Massive SSH infections

Comments

• jbiloh Administrator, Veteran

  August 2020

  @rcxb said:
  Well, NOBODY visits lowendbox right now... Looks kinda like @jbiloh didn't pay his VPS bill.

  
  https://i.ibb.co/94d5Z16/LEB404.png

  There was an issue with cpanel that has since been resolved. Please flush your cache and try again.
• sally Member

  August 2020

  @tetech said:

  @ErawanArifNugroho said:
  Who's the girl name?

  https://en.wikipedia.org/wiki/Pernille_Harder_(footballer)

  You may be legitimately concerned that I know this information.

  Are you a bean flicker by any chance...?
• ErawanArifNugroho Member

  August 2020

  me??? nooo
• Saahib Host Rep, Veteran

  August 2020

  @cochon said:

  @Saahib said:
  I have seen that simply disabling root access to SSH causes bots to not to come back once they know it. There will be brute force attacks but lesser and mostly from new IPs only.

  That's interesting, I was sure that the block wasn't obvious to the intruder, that they still got asked for a password even if the user login was ultimately invalid. Are you sure you didn't also switch off PasswordAuthentication?

  Nope, its not disabled. However, could be coincidence but have seen drop in numbers of repeat attack.