Re: Massiv dictionary attacks from <rackspace.com>

Hi,
you can use fail2ban program or block the ip by iptables manually.
I'm suggestion fail2ban. it's a login attempt counter. 

On Tue, 2012-08-14 at 13:43 +0200, Michelle Konzack wrote: 

> Hello Colleges and *,
> 
> since Sunday 19:47 CEST 18 of my servers are under heavy attack.
> 
> Currently I have counted over  18  million  login  attempts  (dictionary
> attack) with a list of 1005 names an started with IP <50.56.180.220>.
> 
> --[ '/var/log/mail.log' ]-----------------------------------------------
> Aug 12 19:47:32 vserver04 imapd: Connection, ip=[::ffff:50.56.180.220]
> Aug 12 19:47:53 vserver04 imapd: Connection, ip=[::ffff:50.56.180.220]
> ------------------------------------------------------------------------
> 
> I have encountered this problem tody, whil I saw, the logsize increased
> by the factor 200!  Mean, my daily mail.log are arround 1.8 GByte!
> 
> Also since yesterday, I get similar attacks by 3 other IPs from the USA.
> 
> Does someone have encountered similar things?
> 
> Note:  I try to reach (a personaly known) FBI filed officer
>        from New York since I work a PMC.
> 
> Thanks, Greetings and nice Day/Evening
>     Michelle Konzack
> 


-- 
M.Atıf CEYLAN
Yurdum Yazılım