最近很多江苏的 IP，孜孜不倦的破解 VPS，即使被 Ban 也一直连接

[wdc63]

..... Jan 16 08:08:25 ****** sshd[17971]: refused connect from 58.218.204.132 (58.218.204.132) Jan 16 08:08:54 ****** sshd[17972]: refused connect from 58.218.204.132 (58.218.204.132) Jan 16 08:09:29 ****** sshd[17973]: refused connect from 58.218.204.132 (58.218.204.132) Jan 16 08:09:58 ****** sshd[17974]: refused connect from 58.218.204.132 (58.218.204.132) Jan 16 08:10:28 ****** sshd[18005]: refused connect from 58.218.204.132 (58.218.204.132) Jan 16 08:10:55 ****** sshd[18006]: refused connect from 58.218.204.132 (58.218.204.132) Jan 16 08:11:16 ****** sshd[17952]: pam_unix(sshd:session): session closed for user root Jan 16 08:11:23 ****** sshd[18008]: refused connect from 58.218.204.132 (58.218.204.132) Jan 16 08:11:54 ****** sshd[18009]: refused connect from 58.218.204.132 (58.218.204.132) Jan 16 08:12:22 ****** sshd[18010]: refused connect from 58.218.204.132 (58.218.204.132) Jan 16 08:12:50 ****** sshd[18012]: refused connect from 58.218.204.132 (58.218.204.132) Jan 16 08:13:20 ****** sshd[18013]: refused connect from 58.218.204.132 (58.218.204.132) Jan 16 08:13:50 ****** sshd[18014]: refused connect from 58.218.204.132 (58.218.204.132) Jan 16 08:14:22 ****** sshd[18015]: refused connect from 58.218.204.132 (58.218.204.132) Jan 16 08:14:50 ****** sshd[18016]: refused connect from 58.218.204.132 (58.218.204.132) Jan 16 08:15:15 ****** sshd[18047]: refused connect from 58.218.204.132 (58.218.204.132) Jan 16 08:15:45 ****** sshd[18048]: refused connect from 58.218.204.132 (58.218.204.132) Jan 16 08:16:08 ****** sshd[18049]: refused connect from 91.224.160.131 (91.224.160.131) Jan 16 08:16:13 ****** sshd[18050]: refused connect from 58.218.204.132 (58.218.204.132) Jan 16 08:16:45 ****** sshd[18051]: refused connect from 58.218.204.132 (58.218.204.132) Jan 16 08:17:10 ****** sshd[18052]: refused connect from 58.218.204.132 (58.218.204.132) Jan 16 08:17:38 ****** sshd[18053]: refused connect from 58.218.204.132 (58.218.204.132) Jan 16 08:18:10 ****** sshd[18055]: refused connect from 58.218.204.132 (58.218.204.132) Jan 16 08:18:34 ****** sshd[18056]: refused connect from 58.218.204.132 (58.218.204.132) Jan 16 08:19:03 ****** sshd[18057]: refused connect from 58.218.204.132 (58.218.204.132)

58.218.204.132 这个 IP 连续一个星期来尝试破解我的 SSH ，被 ban 掉也孜孜不倦的 30 秒尝试连接一次。真是可怜这个小白的肉鸡。

[d7101120120]

我一直在想，像这种 IP 的来源大约就是破解系统和软件的使用者吧？

[wdc63]

@d7101120120 多半是脚本小子。应该是在肉鸡上跑的脚本。

[kenshin912]

前些日子 tail -f 看了下梯子上的 auth.log , 简直丧心病狂 , 吓得我赶紧装了个 fail2ban .