:) dunno, Alex. 1443 attempts over a 5 day period, including: 264 attempts at 'postgres' 574 attempts at 'oracle' 585 at 'nagios' 15 at 'tesztuser' from 37.187.75.221 aka duhless.net http://vk.com/duhlessnet http://wa-com.com/duhless.net A registry in Russia, anonymized by an Australian outfit Who buy service from ovh.net in France. Stalked, or repeatedly scanned by a compromised box? It looks intentional, not compromised, to me. Le Dimanche 10 novembre 2013 22h18, Alex Smith <alex(a)alexsmith.org> a écrit : On Sun, Nov 10, 2013 at 7:21 PM, Max B <txtmb(a)yahoo.fr> wrote: Stalked, or repeatedly scanned by a compromised box? _______________________________________________ users mailing list users(a)lists.bitfolk.com https://lists.bitfolk.com/mailman/listinfo/users

Hi Max, On Sun, Nov 10, 2013 at 09:46:35PM +0000, Max B wrote: If by "attempts", you mean SSH login tries, then: Most of my hosts have SSH login attempts from this IP on hundreds of different user names and that is with Fail2Ban operating. Without it I wouldn't be surprised to see thousands or tens of thousands of attempts. Looks very much like a typical compromised box doing SSH dictionary attacks. I would not consider this targeted at any individual site or host, unless there is something else you aren't mentioning. The registrar and hosting arrangements don't appear unusual for a large proportion of domain names out there. You will probably never establish whether it's someone server that's been compromised or someone's server that was bought for nefarious purposes, but assuming they have a special interest in you is in my opinion going too far based on evidence provided. Cheers, Andy -- http://bitfolk.com/ -- No-nonsense VPS hosting

Thanks Alex, Andy, attenuate I'm now satisfied that it is a random attack. I'm still wonder ing about the failure log problem in deb 7, though.  :) Cheers Le Dimanche 10 novembre 2013 22h57, Andy Smith <andy(a)bitfolk.com> a écrit : Hi Max, On Sun, Nov 10, 2013 at 09:46:35PM +0000, Max B wrote: including: If by "attempts", you mean SSH login tries, then: Most of my hosts have SSH login attempts from this IP on hundreds of different user names and that is with Fail2Ban operating. Without it I wouldn't be surprised to see thousands or tens of thousands of attempts. Looks very much like a typical compromised box doing SSH dictionary attacks. I would not consider this targeted at any individual site or host, unless there is something else you aren't mentioning. The registrar and hosting arrangements don't appear unusual for a large proportion of domain names out there. You will probably never establish whether it's someone server that's been compromised or someone's server that was bought for nefarious purposes, but assuming they have a special interest in you is in my opinion going too far based on evidence provided. Cheers, Andy -- http://bitfolk.com/ -- No-nonsense VPS hosting _______________________________________________ users mailing list users(a)lists.bitfolk.com https://lists.bitfolk.com/mailman/listinfo/users