Okay, I have a server connected to the net but have not added fail2ban or
anything on top of my firewall yet.
Thought you guys might get a kick out of this one user, ip is from china,
who has got a heck of a knack for making assumptions on possible usernames.
Enjoy this..., 8000+ attempts. Scroll down for funky ones. I have no root
access enabled on this server and it is pretty bare. Just using it as a
collector of banable ips right now and it is doing a good job.
But some of these are quite interesting when you look at the keyboard
layout. They really must try to figure this mental thing out...wow.
If you take some time, there are some down right funny usernames like
1am0nly4Joomla
Igor
scoobydoo
$chooLg1rL
So for all you out there that think your cool way of making a username is
unique and not to be guessed, you might want to look at some of the lengths
this one bot went to.
58.53.192.47: 8002 times
test/password: 48 times
user/password: 45 times
fax/password: 43 times
www/password: 34 times
info/password: 27 times
/password: 24 times
bill/password: 24 times
httpd/password: 23 times
1q2w3e/password: 21 times
admin/password: 21 times
andrew/password: 20 times
guest/password: 20 times
michael/password: 19 times
paul/password: 19 times
webmaster/password: 19 times
0m0n0b0v/password: 18 times
1z2x3c4v/password: 18 times
cvs/password: 18 times
jack/password: 18 times
web/password: 18 times
1p2o3i4u5y/password: 17 times
1q2w3e1q2w3e/password: 17 times
1q2w3e4r/password: 17 times
a1s2d3/password: 17 times
1p2o3i4u/password: 16 times
linux/password: 16 times
oracle/password: 16 times
1asd2asd3asd/password: 15 times
1l2k3j4h/password: 15 times
1qaz2wsx/password: 15 times
adam/password: 15 times
alex/password: 15 times
mnbvcxz/password: 15 times
!@#$!@#$/password: 14 times
!@#QWE/password: 14 times
!@#qwerty/password: 14 times
!QAZ at WSX#EDC/password: 14 times
1qaz2wsx3edc4rfv/password: 14 times
PASSWD/password: 14 times
PASSWORD/password: 14 times
]'/password: 14 times
library/password: 14 times
maggie/password: 14 times
pgsql/password: 14 times
rpcuser/password: 14 times
test!@#/password: 14 times
username/password: 14 times
zxcvbn/password: 14 times
0okmnji98uhb/password: 13 times
amanda/password: 13 times
sales/password: 13 times
1q1q2w2w3e3e/password: 12 times
alan/password: 12 times
bash/password: 12 times
internet/password: 12 times
johnson/password: 12 times
max/password: 12 times
postgres/password: 12 times
root123456/password: 12 times
temp/password: 12 times
tmp/password: 12 times
webadmin/password: 12 times
!@#$%^&*()/password: 11 times
!@#$/password: 11 times
abc123/password: 11 times
backup/password: 11 times
cat/password: 11 times
david/password: 11 times
feng/password: 11 times
gateway/password: 11 times
john/password: 11 times
master/password: 11 times
print/password: 11 times
service/password: 11 times
0m0n0b0v0c0x0z/password: 10 times
0m9n8b7v6c5x4z/password: 10 times
0qa9z87w6s5x4e3d2c1/password: 10 times
123q123a123z/password: 10 times
123q123w123e123r123t123y/password: 10 times
12z12x12c/password: 10 times
1a2a1s2s1d2d/password: 10 times
1m2k3o/password: 10 times
1m2k3o4n5j6i/password: 10 times
1p2p3o4i/password: 10 times
1q1q1q1q1q/password: 10 times
1q2q1w2w/password: 10 times
3wa2q1/password: 10 times
5z4a3qx2s1w/password: 10 times
a1s2d3f4/password: 10 times
a1s2d3f4g5/password: 10 times
aki/password: 10 times
china/password: 10 times
q1w2e3/password: 10 times
q1w2e3r4t5/password: 10 times
rajesh/password: 10 times
rakesh/password: 10 times
susan/password: 10 times
test1/password: 10 times
tomcat/password: 10 times
z1x2c3/password: 10 times
z1x2c3v4b5/password: 10 times
0z0x0c0v/password: 9 times
0z9x8c7v/password: 9 times
1p1o1i1u/password: 9 times
alice/password: 9 times
cvsuser/password: 9 times
p0o9p0o9/password: 9 times
z0x9c8v7/password: 9 times
z0x9c8v7b6/password: 9 times
.369*/password: 8 times
0okm9ijn/password: 8 times
0okmnji9/password: 8 times
1234/password: 8 times
123456/password: 8 times
123qwe123qwe/password: 8 times
1l1k1j1h1g/password: 8 times
1qaz2qaz3qaz4qaz5qaz/password: 8 times
1qaz2wsx3edc4rfv5tgb/password: 8 times
1qaz3edc/password: 8 times
1z1x1c1v1b/password: 8 times
321ewq321ewq/password: 8 times
4rfvbgt5/password: 8 times
5a4s3d2f1g/password: 8 times
5a5s5d5f/password: 8 times
5rdx6tc/password: 8 times
5rdxcft6/password: 8 times
5rdxzse46tfc/password: 8 times
5tgb6yhn/password: 8 times
5tgbnhy6/password: 8 times
6tgv/password: 8 times
7ygv/password: 8 times
7ygv6tfc/password: 8 times
7ygvcft6/password: 8 times
8uhb/password: 8 times
8uhb7ygv/password: 8 times
8uhbvgy76tfc/password: 8 times
9ijn/password: 8 times
access/password: 8 times
america/password: 8 times
aol/password: 8 times
bhu8vgy7/password: 8 times
bradpitt/password: 8 times
camera/password: 8 times
cdrw/password: 8 times
chalse/password: 8 times
chie/password: 8 times
fax123/password: 8 times
force/password: 8 times
freebsd/password: 8 times
harvard/password: 8 times
james/password: 8 times
kaida/password: 8 times
kana/password: 8 times
levis/password: 8 times
m0n9b8v7/password: 8 times
mura/password: 8 times
oki/password: 8 times
online/password: 8 times
orange/password: 8 times
pico!@#/password: 8 times
pico/password: 8 times
red/password: 8 times
rin/password: 8 times
sai/password: 8 times
sanyu/password: 8 times
simens/password: 8 times
steve/password: 8 times
tony/password: 8 times
united/password: 8 times
vgy76tfc/password: 8 times
vgy7cft6/password: 8 times
!#%&(!#%&(/password: 7 times
!#%&(/password: 7 times
!#%&(_|/password: 7 times
!2!2!2/password: 7 times
!2#4%6&8(0/password: 7 times
!@!@!@/password: 7 times
!@#!@#!@#/password: 7 times
!@#!@#/password: 7 times
!@#!@#www/password: 7 times
!@#$!@#$!@#$/password: 7 times
!@#$%^!@#$%^/password: 7 times
!@#$%^&*()_+|/password: 7 times
!@#QWEASDZXC/password: 7 times
!@#QWERTY/password: 7 times
!@#ROOT!@#/password: 7 times
!@#admin/password: 7 times
!@#qaz/password: 7 times
!@#root/password: 7 times
!A at S#D$F/password: 7 times
!A at S#D/password: 7 times
!AZ at SX#DC/password: 7 times
!M at N#B$V%C^X&Z/password: 7 times
!Q#E%T&U(O_{/password: 7 times
!Q at W#E!Q at W#E/password: 7 times
!Q at W#E$R/password: 7 times
!Q at W#E/password: 7 times
!QA at WS#ED/password: 7 times
!QAZ at WSX/password: 7 times
!QW@#ER$/password: 7 times
!Z at X#C$V/password: 7 times
!ZAQ at XSW#CDE/password: 7 times
!a at s#d$f/password: 7 times
!q at w#e$r/password: 7 times
)O(I*U&Y/password: 7 times
)O(I*U/password: 7 times
01230123/password: 7 times
0oi98uy7/password: 7 times
1234!@#$/password: 7 times
123QWE/password: 7 times
123cxzdsaewq/password: 7 times
123czdaeq/password: 7 times
123pl,okmijn/password: 7 times
123plkoijhu/password: 7 times
123plokij/password: 7 times
123qaz/password: 7 times
123qazwsxedc/password: 7 times
123qwe/password: 7 times
123qwe123asd/password: 7 times
123qwerty/password: 7 times
123qwertyuiop/password: 7 times
123www/password: 7 times
123zaqwsxcde/password: 7 times
123zcadqe/password: 7 times
123zxcasdqwe/password: 7 times
1A2S3D4F/password: 7 times
1A3S3D/password: 7 times
1Q2W3E/password: 7 times
1Q2W3E4R/password: 7 times
1Z2X3C/password: 7 times
1a2s3d4f5g6h7j8k9l0;-'/password: 7 times
1ad35gj7/password: 7 times
1az2sx3dc/password: 7 times
1l2k3j4h5g6f7d8s9a/password: 7 times
1m1n1b1v1c1x1z/password: 7 times
1m2n3b4v5c6x7z/password: 7 times
1p1p1p/password: 7 times
1p2o3i/password: 7 times
1q/password: 7 times
1q123/password: 7 times
1q1q1q/password: 7 times
1q2q3q4q5q6q/password: 7 times
1q2w3e123/password: 7 times
1q2w3e4r5t/password: 7 times
1q2w3e4r5t6y7u8i9o0p-[=]/password: 7 times
1q2w3e4r5t6y7u8i9o0p/password: 7 times
1q3e5t/password: 7 times
1q3e5t1q3e5t/password: 7 times
1q3e5t7u9o-[/password: 7 times
1q3e5t7u9o/password: 7 times
1q3e5t7u9o0[/password: 7 times
1q5t0p/password: 7 times
1q9o/password: 7 times
1qa2ws/password: 7 times
1qa2ws3ed/password: 7 times
1qa2ws3ed4rf/password: 7 times
1qaazxsw23edcvfr45tgbnhy67ujm/password: 7 times
1qaz/password: 7 times
1qaz123/password: 7 times
1qaz2wsx3edc/password: 7 times
1qaz321/password: 7 times
1qazxsw23edc/password: 7 times
1qe35tu79o/password: 7 times
1qe35tu79o[-/password: 7 times
1qq11q/password: 7 times
1qw23e/password: 7 times
1qw23er45ty6/password: 7 times
1qwe2asd3zxc/password: 7 times
1z1x1c1v/password: 7 times
1z2x3c4v5b6n7m8,9.0/password: 7 times
1zaq2xsw/password: 7 times
1zaq2xsw3cde/password: 7 times
2w/password: 7 times
2w4r6y/password: 7 times
2w4r6y8i0p/password: 7 times
3e/password: 7 times
3e2w1q/password: 7 times
4r3e2w1q/password: 7 times
5t4r3e2w1q/password: 7 times
9o8i7u6y/password: 7 times
?>"/password: 7 times
?><"/password: 7 times
?>}{?>}{/password: 7 times
@WSX$RFV^YHN*IK</password: 7 times
ACCOUNTS/password: 7 times
ADIN!@#$/password: 7 times
ADMIN/password: 7 times
ASDFGG/password: 7 times
ASDFGHJKL/password: 7 times
C#X at Z!/password: 7 times
CDEXSWZAQ/password: 7 times
FEDORA/password: 7 times
LKJHGFDSA/password: 7 times
MKONJIBHU/password: 7 times
MNBVCXZ/password: 7 times
O)(IU*&Y/password: 7 times
P<OMINUB/password: 7 times
PASSWORD!@#/password: 7 times
POI)()*/password: 7 times
POIUYT/password: 7 times
Password/password: 7 times
QWE!@#/password: 7 times
QZWXECRVTBYNUM/password: 7 times
QazWsxEdc/password: 7 times
R00t/password: 7 times
ROOT!#%&(/password: 7 times
ROOT!@#$%^/password: 7 times
ROOT!@#123/password: 7 times
ROOT!QAZ/password: 7 times
ROOT!QAZ at WSX/password: 7 times
ROOT#@!/password: 7 times
ROOT0123/password: 7 times
ROOT123/password: 7 times
ROOT1234/password: 7 times
ROOTROOT/password: 7 times
ROOTROOTROOT/password: 7 times
ROOTSHELL/password: 7 times
ROOT_+|/password: 7 times
ROOT|+_/password: 7 times
ROT/password: 7 times
Root/password: 7 times
SHELL!@#/password: 7 times
SHELL/password: 7 times
TESR!@#/password: 7 times
TEST/password: 7 times
TESTROOT/password: 7 times
USER!@#/password: 7 times
USER/password: 7 times
USERTEST/password: 7 times
WWW/password: 7 times
ZCADQE/password: 7 times
ZXCASDQWE!@#/password: 7 times
ZXCDSAQWE#@!/password: 7 times
ZXCV123/password: 7 times
\\]1q=[2w-p3e0o4r9i5t8u6y/password: 7 times
\\]=[-p/password: 7 times
\\]=[-p0o/password: 7 times
\\]=[-p0o\\]=[-p0o/password: 7 times
\\]=[-p\\]=[-p/password: 7 times
]=[0o8u/password: 7 times
][p][p][p/password: 7 times
][poiu/password: 7 times
][poiuytrewq/password: 7 times
]\\[=p-/password: 7 times
]\\[=p-o0/password: 7 times
]\\\\]]\\/password: 7 times
_P)O(I*U/password: 7 times
`12`12/password: 7 times
abc/password: 7 times
abc1234/password: 7 times
abcabc123/password: 7 times
accounts!@#$/password: 7 times
accounts/password: 7 times
accounts123/password: 7 times
admin!@#!@#/password: 7 times
admin!@#$%^/password: 7 times
admin!@#/password: 7 times
angel/password: 7 times
aron/password: 7 times
asdffghjkl;'/password: 7 times
asdfg/password: 7 times
asdfghjkl/password: 7 times
beyond/password: 7 times
billing/password: 7 times
cde321xsw21zaq1/password: 7 times
cde3xsw2zaq1/password: 7 times
cdewsxzaq/password: 7 times
cdexswzaq123/password: 7 times
cvs!@#/password: 7 times
cvs#@!/password: 7 times
cvs123/password: 7 times
cvsadmin/password: 7 times
cvsuser123/password: 7 times
cxzasdewq/password: 7 times
danny/password: 7 times
data/password: 7 times
developer/password: 7 times
dvd/password: 7 times
e3w2q1/password: 7 times
edcwsxqaz1234/password: 7 times
edit/password: 7 times
email/password: 7 times
fedora!@#/password: 7 times
fedoracore/password: 7 times
ftp!@#/password: 7 times
ftp123/password: 7 times
ftpd/password: 7 times
ftpuser/password: 7 times
ftpuser123/password: 7 times
fuckyou/password: 7 times
george/password: 7 times
hertz/password: 7 times
http/password: 7 times
ident/password: 7 times
kernel!@#/password: 7 times
kernel/password: 7 times
manager!@#!@#/password: 7 times
manager/password: 7 times
manager123/password: 7 times
mislq13579/password: 7 times
misql123123/password: 7 times
monibuvyctxrze/password: 7 times
mysql135/password: 7 times
mysql1qaz/password: 7 times
news/password: 7 times
nobody!!@@##/password: 7 times
nobody!@#/password: 7 times
o0i9u8/password: 7 times
o0i9u8y7/password: 7 times
o9i8u7/password: 7 times
o9i8u7y6/password: 7 times
o9u6r3q/password: 7 times
open/password: 7 times
p0i8y6r4w2/password: 7 times
p0o9i8p0o9i8/password: 7 times
p0o9i8u7/password: 7 times
p0o9i8u7y6/password: 7 times
pass/password: 7 times
passpass/password: 7 times
passwd!@#$/password: 7 times
passwd!q at w#e/password: 7 times
passwd123/password: 7 times
password!@#/password: 7 times
pl,okmin/password: 7 times
pl,pl,okmokm/password: 7 times
public!@#/password: 7 times
public/password: 7 times
public123/password: 7 times
public1234/password: 7 times
q1e3t5/password: 7 times
q1e3t5u7o9/password: 7 times
q1w2e3q1w2e3/password: 7 times
qaswqaw/password: 7 times
qawzse/password: 7 times
qawzsexdr/password: 7 times
qetuo[/password: 7 times
qwer!@#/password: 7 times
qwer123/password: 7 times
qwer1234/password: 7 times
qwer123456/password: 7 times
qwerqwer/password: 7 times
qwerty123123/password: 7 times
qwerty1234/password: 7 times
qwerty1qaz/password: 7 times
qwerty4321/password: 7 times
qwertyasdfgh/password: 7 times
qwertyasdfghzxcvbn/password: 7 times
qwertyqwerty/password: 7 times
qwertyuiop/password: 7 times
qwertyuiop[]/password: 7 times
qzcetbmu/password: 7 times
r00t!@#/password: 7 times
r00t123/password: 7 times
r00t1234/password: 7 times
r4e3w2q1/password: 7 times
resin/password: 7 times
richard/password: 7 times
root!#%&(_|/password: 7 times
root!@#!@#!@#/password: 7 times
root!@#$!@#$/password: 7 times
root!@#/password: 7 times
root-=\\/password: 7 times
rootpassword/password: 7 times
roottest/password: 7 times
rootuser!@#/password: 7 times
rootuser/password: 7 times
rootuseradmin/password: 7 times
rot/password: 7 times
sharon/password: 7 times
shell!@#$/password: 7 times
shell!@#/password: 7 times
shop/password: 7 times
stephen/password: 7 times
test!@#!@#/password: 7 times
test!@#$/password: 7 times
test$#@!/password: 7 times
test123/password: 7 times
test1234/password: 7 times
test4321/password: 7 times
testtest!@#/password: 7 times
testtest/password: 7 times
user!@#$%^/password: 7 times
user!@#$/password: 7 times
user!@#/password: 7 times
userftp/password: 7 times
userroot!@#/password: 7 times
userroot/password: 7 times
usertest/password: 7 times
vcxzfdsarewq/password: 7 times
vcxzfdsarewq4321/password: 7 times
w2r4y6/password: 7 times
w2r4y6i8p0/password: 7 times
www!@#$/password: 7 times
www!@#/password: 7 times
www-data/password: 7 times
www1/password: 7 times
www111/password: 7 times
www123/password: 7 times
www123123/password: 7 times
wwwrun/password: 7 times
wwwwww/password: 7 times
xsw21qaz/password: 7 times
xsw2zaq1/password: 7 times
zaq1/password: 7 times
zaq12cde34/password: 7 times
zaq12wsxcde34/password: 7 times
zaq12wsxcde34rfv/password: 7 times
zaq12xsw34cde/password: 7 times
zaqxswcde123/password: 7 times
zcadqe/password: 7 times
zcbmadgjl/password: 7 times
zsecftbhumko/password: 7 times
zsexdrcft/password: 7 times
zxcvbnm,./password: 7 times
zxcvbnm/password: 7 times
}"?{/password: 7 times
}{P|+_/password: 7 times
}{}{}{/password: 7 times
~!@#~@!#/password: 7 times
!@#bill/password: 6 times
BILL!@#/password: 6 times
BILL/password: 6 times
HTTPD/password: 6 times
NOTES/password: 6 times
ORACLE/password: 6 times
REDHAT!@#/password: 6 times
REDHAT/password: 6 times
SALES!@#/password: 6 times
SALES/password: 6 times
SYSTEM!@#$/password: 6 times
SYSTEM!@#/password: 6 times
WEBADMIN/password: 6 times
WEBMASTER/password: 6 times
a!@#/password: 6 times
a123/password: 6 times
bill!@#/password: 6 times
cindy/password: 6 times
daniel/password: 6 times
francois/password: 6 times
ftptest/password: 6 times
httpd!@#$/password: 6 times
httpd112233/password: 6 times
httpd123/password: 6 times
httpd1234/password: 6 times
httpds/password: 6 times
ice4budu/password: 6 times
info!@#$/password: 6 times
info!@#/password: 6 times
info123/password: 6 times
infoinfo/password: 6 times
jhon!@#/password: 6 times
jhon/password: 6 times
jhon123/password: 6 times
linux!@#!@#/password: 6 times
linux!@#$/password: 6 times
linux!@#/password: 6 times
log/password: 6 times
lucy/password: 6 times
marco/password: 6 times
marco123/password: 6 times
notes/password: 6 times
notes123/password: 6 times
notes1234/password: 6 times
notes1q2w3e/password: 6 times
oracle!@#/password: 6 times
oracle#@!/password: 6 times
oracle1q2w3e/password: 6 times
oracleroot/password: 6 times
qawsedr/password: 6 times
raj/password: 6 times
redhat!@#$/password: 6 times
redhat!@#/password: 6 times
redhat/password: 6 times
redhat13579/password: 6 times
redhat1q2w3e/password: 6 times
rootoracle/password: 6 times
sales!@#/password: 6 times
sales#@!/password: 6 times
sales123/password: 6 times
sales1234/password: 6 times
sara/password: 6 times
service!@#$/password: 6 times
service!@#/password: 6 times
service1234/password: 6 times
shell/password: 6 times
students/password: 6 times
sun0s/password: 6 times
sunos!@#!@#/password: 6 times
sunos!@#/password: 6 times
sunos/password: 6 times
sunos123/password: 6 times
system!@#!@#/password: 6 times
system!@#/password: 6 times
system#@!#@!/password: 6 times
system/password: 6 times
system123/password: 6 times
test2/password: 6 times
testftp/password: 6 times
tomcat!@#/password: 6 times
tomcat123/password: 6 times
university!@#/password: 6 times
university/password: 6 times
university123/password: 6 times
university123123/password: 6 times
unix/password: 6 times
vicky/password: 6 times
web!@#/password: 6 times
web123/password: 6 times
web1234/password: 6 times
webmaster!@#!@#/password: 6 times
webmaster!@#/password: 6 times
webmaster#@!/password: 6 times
webweb/password: 6 times
webweb123/password: 6 times
webwebweb/password: 6 times
wwwwebmaster/password: 6 times
!Q at AW#ZSE$/password: 5 times
!QQ!@WW@#EE#/password: 5 times
!QSX/password: 5 times
!ZZ at XX/password: 5 times
!qAz at wSx#eDc/password: 5 times
'[-]=\\/password: 5 times
)OO)(II(*UU*/password: 5 times
-,0m9n8b/password: 5 times
0k9j8h/password: 5 times
0m9n8b7v6c5x5z/password: 5 times
0o0o9i9i8u8u/password: 5 times
0okmnji98uhbvgy76tfcxdr54eszaw32q1/password: 5 times
11q22w33e/password: 5 times
123!@#/password: 5 times
123#@!/password: 5 times
123qazedctgb/password: 5 times
123qweasdzxc/password: 5 times
123rfv/password: 5 times
12q3wa4esz/password: 5 times
1aa2ss3dd/password: 5 times
1as1zx/password: 5 times
1dsa2dsa3dsa/password: 5 times
1ewq/password: 5 times
1k2k3k/password: 5 times
1l2k3j/password: 5 times
1q23wazse4/password: 5 times
1q2aw3/password: 5 times
1q2aw3zse4/password: 5 times
1qaz1qaz2wsx2wsx/password: 5 times
1qaz2qaz3qaz/password: 5 times
1qaz2wsx1qaz/password: 5 times
1qaz2wsx3edc1qaz2wsx3edc/password: 5 times
1qazxsw2zaq1xsw2/password: 5 times
1qq2ww3ee/password: 5 times
1qsc/password: 5 times
1qwe/password: 5 times
1qwe2qwe/password: 5 times
1qwe2qwe3qwe/password: 5 times
1z\\/password: 5 times
1zaqxsw2/password: 5 times
1zaqxsw2cde3/password: 5 times
1zx23cv45bn67m,89./password: 5 times
1zxc2zxc3zxc/password: 5 times
1zz2xx/password: 5 times
1zz2xx3cc/password: 5 times
2ewq/password: 5 times
3ewq/password: 5 times
3w3w2q2q1/password: 5 times
4321qaz/password: 5 times
4e3w2q1/password: 5 times
5r4e3w2q/password: 5 times
5rdx4esz3wa2q1/password: 5 times
5rdx5rdx/password: 5 times
6c5x4z3a/password: 5 times
6t5r4e3w2q1/password: 5 times
6t5r4e3w2q1`/password: 5 times
6tfcxdr54esz/password: 5 times
9ijn8uhb/password: 5 times
?<BX/password: 5 times
APACHE/password: 5 times
DNS/password: 5 times
LINUX/password: 5 times
MKO)NJI(/password: 5 times
\\/password: 5 times
\\=-][p';l/password: 5 times
\\]='[-/password: 5 times
\\]=-['/password: 5 times
`1qaz/password: 5 times
a1s1d1f1g1h1j1k1l1/password: 5 times
alan123/password: 5 times
alice123/password: 5 times
amalia!@#/password: 5 times
amalia/password: 5 times
amalia123/password: 5 times
amsterdam/password: 5 times
apache!@#$/password: 5 times
apache!@#/password: 5 times
apache#@!/password: 5 times
apache123/password: 5 times
apache1234/password: 5 times
apache1q2w3e4r/password: 5 times
asd123/password: 5 times
bashhistory/password: 5 times
de32wsaq1/password: 5 times
dns!@#!@#/password: 5 times
dns!@#/password: 5 times
dns/password: 5 times
dns123/password: 5 times
dnsdns/password: 5 times
dnswww/password: 5 times
duncan/password: 5 times
e3e3w2w2q1q1/password: 5 times
edu!@#/password: 5 times
edu#@!/password: 5 times
edu/password: 5 times
gov!@#!@#/password: 5 times
gov/password: 5 times
gov123/password: 5 times
hahaha/password: 5 times
history/password: 5 times
iop123/password: 5 times
japonia/password: 5 times
k09jh87g/password: 5 times
kill-9/password: 5 times
linuxredhat/password: 5 times
linuxshell/password: 5 times
lol/password: 5 times
m0okn9ijb8uh/password: 5 times
master!@#/password: 5 times
master123/password: 5 times
master1234/password: 5 times
mko,lp/password: 5 times
mko/password: 5 times
mko0nji9/password: 5 times
mko0nji9nji9/password: 5 times
new/password: 5 times
niso/password: 5 times
nji9bhu8/password: 5 times
o00oo00o/password: 5 times
o0o0i9i9u8u8/password: 5 times
o0o0o0/password: 5 times
o0o0o0o0/password: 5 times
o0u8t6/password: 5 times
oscar/password: 5 times
passwd/password: 5 times
patrick/password: 5 times
pl,/password: 5 times
plm/password: 5 times
poi123/password: 5 times
q11qw22w/password: 5 times
q11qw22we33e/password: 5 times
q1w1e1a1s1d1z1x1c1/password: 5 times
qazedc/password: 5 times
qezrxtcyv/password: 5 times
rootedu/password: 5 times
spring/password: 5 times
sw2aq1sw2aq1/password: 5 times
tech!@#/password: 5 times
tech/password: 5 times
tech123/password: 5 times
test12345/password: 5 times
test123456/password: 5 times
testtest!@#!@#/password: 5 times
turbo/password: 5 times
xdr54eszaw32q1/password: 5 times
zaxscde3w2q1/password: 5 times
zerxctyv/password: 5 times
zxc123/password: 5 times
zxcvcxz/password: 5 times
|+_}{P"/password: 5 times
!@#$%/password: 4 times
!@#$%^&*(/password: 4 times
!@#$%^&*/password: 4 times
!@#$%^&/password: 4 times
!@#$%^/password: 4 times
!@#/password: 4 times
))))))/password: 4 times
)))))/password: 4 times
******/password: 4 times
*963./password: 4 times
000/password: 4 times
000000/password: 4 times
00000000/password: 4 times
000999888/password: 4 times
00998877/password: 4 times
00998877665544332211/password: 4 times
0123456789/password: 4 times
0246/password: 4 times
02580147/password: 4 times
08642/password: 4 times
08642`/password: 4 times
09876/password: 4 times
0987654321/password: 4 times
0987654321`/password: 4 times
102030405060708090/password: 4 times
111/password: 4 times
111111/password: 4 times
112233/password: 4 times
11223344556677889900/password: 4 times
121212/password: 4 times
123/password: 4 times
123123123/password: 4 times
12345/password: 4 times
1234512345/password: 4 times
1234554321/password: 4 times
12345678/password: 4 times
1234567890-=\\/password: 4 times
1234567890/password: 4 times
123654/password: 4 times
123654789/password: 4 times
123abc/password: 4 times
123go/password: 4 times
13579-\\/password: 4 times
13579-\\=08642/password: 4 times
13579/password: 4 times
13971/password: 4 times
147258369/password: 4 times
147369258/password: 4 times
147963/password: 4 times
148/password: 4 times
150/password: 4 times
159/password: 4 times
172839/password: 4 times
1z2x3c/password: 4 times
1z2x3c4v5b6n/password: 4 times
1z2x3c4v5b6n7m/password: 4 times
31793/password: 4 times
357/password: 4 times
357951/password: 4 times
369852147/password: 4 times
564568/password: 4 times
741/password: 4 times
7410/password: 4 times
741852963/password: 4 times
951/password: 4 times
98765/password: 4 times
ROOT%$#@!/password: 4 times
\\-9/password: 4 times
\\-97531/password: 4 times
\\\\==--00998877/password: 4 times
a1b2c3/password: 4 times
aaron/password: 4 times
abcdef/password: 4 times
abcdefghij/password: 4 times
abcdefghijklmnop/password: 4 times
abel/password: 4 times
ac/password: 4 times
ad/password: 4 times
adduser/password: 4 times
adler/password: 4 times
adley/password: 4 times
administrator/password: 4 times
adress/password: 4 times
adress1234/password: 4 times
adrian/password: 4 times
adrien/password: 4 times
aiken/password: 4 times
ajay/password: 4 times
aka/password: 4 times
akako/password: 4 times
alfred/password: 4 times
ali/password: 4 times
allan/password: 4 times
amiko/password: 4 times
amit/password: 4 times
andi/password: 4 times
andy/password: 4 times
angela/password: 4 times
angie/password: 4 times
anita/password: 4 times
ankush/password: 4 times
anna/password: 4 times
anthony/password: 4 times
anton/password: 4 times
anutumn/password: 4 times
aronaron/password: 4 times
arthur/password: 4 times
asdf/password: 4 times
asshole/password: 4 times
austin/password: 4 times
barbara/password: 4 times
bart/password: 4 times
baseball/password: 4 times
bear/password: 4 times
ben/password: 4 times
beny/password: 4 times
bhalgarh/password: 4 times
bharti/password: 4 times
bhushanarora/password: 4 times
billy/password: 4 times
biru_gupta/password: 4 times
blue/password: 4 times
boomer/password: 4 times
box/password: 4 times
bridge/password: 4 times
brock/password: 4 times
bruno/password: 4 times
buck/password: 4 times
bud/password: 4 times
bulk!@#!@#/password: 4 times
bulk!@#/password: 4 times
bulk123/password: 4 times
buster/password: 4 times
calvert/password: 4 times
calvin/password: 4 times
camaro/password: 4 times
canada/password: 4 times
carleton/password: 4 times
carling/password: 4 times
carmen/password: 4 times
cary/password: 4 times
casper/password: 4 times
cecil/password: 4 times
chal/password: 4 times
chan/password: 4 times
chapman/password: 4 times
charles/password: 4 times
check/password: 4 times
chris/password: 4 times
clau/password: 4 times
claw/password: 4 times
colin/password: 4 times
computer/password: 4 times
connex/password: 4 times
cowboy/password: 4 times
craig/password: 4 times
culbert/password: 4 times
curt/password: 4 times
cyril/password: 4 times
dai/password: 4 times
daishy/password: 4 times
dale/password: 4 times
dallas/password: 4 times
dalton/password: 4 times
damon/password: 4 times
dane/password: 4 times
danior/password: 4 times
dany/password: 4 times
darla/password: 4 times
darwin/password: 4 times
davinder/password: 4 times
deluser/password: 4 times
diamond/password: 4 times
digital/password: 4 times
dong/password: 4 times
draft/password: 4 times
dragon/password: 4 times
duke/password: 4 times
editor/password: 4 times
emiko/password: 4 times
empty/password: 4 times
etsu/password: 4 times
fiction/password: 4 times
field/password: 4 times
finger/password: 4 times
fire/password: 4 times
fishing/password: 4 times
fiwrll/password: 4 times
flower/password: 4 times
flowers/password: 4 times
fm/password: 4 times
foobar/password: 4 times
fred/password: 4 times
freedom/password: 4 times
friday/password: 4 times
fuji/password: 4 times
fujita/password: 4 times
furu/password: 4 times
gary/password: 4 times
genesis/password: 4 times
gina/password: 4 times
gita/password: 4 times
gulvir/password: 4 times
gurnamarora/password: 4 times
hammer/password: 4 times
hana/password: 4 times
handan/password: 4 times
happy/password: 4 times
harley/password: 4 times
haruki/password: 4 times
hash/password: 4 times
hashi/password: 4 times
hasky/password: 4 times
hello/password: 4 times
hibiki/password: 4 times
hockey/password: 4 times
hokkaido/password: 4 times
host/password: 4 times
hosting/password: 4 times
ichiro/password: 4 times
id/password: 4 times
inari/password: 4 times
inbox!@#$/password: 4 times
inbox!@#/password: 4 times
inbox123/password: 4 times
japan/password: 4 times
jason/password: 4 times
jayant/password: 4 times
jesus/password: 4 times
job/password: 4 times
jordan/password: 4 times
joshua/password: 4 times
kaemon/password: 4 times
kaiya/password: 4 times
kameko/password: 4 times
kane/password: 4 times
kanika/password: 4 times
kanji/password: 4 times
kaori/password: 4 times
kaoru/password: 4 times
kasako/password: 4 times
katana/password: 4 times
kathi/password: 4 times
kei/password: 4 times
keiko/password: 4 times
kenji/password: 4 times
kenki/password: 4 times
kevin/password: 4 times
khatain/password: 4 times
ki/password: 4 times
kiaria/password: 4 times
kichi/password: 4 times
kimi/password: 4 times
kin/password: 4 times
kita/password: 4 times
koko/password: 4 times
korea/password: 4 times
koto/password: 4 times
kuma/password: 4 times
kumarmanish/password: 4 times
kumi/password: 4 times
kun/password: 4 times
kusum/password: 4 times
kyoko/password: 4 times
language/password: 4 times
lchiro/password: 4 times
lekhraj/password: 4 times
letmein/password: 4 times
ls/password: 4 times
magic/password: 4 times
mai/password: 4 times
maiko/password: 4 times
makato/password: 4 times
mamoru/password: 4 times
man/password: 4 times
manish/password: 4 times
manoj/password: 4 times
mar/password: 4 times
mareo/password: 4 times
mariko/password: 4 times
marilko/password: 4 times
maro/password: 4 times
masako/password: 4 times
masao/password: 4 times
masato/password: 4 times
matsu/password: 4 times
matthew/password: 4 times
mayko/password: 4 times
meat/password: 4 times
meia/password: 4 times
michelle/password: 4 times
michi/password: 4 times
michiko/password: 4 times
mickey/password: 4 times
midori/password: 4 times
mina/password: 4 times
momo/password: 4 times
monday/password: 4 times
mskochar/password: 4 times
mudit/password: 4 times
murphy/password: 4 times
murthal/password: 4 times
mustang/password: 4 times
mutsuko/password: 4 times
mylo/password: 4 times
nagaharu/password: 4 times
naka/password: 4 times
namrata/password: 4 times
nao/password: 4 times
naoki/password: 4 times
neelam/password: 4 times
newpass/password: 4 times
newuser/password: 4 times
nishant/password: 4 times
nokia/password: 4 times
nori/password: 4 times
notused/password: 4 times
old/password: 4 times
one/password: 4 times
oold/password: 4 times
orin/password: 4 times
osaka/password: 4 times
ou812/password: 4 times
pamela/password: 4 times
pascal/password: 4 times
password/password: 4 times
pawan/password: 4 times
polo/password: 4 times
pooja/password: 4 times
pookie/password: 4 times
pradeep/password: 4 times
puneet/password: 4 times
qwerty/password: 4 times
rai/password: 4 times
raiden/password: 4 times
raidon/password: 4 times
rainbow/password: 4 times
rajeev/password: 4 times
rajivmangla/password: 4 times
ranger/password: 4 times
rascal/password: 4 times
rbsingh/password: 4 times
rei/password: 4 times
reiji/password: 4 times
rein/password: 4 times
ren/password: 4 times
rihito/password: 4 times
riku/password: 4 times
ringo/password: 4 times
rini/password: 4 times
rishi/password: 4 times
rishou/password: 4 times
ritsuko/password: 4 times
river/password: 4 times
rk/password: 4 times
rkhosla/password: 4 times
robert/password: 4 times
romania/password: 4 times
ronin/password: 4 times
root!@#123/password: 4 times
root000000/password: 4 times
root123!@#/password: 4 times
root123123/password: 4 times
root12345/password: 4 times
root54321/password: 4 times
root98765/password: 4 times
rootapache/password: 4 times
rorin/password: 4 times
runner/password: 4 times
ryou/password: 4 times
ryozo/password: 4 times
ryu/password: 4 times
ryuuichi/password: 4 times
saburo/password: 4 times
sachi/password: 4 times
sada/password: 4 times
saeko/password: 4 times
sahuja/password: 4 times
saki/password: 4 times
saku/password: 4 times
sakuko/password: 4 times
sale/password: 4 times
sam/password: 4 times
sama/password: 4 times
samba/password: 4 times
samuru/password: 4 times
san/password: 4 times
sandeep/password: 4 times
sandy/password: 4 times
sanjay/password: 4 times
sanjivarishi/password: 4 times
sapna/password: 4 times
satnam/password: 4 times
sato/password: 4 times
satpreet/password: 4 times
satu/password: 4 times
scooter/password: 4 times
seiko/password: 4 times
sendmail/password: 4 times
sensei/password: 4 times
sent!@#/password: 4 times
sent/password: 4 times
server/password: 4 times
sgi/password: 4 times
sgika/password: 4 times
shadow/password: 4 times
shannon/password: 4 times
shaun/password: 4 times
shika/password: 4 times
shima/password: 4 times
shino/password: 4 times
shiro/password: 4 times
shita/password: 4 times
shuichi/password: 4 times
shuoich/password: 4 times
sida/password: 4 times
silver/password: 4 times
snake/password: 4 times
snoopy/password: 4 times
soccer/password: 4 times
soleil/password: 4 times
sonia/password: 4 times
sophie/password: 4 times
sorano/password: 4 times
spider/password: 4 times
sprint/password: 4 times
steven/password: 4 times
subrat/password: 4 times
suma/password: 4 times
sumi/password: 4 times
sumit/password: 4 times
summer/password: 4 times
sun/password: 4 times
suna/password: 4 times
sunshine/password: 4 times
sushi/password: 4 times
sushma/password: 4 times
suzuki/password: 4 times
sven/password: 4 times
ta/password: 4 times
tabito/password: 4 times
tadaaki/password: 4 times
tadako/password: 4 times
taka/password: 4 times
takahashi/password: 4 times
takai/password: 4 times
takako/password: 4 times
tanaka/password: 4 times
taylor/password: 4 times
teh/password: 4 times
thx1138/password: 4 times
tiger/password: 4 times
tigger/password: 4 times
tim/password: 4 times
tokyo/password: 4 times
tom/password: 4 times
toor/password: 4 times
tree/password: 4 times
tuesday/password: 4 times
univers/password: 4 times
uptime/password: 4 times
user2/password: 4 times
users/password: 4 times
vandana/password: 4 times
vanessa/password: 4 times
varsha/password: 4 times
vijaygupta/password: 4 times
village/password: 4 times
vipul/password: 4 times
virendar/password: 4 times
waako/password: 4 times
waimi/password: 4 times
wakako/password: 4 times
wakana/password: 4 times
watanabe/password: 4 times
wheeling/password: 4 times
will/password: 4 times
willie/password: 4 times
win/password: 4 times
woman/password: 4 times
work/password: 4 times
xxx/password: 4 times
yama/password: 4 times
yogesh/password: 4 times
yoko/password: 4 times
yoyo/password: 4 times
amazon/password: 3 times
brett/password: 3 times
connect/password: 3 times
firewall/password: 3 times
guard/password: 3 times
hosts/password: 3 times
issue/password: 3 times
ping/password: 3 times
puma/password: 3 times
security/password: 3 times
tadami/password: 3 times
tadanori/password: 3 times
tadao/password: 3 times
taichi/password: 3 times
zxmnwlskjk/password: 3 times
4faculty/password: 2 times
FGH3iGHCM39/password: 2 times
atnaltA60_oto/password: 2 times
axceleon/password: 2 times
creativa/password: 2 times
cvsuser1/password: 2 times
daemon1/password: 2 times
dbaccess/password: 2 times
eknight/password: 2 times
hmiboard/password: 2 times
iz21puy9/password: 2 times
john157/password: 2 times
mall/password: 2 times
network/password: 2 times
pat/password: 2 times
pmapass/password: 2 times
pmapassword/password: 2 times
portside/password: 2 times
rgarraud/password: 2 times
rho/password: 2 times
s0m394ss/password: 2 times
somepass/password: 2 times
tgmweb/password: 2 times
vanroye.be/password: 2 times
webcoder/password: 2 times
$chooLg1rL/password: 1 time
006d5cf6366ca586/password: 1 time
123onestarsa/password: 1 time
1am0nly4Joomla/password: 1 time
1am4CMS/password: 1 time
1am4Drupal/password: 1 time
1am4NAV/password: 1 time
1amnot4spr1ng/password: 1 time
1d1a702057321729/password: 1 time
22tango22/password: 1 time
282e8b980a9d8857/password: 1 time
2edcef5e32471447/password: 1 time
355mlPepsi/password: 1 time
40a8b47315ccf34d/password: 1 time
4sfUcK/password: 1 time
4webmanh/password: 1 time
629274793038a7e1/password: 1 time
67116cea1a68193d/password: 1 time
6f25624522c90ae2/password: 1 time
7816252a27c32eab/password: 1 time
7819894d27c43f7f/password: 1 time
7hUm8s/password: 1 time
8Valerie20/password: 1 time
8ackup/password: 1 time
Fjeie93s/password: 1 time
GFh3iouhgslkj/password: 1 time
H4Rtb34T/password: 1 time
H4Rtb34T2/password: 1 time
John157/password: 1 time
Ly6Vm3zTu/password: 1 time
MK-D-0001/password: 1 time
MKD3134/password: 1 time
Mov1E$/password: 1 time
No3vA7_bOt/password: 1 time
Nt48vxDbtG73E5Fg/password: 1 time
RaiT2OPVY4l53XY/password: 1 time
TGoi3houhf/password: 1 time
WiAbrla4Hi/password: 1 time
admin1214/password: 1 time
amp109/password: 1 time
asa/password: 1 time
austrade/password: 1 time
averymvkay/password: 1 time
aya914/password: 1 time
b3s8d0_oenc7Yb/password: 1 time
b4tug4N!/password: 1 time
betatest/password: 1 time
bmusic/password: 1 time
c3L3bmov1e/password: 1 time
c3l3bv1Dz/password: 1 time
cats/password: 1 time
ccNaQ9hbgIe5HGa/password: 1 time
clinton/password: 1 time
confirm/password: 1 time
controlvideo/password: 1 time
cvbcvbrs/password: 1 time
denis/password: 1 time
dhpj3jcy/password: 1 time
dotproject/password: 1 time
ecmarks/password: 1 time
efpadmin/password: 1 time
ezpay/password: 1 time
fUck1n6/password: 1 time
fruit/password: 1 time
fruitOfthe/password: 1 time
ftdelmarva/password: 1 time
gfch45fh/password: 1 time
glen/password: 1 time
gv1234/password: 1 time
harjawan/password: 1 time
horde190/password: 1 time
horny/password: 1 time
i3xR_eVi_e7w/password: 1 time
igor/password: 1 time
iohzoihosud/password: 1 time
jz7m0q/password: 1 time
k1$sn1KKi/password: 1 time
kovacsa/password: 1 time
kurt/password: 1 time
lakatos.csaba/password: 1 time
legend/password: 1 time
m0v13S/password: 1 time
m0vI3/password: 1 time
mac171/password: 1 time
macky/password: 1 time
malika/password: 1 time
mambo_xihaco12/password: 1 time
maruse/password: 1 time
mfc97/password: 1 time
mh1RjoH9/password: 1 time
my45sqL_F3uc2K/password: 1 time
mystudgh46/password: 1 time
nNo0oNn/password: 1 time
nearo1214/password: 1 time
newSite/password: 1 time
nti/password: 1 time
obscure/password: 1 time
ojnzjkdsk/password: 1 time
olivier01/password: 1 time
padbss/password: 1 time
pepsimax123/password: 1 time
pm4p455/password: 1 time
pmmon/password: 1 time
portallogin1214/password: 1 time
pulsar/password: 1 time
qec/password: 1 time
querty/password: 1 time
r3fLeC7HoSt/password: 1 time
r3m0t3/password: 1 time
r3m3dy/password: 1 time
rimas/password: 1 time
river^bend/password: 1 time
s0m39411/password: 1 time
saleslogs/password: 1 time
sanjeev612/password: 1 time
scoobydoo/password: 1 time
sexus040969/password: 1 time
share/password: 1 time
shoppersParadise/password: 1 time
sivoko/password: 1 time
sp3rM/password: 1 time
specification/password: 1 time
sqlDBaccess_05/password: 1 time
sqpassword/password: 1 time
stlUB8Ag9E/password: 1 time
support/password: 1 time
sys1osl/password: 1 time
szeles.beni/password: 1 time
tAGOrae2vOQ7AwQ2/password: 1 time
testdev/password: 1 time
testing/password: 1 time
testpin/password: 1 time
tyhk7hrk/password: 1 time
uivzhxuihds/password: 1 time
upload/password: 1 time
w3bch4t/password: 1 time
wZf8J4Rd/password: 1 time
wmspasswd/password: 1 time
wobbie/password: 1 time
wvnet/password: 1 time
yokohama/password: 1 time
Bob Hoffman wrote:> Okay, I have a server connected to the net but have not added fail2ban or > anything on top of my firewall yet. > > Thought you guys might get a kick out of this one user, ip is from china, > who has got a heck of a knack for making assumptions on possible usernames. > > Enjoy this..., 8000+ attempts. Scroll down for funky ones. I have no root > access enabled on this server and it is pretty bare. Just using it as a > collector of banable ips right now and it is doing a good job. > But some of these are quite interesting when you look at the keyboard > layout. They really must try to figure this mental thing out...wow. > > If you take some time, there are some down right funny usernames like > > 1am0nly4Joomla > Igor > scoobydoo > $chooLg1rL > > So for all you out there that think your cool way of making a username is > unique and not to be guessed, you might want to look at some of the lengths > this one bot went to. > > 58.53.192.47: 8002 times > test/password: 48 times > user/password: 45 times > fax/password: 43 times > www/password: 34 times > info/password: 27 times > /password: 24 times > bill/password: 24 times > httpd/password: 23 times > 1q2w3e/password: 21 times > admin/password: 21 times > ><snip the other 7995 > I think that would definitely classify as a dictionary attack.. but what dictionary has all those kinds of entries :) Sam
> Enjoy this..., 8000+ attempts.I moved the ssh port from the standard 22 to a high port. The attempts to break into my servers disappeared. The logs are clean now. I would advise you to do the same. Choose a high (> 1024) unused port and configure the clients accordingly.
Sam Drinkard <sam at wa4phy.net> Sent by: centos-bounces at centos.org 07/23/2009 11:49 AM Please respond to CentOS mailing list <centos at centos.org> To CentOS mailing list <centos at centos.org> cc Subject Re: [CentOS] SSH attacks from china Bob Hoffman wrote:> Okay, I have a server connected to the net but have not added fail2banor> anything on top of my firewall yet. > > Thought you guys might get a kick out of this one user, ip is fromchina,> who has got a heck of a knack for making assumptions on possibleusernames.> > Enjoy this..., 8000+ attempts. Scroll down for funky ones. I have noroot> access enabled on this server and it is pretty bare. Just using it as a > collector of banable ips right now and it is doing a good job. > But some of these are quite interesting when you look at the keyboard > layout. They really must try to figure this mental thing out...wow. > > If you take some time, there are some down right funny usernames like > > 1am0nly4Joomla > Igor > scoobydoo > $chooLg1rL > > So for all you out there that think your cool way of making a usernameis> unique and not to be guessed, you might want to look at some of thelengths> this one bot went to. > > 58.53.192.47: 8002 times > test/password: 48 times > user/password: 45 times > fax/password: 43 times > www/password: 34 times > info/password: 27 times > /password: 24 times > bill/password: 24 times > httpd/password: 23 times > 1q2w3e/password: 21 times > admin/password: 21 times > > ><snip the other 7995 > > >I think that would definitely classify as a dictionary attack.. but what >dictionary has all those kinds of entries :) > >Sam >When it is not so much a dictionary, but a list of known, good usernames/passwords harvested from somewhere else... or in this case several lists concatenated one after another (note how there the list is a pattern of alphabetical runs)... Mark </PRE><p><span style="font-size:9.5pt;line-height:115%;font-family: Arial">This transmission is intended solely for the person or organization to whom it is addressed and it may contain privileged and confidential information. If you are not the intended recipient you should not copy, distribute or take any action in reliance on it. If you believe you received this transmission in error, please notify the sender.</span></p> -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.centos.org/pipermail/centos/attachments/20090723/95fd419d/attachment.html
Bob Hoffman wrote on Thu, 23 Jul 2009 12:37:54 -0400:> Enjoy this..., 8000+ attempts.I did not enjoy this. Could you please consider next time putting such a log up under a link somewhere and refer to it instead of sending it all to the list? Thanks. Kai -- Kai Sch?tzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com
On Sat, Jul 25, 2009 at 6:40 PM, Sorin Srbu<sorin.srbu at orgfarm.uu.se> wrote:>>-----Original Message----- >>From: centos-bounces at centos.org [mailto:centos-bounces at centos.org] On >>Behalf Of Lucian at lastdot.org >>Sent: Friday, July 24, 2009 1:09 PM >>To: CentOS mailing list >>Subject: Re: [CentOS] SSH attacks from china >> >>I banned all China and Korea in my gateway :) (not for all ports, only >>for ssh & ftp). > > That's the simple solution, and one that has been argued (on the 'net > generally) to be a very blunt tool at that. > > What if you have legit users from China and Korea trying to connect to your > server(s)? > -- > /SorinYou can imagine I'd not banned CN if i knew I had legit users there. So far no complaints from my clients.. and besides, I only blocked ssh and ftp ports.. The chinese can still send me mail and browse my websites. ..Thinking if i should ban them from pop3 and imap as well.> > _______________________________________________ > CentOS mailing list > CentOS at centos.org > http://lists.centos.org/mailman/listinfo/centos > >
On Wed, Jul 29, 2009 at 9:10 PM, Sorin Srbu<sorin.srbu at orgfarm.uu.se> wrote:>>-----Original Message----- >>From: centos-bounces at centos.org [mailto:centos-bounces at centos.org] On >>Behalf Of Lucian at lastdot.org >>Sent: Sunday, July 26, 2009 11:27 PM >>To: CentOS mailing list >>Subject: Re: [CentOS] SSH attacks from china >> >>Vietnam and Indonezia are also suspects in my list. >>The biggest problem with this approach is that even tho I could ban >>whole Asia and Russia, a significant part of the attacks do not >>originate from there, but from countries like USA, UK, etc, controlled >>by hackers (also) from the aforementioned areas... >>The latest case of password breaking I had to deal with was from an >>USA IP address.. they managed to insert an iframe in all index.html >>and index.php files on the respective FTP account. The iframe however >>was pointing to a .ru website hosted in France.. Isn't globalization >>fun?! >>Anyway, just banning ranges of IP addresses may not enough, so to rely >>on this _only_ would be careless. > > Exactly, that was what I trying to get at! > > So you're not going to ban all ip addresses from the US I take it, since > most spam, crapware, attacks and whatnot originate from there, as you point > out? ;-)I might just do that, but of course, for a certain range of ports. Actually a better idea would be to just allow connections on the most sensitive services only from our country since we do no business with people abroad. It would be interesting to see which method is more performant, iptables+ipset or iptables-geoip.> -- > /Sorin > > _______________________________________________ > CentOS mailing list > CentOS at centos.org > http://lists.centos.org/mailman/listinfo/centos > >