Add notes on server side of the attack

* Fix typo