-
Please see the most recent updates in the "Where did the .com name go?" thread. Posts number 16 and 17.
Attempted Hacking, A Company Who Cares
- Thread starter Ickie
- Start date
Railrunner130
Charter Member
Very good! Glad to hear someone is fighting this war!
T
tigisfat
Guest
Cool, what exactly did they do?
Ickie
SOH Administrator
they got caught trying to hack us but my scripts logged him and banned the ip address and it just stopped.
brute force hacking is what its called.
here is the log:
The remote system 213.50.52.14 was found to have exceeded acceptable login failures on worm.sim-outhouse.com; there was 61 events to the service pure-ftpd. As such the attacking host has been banned from further accessing this system. For the integrity of your host you should investigate this event as soon as possible.
Executed ban command:
/etc/apf/apf -d 213.50.52.14 {bfd.pure-ftpd}
The following are event logs from 213.50.52.14 on service pure-ftpd (all time stamps are GMT -0400):
Jun 12 01:07:43 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:07:43 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:07:47 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:07:48 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:07:49 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:07:49 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:08:01 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:08:32 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:08:33 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:08:33 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:08:36 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:08:39 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:08:39 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:08:40 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:08:42 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:08:42 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:08:43 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:09:19 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:09:25 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:09:25 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:09:26 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:09:31 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:09:35 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:09:35 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:09:35 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:09:35 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:09:35 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:09:59 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:10:02 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:10:04 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:10:11 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:10:16 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:10:21 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:10:22 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:10:22 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:10:28 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:10:29 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:10:30 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:10:30 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:10:33 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:10:33 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:10:33 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:11:02 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:11:07 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:11:12 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:11:20 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:11:20 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:11:20 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:11:23 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:11:24 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:11:24 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:11:28 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:11:29 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:11:29 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:12:01 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:12:06 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:12:10 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:12:14 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:12:14 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:12:17 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:12:18 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:12:18 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:12:19 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:12:24 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:12:24 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:12:24 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:12:24 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:12:31 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:13:09 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:13:09 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:13:10 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:13:12 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:13:12 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:13:13 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:13:18 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:13:18 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:13:19 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:14:03 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:14:04 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:14:04 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:14:05 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:14:06 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:14:06 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:14:12 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:14:13 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:14:13 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:14:58 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:14:58 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:14:59 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:14:59 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:14:59 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:14:59 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:15:02 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:15:02 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:15:02 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:15:04 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:15:05 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:15:23 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:15:54 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:15:54 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:15:54 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:15:55 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:15:55 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:15:55 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:15:56 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:15:56 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:15:56 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:16:09 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:16:37 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:16:37 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:16:43 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:16:49 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:16:49 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:16:50 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:16:50 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:16:51 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:16:51 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:16:51 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:16:52 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:16:52 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:17:31 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:17:35 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:17:35 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:17:40 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:17:42 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:17:42 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:17:43 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:17:44 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:17:44 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:17:45 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:17:45 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:17:46 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:17:46 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:18:06 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:18:29 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:18:29 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:18:30 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:18:35 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:18:37 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:18:37 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:18:38 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:18:38 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:18:39 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:18:39 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:18:39 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:18:39 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:18:40 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:18:54 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:18:54 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:18:59 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:19:03 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:19:24 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:19:24 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:19:24 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:19:32 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:19:32 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:19:32 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:19:32 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:19:32 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:19:32 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:19:33 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:19:34 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:19:34 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:19:45 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:19:46 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:19:46 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:20:03 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:20:05 worm BFD(1112): {pure-ftpd} 213.50.52.14 exceeded login failures; executed ban command '/etc/apf/apf -d 213.50.52.14 {bfd.pure-ftpd}'.
----
brute force hacking is what its called.
here is the log:
The remote system 213.50.52.14 was found to have exceeded acceptable login failures on worm.sim-outhouse.com; there was 61 events to the service pure-ftpd. As such the attacking host has been banned from further accessing this system. For the integrity of your host you should investigate this event as soon as possible.
Executed ban command:
/etc/apf/apf -d 213.50.52.14 {bfd.pure-ftpd}
The following are event logs from 213.50.52.14 on service pure-ftpd (all time stamps are GMT -0400):
Jun 12 01:07:43 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:07:43 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:07:47 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:07:48 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:07:49 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:07:49 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:08:01 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:08:32 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:08:33 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:08:33 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:08:36 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:08:39 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:08:39 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:08:40 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:08:42 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:08:42 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:08:43 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:09:19 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:09:25 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:09:25 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:09:26 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:09:31 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:09:35 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:09:35 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:09:35 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:09:35 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:09:35 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:09:59 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:10:02 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:10:04 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:10:11 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:10:16 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:10:21 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:10:22 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:10:22 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:10:28 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:10:29 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:10:30 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:10:30 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:10:33 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:10:33 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:10:33 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:11:02 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:11:07 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:11:12 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:11:20 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:11:20 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:11:20 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:11:23 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:11:24 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:11:24 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:11:28 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:11:29 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:11:29 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:12:01 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:12:06 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:12:10 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:12:14 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:12:14 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:12:17 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:12:18 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:12:18 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:12:19 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:12:24 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:12:24 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:12:24 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:12:24 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:12:31 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:13:09 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:13:09 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:13:10 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:13:12 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:13:12 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:13:13 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:13:18 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:13:18 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:13:19 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:14:03 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:14:04 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:14:04 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:14:05 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:14:06 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:14:06 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:14:12 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:14:13 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:14:13 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:14:58 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:14:58 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:14:59 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:14:59 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:14:59 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:14:59 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:15:02 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:15:02 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:15:02 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:15:04 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:15:05 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:15:23 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:15:54 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:15:54 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:15:54 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:15:55 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:15:55 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:15:55 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:15:56 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:15:56 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:15:56 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:16:09 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:16:37 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:16:37 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:16:43 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:16:49 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:16:49 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:16:50 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:16:50 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:16:51 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:16:51 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:16:51 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:16:52 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:16:52 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:17:31 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:17:35 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:17:35 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:17:40 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:17:42 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:17:42 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:17:43 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:17:44 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:17:44 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:17:45 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:17:45 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:17:46 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:17:46 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:18:06 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:18:29 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:18:29 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:18:30 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:18:35 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:18:37 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:18:37 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:18:38 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:18:38 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:18:39 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:18:39 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:18:39 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:18:39 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:18:40 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:18:54 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:18:54 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:18:59 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:19:03 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:19:24 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:19:24 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:19:24 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:19:32 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:19:32 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:19:32 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:19:32 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:19:32 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:19:32 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:19:33 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:19:34 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:19:34 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:19:45 worm pure-ftpd: (?@213.50.52.14) [ERROR] Too many authentication failures Jun 12 01:19:46 worm pure-ftpd: (?@213.50.52.14) [INFO] New connection from 213.50.52.14 Jun 12 01:19:46 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:20:03 worm pure-ftpd: (?@213.50.52.14) [WARNING] Authentication failed for user [Administrator] Jun 12 01:20:05 worm BFD(1112): {pure-ftpd} 213.50.52.14 exceeded login failures; executed ban command '/etc/apf/apf -d 213.50.52.14 {bfd.pure-ftpd}'.
----
M
MCDesigns
Guest
I say cut off his worm and send it back to him. :d
Now yer talking!!! :ernae:
way to go Sweden!
cheezyflier
Charter Member
Q
quantumleap
Guest
As someone who has run multi-million dollar data centres sat on the Internet, many times unfortunately you find attempts like this are just automated scripts running on machines which were previously compromised themselves and now just acting as proxys. The person who owns the machine at 213.50.52.14 may not even have been aware that it was happening.
Jeff
Jeff