ConfigServer Community Forum

How can this happen? Thank you.

Time: Mon May 26 03:14:04 2014 +0300
IP: distributed ftpd attack on account [anonymous]
Failures: 5
Interval: 300 seconds
Blocked: Permanent Block

Log entries:

May 26 03:12:43 host pure-ftpd: (?@66.249.64.165) [WARNING] Authentication failed for user [anonymous]
May 26 03:12:25 host pure-ftpd: (?@66.249.64.134) [WARNING] Authentication failed for user [anonymous]
May 26 03:14:00 host pure-ftpd: (?@66.249.64.216) [WARNING] Authentication failed for user [anonymous]
May 26 03:12:49 host pure-ftpd: (?@66.249.64.170) [WARNING] Authentication failed for user [anonymous]
May 26 03:13:55 host pure-ftpd: (?@66.249.64.216) [WARNING] Authentication failed for user [anonymous]

IP Addresses Blocked:

66.249.64.165 (US/United States/crawl-66-249-64-165.googlebotcom)
66.249.64.134 (US/United States/crawl-66-249-64-134.googlebotcom)
66.249.64.216 (US/United States/crawl-66-249-64-216.googlebotcom)
66.249.64.170 (US/United States/crawl-66-249-64-170.googlebotcom)

If you want to prevent a certain domain being blocked, use /etc/csf/csf.rignore. Restart csf and then lfd after making any changes.