And another little attack wave on my mail server. The screenshot shows the number of failed attempts to post spam per IP (99% refused by my mail server because the hostname was fake). Now all blocked with #crowdsec for a few days.
As you can see, the attacking IP addresses try continuously to flood my mail server. Compare that to the attempts to brute-force SASL logins, which are just 1 try per IP, indicating these attacks come from a botnet.
The brute-force SSH login attempts are, like the spam attempts, coming from longer running scripts on typically cheap VPSes that run until someone notices and shuts them down (or not. some hosting companies don't give a sh*it about such abuse)
@jwildeboer I always ponder what their reaction would be if they were to finally gain access to the crappy little Raspberry Pi waiting for them on the other side of the non-standard ssh port at my house. Presumably extreme disappointment.
@jwildeboer
Will have to take a look at that. It's crazy how many people/bots try to abuse any old server with IP address. I've been running fail2ban for quite a while, but maybe the crowdsourcing is worth having.
Add comment