Anybody experiencing FTP attacks on their servers? - GoFuckYourself.com

TheSenator · 08-12-2009, 04:21 PM

I am getting some crazy FTP attacks from China.

Some bot from China is trying to find exploits on my sites.

Here is an IP 221.130.193.61

My system admin already figured out the pattern and has a script to detect if my server is being attack.

Shit has slowed down my server.

CaptainWolfy · 08-12-2009, 04:28 PM

i have experienced that shit just month ago, change every ftp pass you have, and clean that shit if you got infected..

Fletch XXX · 08-12-2009, 04:28 PM

at least youre on it, good luck.

camgirlshide · 08-12-2009, 04:33 PM

using just a single ip for the attack? That's surprising. Usually they are better than that.

TurboAngel · 08-12-2009, 04:53 PM

That sucks.

TheSenator · 08-12-2009, 05:00 PM

The attacks are spread out through the day. My system admin is on top of that shit. Whatever bot they are using has unlimited bandwidth to suck and dump shit at 100Mbs...

raymor · 08-13-2009, 01:59 PM

We see FTP dictionary attacks on most servers where we look for it.
POP3, email, is also a popular target because very often your FTP user/pass
will be approved for POP3, but people leave POP3 unprotected. So the bad
guys brute on POP3, then when they hit one that works try the same user/pass
for FTP, Wordpress, etc. On our servers, EVERY single daemon has brute
force protection - SMTP, IMAP, POP3, FTP... . SSH is keys only, no passwords.
We created a single brute force protection system that can watch any service.
There are just a couple of settings to adapt it fro FTP, POP3, etc.

AdultHardcore · 08-13-2009, 02:41 PM

Quote:

Originally Posted by TheSenator

I am getting some crazy FTP attacks from China.

Some bot from China is trying to find exploits on my sites.

Here is an IP 221.130.193.61

My system admin already figured out the pattern and has a script to detect if my server is being attack.

Shit has slowed down my server.

That sucks!!!

d-null · 08-13-2009, 02:46 PM

yeah the bastards are a piss off

BestXXXPorn · 08-13-2009, 02:55 PM

Best solution, disable FTP! It's antiquated :P

fuzebox · 08-13-2009, 04:16 PM

Quote:

Originally Posted by BestXXXPorn

Best solution, disable FTP! It's antiquated :P

I can't believe more webmasters don't use ssh/scp/sftp/whatever...

08-12-2009, 04:21 PM	#1
TheSenator Too lazy to set a custom title Industry Role: Join Date: Feb 2003 Location: NJ Posts: 13,331	Anybody experiencing FTP attacks on their servers? I am getting some crazy FTP attacks from China. Some bot from China is trying to find exploits on my sites. Here is an IP 221.130.193.61 My system admin already figured out the pattern and has a script to detect if my server is being attack. Shit has slowed down my server. __________________ ISeekGirls.com since 2005

08-12-2009, 04:28 PM	#3
Fletch XXX GFY HALL OF FAME DAMMIT!!! Join Date: Jan 2002 Location: that 504 Posts: 60,840	at least youre on it, good luck. __________________ Want an Android App for your tube, membership, or free site? Need banners or promo material? Hit us up (ICQ Fletch: 148841377) or email me fletchxxx at gmail.com - recent work - About me

08-12-2009, 04:33 PM	#4
camgirlshide Confirmed User Join Date: Jan 2005 Posts: 1,558	using just a single ip for the attack? That's surprising. Usually they are better than that. __________________ Useful adult webmaster links - Alphabetical list of solo models with webcam Stats on my best converting affiliate programs - camgirlshide webmaster blog complete list of affiliate programs I use.

08-12-2009, 05:00 PM	#6
TheSenator Too lazy to set a custom title Industry Role: Join Date: Feb 2003 Location: NJ Posts: 13,331	The attacks are spread out through the day. My system admin is on top of that shit. Whatever bot they are using has unlimited bandwidth to suck and dump shit at 100Mbs... __________________ ISeekGirls.com since 2005

08-13-2009, 01:59 PM	#7
raymor Confirmed User Join Date: Oct 2002 Posts: 3,745	We see FTP dictionary attacks on most servers where we look for it. POP3, email, is also a popular target because very often your FTP user/pass will be approved for POP3, but people leave POP3 unprotected. So the bad guys brute on POP3, then when they hit one that works try the same user/pass for FTP, Wordpress, etc. On our servers, EVERY single daemon has brute force protection - SMTP, IMAP, POP3, FTP... . SSH is keys only, no passwords. We created a single brute force protection system that can watch any service. There are just a couple of settings to adapt it fro FTP, POP3, etc. __________________ For historical display only. This information is not current: support@bettercgi.com ICQ 7208627 Strongbox - The next generation in site security Throttlebox - The next generation in bandwidth control Clonebox - Backup and disaster recovery on steroids

08-12-2009, 04:28 PM	#2
CaptainWolfy Playa Industry Role: Join Date: Dec 2005 Location: Somewhere on the Earth Posts: 8,439	i have experienced that shit just month ago, change every ftp pass you have, and clean that shit if you got infected..

08-12-2009, 04:53 PM	#5
TurboAngel H.B.I.C. Industry Role: Join Date: Jun 2003 Location: NC Posts: 30,122	That sucks.

08-13-2009, 02:46 PM	#9
d-null . . . Industry Role: Join Date: Apr 2007 Location: NY Posts: 13,724	yeah the bastards are a piss off __________________ __________________ Looking for a custom TUBE SCRIPT that supports massive traffic, load balancing, billing support, and h264 encoding? Hit up Konrad! Looking for designs for your websites or custom tubesite design? Hit up Zuzana Designs Check out the #1 WordPress SEO Plugin: CyberSEO Suite

08-13-2009, 02:55 PM	#10
BestXXXPorn Confirmed User Join Date: Jun 2009 Location: Asheville, NC Posts: 2,277	Best solution, disable FTP! It's antiquated :P __________________ ICQ: 258-202-811 \| Email: eric{at}bestxxxporn.com