even do that with the trashy one they use, certainly does. Google indexes a lot of these things. It's an all you can eat buffet of wide open onboard IPMI. Googling for fun I see universities, large corporations, and...