218.62.88.29 is from China

same as others

got 1 hour long a HELL of a lot of connects to my fileserver from this IP adress, kept trying to login the entire time, can't much add to this notation besides this... a example of the log :

(001987) 11/23/2009 20:56:32 PM - (not logged in) (218.62.88.29)> USER Admin
(001987) 11/23/2009 20:56:32 PM - (not logged in) (218.62.88.29)> 331 Password required for admin
(001987) 11/23/2009 20:56:38 PM - (not logged in) (218.62.88.29)> USER Admin
(001987) 11/23/2009 20:56:38 PM - (not logged in) (218.62.88.29)> 331 Password required for admin
(001987) 11/23/2009 20:56:46 PM - (not logged in) (218.62.88.29)> USER Admin
(001987) 11/23/2009 20:56:46 PM - (not logged in) (218.62.88.29)> 331 Password required for admin
(001987) 11/23/2009 20:56:54 PM - (not logged in) (218.62.88.29)> PASS *
(001987) 11/23/2009 20:56:54 PM - (not logged in) (218.62.88.29)> 530 Login or password incorrect!
(001987) 11/23/2009 20:57:17 PM - (not logged in) (218.62.88.29)> PASS *
(001987) 11/23/2009 20:57:17 PM - (not logged in) (218.62.88.29)> 530 Login or password incorrect!
(001987) 11/23/2009 20:57:27 PM - (not logged in) (218.62.88.29)> 421 Login time exceeded. Closing control connection.

Attemptee ftp failed login hits 1829 in a day

Attemptee ftp failed login hits 1829 in a day

Snippet of log:

secure.1:Aug 31 16:29:45 ix vsftpd: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=218.62.88.29
secure.1:Aug 31 16:29:54 ix vsftpd: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=218.62.88.29
secure.1:Aug 31 16:30:00 ix vsftpd: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=218.62.88.29
secure.1:Aug 31 16:30:09 ix vsftpd: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=218.62.88.29
secure.1:Aug 31 16:30:18 ix vsftpd: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=218.62.88.29
secure.1:Aug 31 16:30:27 ix vsftpd: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=218.62.88.29
secure.1:Aug 31 16:30:33 ix vsftpd: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=218.62.88.29
secure.1:Aug 31 16:30:42 ix vsftpd: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=218.62.88.29
secure.1:Aug 31 16:30:51 ix vsftpd: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=218.62.88.29
secure.1:Aug 31 16:30:59 ix vsftpd: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=218.62.88.29
secure.1:Aug 31 16:31:06 ix vsftpd: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=218.62.88.29
secure.1:Aug 31 16:31:14 ix vsftpd: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=218.62.88.29
secure.1:Aug 31 16:31:23 ix vsftpd: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=218.62.88.29
secure.1:Aug 31 16:31:31 ix vsftpd: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=218.62.88.29
secure.1:Aug 31 16:31:38 ix vsftpd: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=218.62.88.29

Trying to login as Administrator on FTP server

lousy.. who will use user name call administrator nowadays?

Located at a Net café in Beijing, China: Windows Server Based OS Running a vulnerable version of VNC (4.1.1-4.1.3) Attacks ranged from 22-30 Passwords per Minute.



Both of the services fingerprints indicate that these are being used as zombies, added to the fact that the vulnerabilities on these boxes are very obvious.

FTP Brute force, looks like a bot