IP lokalisieren

R

Raven6299

Member
Hallo,

in lezter Zeit werde ich via FTP sehr stark attakiert. Die SSH Schnittstelle habe ich schon abgesichert. Wer kann mir sagen, wo diese IP herkommt?

Code: 
Aug 19 17:51:19 v285 proftpd[6600]: v285.1blu.de (211.162.31.102[211.162.31.102]) - FTP session opened. 
Aug 19 17:51:20 v285 proftpd[6600]: v285.1blu.de (211.162.31.102[211.162.31.102]) - no such user 'Administrator' 
Aug 19 17:51:20 v285 proftpd[6600]: v285.1blu.de (211.162.31.102[211.162.31.102]) - USER Administrator: no such user found from 211.162.31.102 [211.162.31.102] to 82.98.72.2:21 
Aug 19 17:51:21 v285 proftpd[6600]: v285.1blu.de (211.162.31.102[211.162.31.102]) - no such user 'Administrator' 
Aug 19 17:51:21 v285 proftpd[6600]: v285.1blu.de (211.162.31.102[211.162.31.102]) - USER Administrator: no such user found from 211.162.31.102 [211.162.31.102] to 82.98.72.2:21 
Aug 19 17:51:22 v285 proftpd[6600]: v285.1blu.de (211.162.31.102[211.162.31.102]) - no such user 'Administrator' 
Aug 19 17:51:22 v285 proftpd[6600]: v285.1blu.de (211.162.31.102[211.162.31.102]) - USER Administrator: no such user found from 211.162.31.102 [211.162.31.102] to 82.98.72.2:21 
Aug 19 17:51:22 v285 proftpd[6600]: v285.1blu.de (211.162.31.102[211.162.31.102]) - Maximum login attempts (3) exceeded 
Aug 19 17:51:22 v285 proftpd[6600]: v285.1blu.de (211.162.31.102[211.162.31.102]) - FTP session closed. 
Aug 19 17:51:22 v285 proftpd[7179]: v285.1blu.de (211.162.31.102[211.162.31.102]) - FTP session opened. 
Aug 19 17:51:25 v285 proftpd[7179]: v285.1blu.de (211.162.31.102[211.162.31.102]) - no such user 'Administrator' 
Aug 19 17:51:25 v285 proftpd[7179]: v285.1blu.de (211.162.31.102[211.162.31.102]) - USER Administrator: no such user found from 211.162.31.102 [211.162.31.102] to 82.98.72.2:21 
Aug 19 17:51:26 v285 proftpd[7179]: v285.1blu.de (211.162.31.102[211.162.31.102]) - no such user 'Administrator' 
Aug 19 17:51:26 v285 proftpd[7179]: v285.1blu.de (211.162.31.102[211.162.31.102]) - USER Administrator: no such user found from 211.162.31.102 [211.162.31.102] to 82.98.72.2:21 
Aug 19 17:51:28 v285 proftpd[7179]: v285.1blu.de (211.162.31.102[211.162.31.102]) - no such user 'Administrator' 
Aug 19 17:51:28 v285 proftpd[7179]: v285.1blu.de (211.162.31.102[211.162.31.102]) - USER Administrator: no such user found from 211.162.31.102 [211.162.31.102] to 82.98.72.2:21 
Aug 19 17:51:28 v285 proftpd[7179]: v285.1blu.de (211.162.31.102[211.162.31.102]) - Maximum login attempts (3) exceeded 
Aug 19 17:51:28 v285 proftpd[7179]: v285.1blu.de (211.162.31.102[211.162.31.102]) - FTP session closed. 
Aug 19 17:51:29 v285 proftpd[8264]: v285.1blu.de (211.162.31.102[211.162.31.102]) - FTP session opened. 
Aug 19 17:51:30 v285 proftpd[8264]: v285.1blu.de (211.162.31.102[211.162.31.102]) - no such user 'Administrator' 
Aug 19 17:51:30 v285 proftpd[8264]: v285.1blu.de (211.162.31.102[211.162.31.102]) - USER Administrator: no such user found from 211.162.31.102 [211.162.31.102] to 82.98.72.2:21 
Aug 19 17:51:30 v285 proftpd[8264]: v285.1blu.de (211.162.31.102[211.162.31.102]) - no such user 'Administrator' 
Aug 19 17:51:30 v285 proftpd[8264]: v285.1blu.de (211.162.31.102[211.162.31.102]) - USER Administrator: no such user found from 211.162.31.102 [211.162.31.102] to 82.98.72.2:21 
Aug 19 17:51:31 v285 proftpd[8264]: v285.1blu.de (211.162.31.102[211.162.31.102]) - no such user 'Administrator' 
Aug 19 17:51:31 v285 proftpd[8264]: v285.1blu.de (211.162.31.102[211.162.31.102]) - USER Administrator: no such user found from 211.162.31.102 [211.162.31.102] to 82.98.72.2:21 
Aug 19 17:51:31 v285 proftpd[8264]: v285.1blu.de (211.162.31.102[211.162.31.102]) - Maximum login attempts (3) exceeded 
Aug 19 17:51:31 v285 proftpd[8264]: v285.1blu.de (211.162.31.102[211.162.31.102]) - FTP session closed.


Wie kann ich das FTP besser absichern? Gibts da Scripts ähnlich wie Denyhosts?
 
Hallo,

zur IP WHOIS - 211.162.31.102

Code: 
...
address:      East District, Beijing, China (100027)
.....
Den Rest bitte selber lesen, wegen Datenschutz ;)

Zum FTP, auch dort kannst du den Port verlegen zum Beispiel.
Reicht vor erst für die meisten Scriptkiddies und da ich bezweifel das ein Chinese (wenn das kein Proxy ist den der nutzt) interesse an deinem Server hat sind auch das irgendwelche Scriptkiddies

Ich muss mich verbessern.
Das scheind einne Dynamische IP zu sein.
Also ist die Wahrscheinlichkeit das das ein Proxy ist(war) noch geringer.
 
Last edited by a moderator:
You must log in or register to reply here.
Back
Top