[Nottingham] Web-bot attack!

Martin martin at ml1.co.uk
Wed Nov 11 14:49:05 UTC 2009


Folks,

For whatever reason, my very humble Via C3 system, resplendent with all
of one user, 512MBytes of SDRAM, a few MHz CPU, and a mere USB memory
stick for a "SSD", has somehow become the focus of a webbot!...

Since 5/11/2009, I've seen 5362 ssh attempts from *469* IP addresses.

The hit rate is very slow and randomly from that family of IP addresses
so it doesn't trip any blocking due to rate limiting on the firewall.

The list of IP addresses can be posted for anyone interested.


So, to avoid the pestering, is the only defence to move over to using
port knocking?...

Or can we nuke all the zombied machines?!

Cheers,
Martin

-- 
----------------
Martin Lomas
martin at ml1.co.uk
----------------



More information about the Nottingham mailing list