4

Hey their did anybody notice unauthorized login attempt over ssh. Means I have a demo digitalocean droplet I just left it for some logs their isn't any imp data over but when I try to ssh back that machine after an interval of max 5 to 6 days after login message displayed their were 9876 login attempts were made, then I directly go to ssh log over secure log file get all those IP, found out max were from China some from France and all are doing random login names like user, admin etc etc and with random password over multiple ports even non standard one, is anyone finds this happening

Comments
  • 1
    It is bots, they roam the internet in search of a easy target. Very common
  • 0
    But why other non standard port I know it's bot as no single person sit down and doing this thinking but why from these two country
  • 0
    @antoniomerlin
    Heard of nmap?
  • 0
    Oooh no I'm getting 25k a day and I'm the only one using the server
  • 0
    @b3b3
    Fail2ban to the rescue!
    Every bot are banned for a week, reported to blacklists and a email is sent to abuse.
    Automatically!
  • 2
    @b3b3 Every server I have is at around 10-20K a fucking hour. Gotta love CSF!
  • 0
    @linuxxx ummm but your website or whatever gets used a lot I guess? 🤔
    @Linux yup f2b actually is a great tool. Also to ban yourself (I'm retarded I know). But if you don't forget your password its useful I guess 💁
  • 1
    @b3b3
    Trust me, I have banned myself and almost got my server suspended because of the abuse reports that went to the other servers abuse department ;)
  • 0
    Yup, I know nmap, just I am curious what they are trying to do after getting access just gonna lay some traps wish me luck
  • 0
    FYI I also did reverse lookup
Add Comment