Article written by

2 Responses

Page 1 of 1
  1. Jon Jennings
    Jon Jennings at | | Reply

    Very interesting. In the 1000+ IP addresses that have hit me, I haven’t seen any of those ones. I guess it’s true – there’s a LOT of machines out there in this botnet.

    Makes me wonder how effective IP blocking is – although the more prolific IP addresses in my list are hitting me once every 20 mins or so, presumably to avoid triggering IP blocks… I don’t know if that’s learned behaviour (ie they would have hit me continuously, but have discovered they get blocked), or programmed into the script. Maybe if I didn’t have a lockdown plugin then they’d just throw a dictionary straight at me 🙂 [I saw that on the root account on my VPS once… 6600 attempts in 48 hours from about 3 addresses LOL]

    I’m fascinated to see that IP address that’s hit you on real user accounts. Maybe someone’s taken your comments to heart and written a better script!

    85.114.133.118 certainly loves you. My BFF is 94.242.237.101

Leave a Reply