Just got this warning from my server...


Log entries:

Oct 22 12:19:34 morpheus pop3d: LOGIN FAILED, user=coveney, ip=[::ffff:67.15.187.3]
Oct 22 12:19:39 morpheus pop3d: LOGIN FAILED, user=coveney, ip=[::ffff:67.15.187.3]
Oct 22 12:19:44 morpheus pop3d: LOGIN FAILED, user=coveney, ip=[::ffff:67.15.187.3]
Oct 22 12:19:49 morpheus pop3d: LOGIN FAILED, user=coveney, ip=[::ffff:67.15.187.3]
Oct 22 12:19:55 morpheus pop3d: LOGIN FAILED, user=coveney, ip=[::ffff:67.15.187.3]

Seems someone is attempting to log into my server from a TP IP who has no business being here. I have forwarded the email to abuse. Hopefully this will be addressed right away.

I get logon attempts all of the time.
I just recently switched to a new server and although the problem is less, I still get a few idiots out there thinking they can get in.
I use EventSentry (Windows) so I receive an e-mail within seconds after an invalid attempt.
If the IP is listed, I just block it and the problem goes away.

Some people need better things to do.

I have been with TP/EV1 for many many years. This is the first time I have been hit with this sort of 'in house' attack. I got two more today...

Oct 23 12:56:05 morpheus pop3d: LOGIN FAILED, user=newlove, ip=[::ffff:67.15.110.11]

and

Oct 23 07:53:33 morpheus pop3d: LOGIN FAILED, user=blunt, ip=[::ffff:67.15.6.2]

They are automatically blocked here as well. However it would be nice if TP would shut down these folks.

Yea, I agree completely.
At least I have three IP's added to by block list.

Hell I will just block all of 67.15.x.x and be done with it.

That's a great policy. . . until the users start to complain about having their interests blocked.

But there's a dirty word we use for those annoying people. . .

"Clients"

Depends on the duties of that specific server.

Greetings:

We see multiple attacks from The Planet almost every single day. The only source that approaches the number of attacks is gnax.

We do report each attack (that has 3 or more log entries) to abuse @ theplanet.com.

Our main frustration is that we can report the same IP for weeks on end before seeing the attacks stop.

And, yes, while we can block the IP's and ranges, the attacks are so frequent from The Planet that we would spend just as much time blocking as reporting, and eventually iptables would fill up.

Thank you.

i've been getting hit by this one for quite a while:
Maximum connection limit reached for ::ffff:66.98.144.87: 4 Time(s)

i get them from planet ip's periodically, but once i stopped getting the "we're looking into it, but we can't tell you the results" type notice.. i stopped reporting. doesn't look as though anyone is reading these messages anymore?