Web Hosting Talk : Web Hosting Main Forums : Hosting Security and Technology : SSH bruteforce - unfair competition

[heymar]

Hi,

We run a small hosting company.
I have recently checked logs and found interresting records.

Log cut:
--------------------
Jul _3 07:18:22 scorpion sshd(pam_unix)[27553]: authentication failure; logname=
uid=0 euid=0 tty=NODEVssh ruser= rhost=www.edgewebhost.com _user=root
--------------------
And there is alot of such
As you see remote host, from which connection was made is rhost=www.edgewebhost.com, from other webhosting company's primary server .
I've email'ed em about this case, but so far no reply.

The question would be:
Do you guys (admins) have seen such competitor's unfair work?

I think, this is amoral.

[DoCk]

They've probably been broken into. I doubt they are doing it on purpose. If you can't get through to them, notify the host they're on. It appears to be ServerMatrix/ThePlanet.

[Kasey]

I'd seriously doubt that edgewebhost.com is actually the one trying to brute-force you... it's quite possible that there's a user on that server that's responsible for the attack. (Which, either way, is still bad on their part.)

As for a resolution, I wouldn't even bother e-mailing the host... forward the log entries to abuse@theplanet.com (the owner of the IP) and they'll hopefully get it taken care of.

[CybexHost]

ThePlanet takes abuse seriously, just go ahead and use the email address above.

[heymar]

Hi everybody,

I've mailed ThePlanet.
Thank's for your replys.