In my nginx logs I see
May 24 09:31:50 hosting pure-ftpd[343599]: (?@140.143.237.55) [INFO] New connection from 140.143.237.55
May 24 09:31:52 hosting pure-ftpd[343582]: (?@140.143.237.55) [WARNING] Authentication failed for user [wwwroot]
May 24 09:31:52 hosting pure-ftpd[343582]: (?@140.143.237.55) [INFO] Logout.
May 24 09:31:56 hosting pure-ftpd[343624]: (?@140.143.237.55) [INFO] New connection from 140.143.237.55
May 24 09:31:57 hosting pure-ftpd[343599]: (?@140.143.237.55) [WARNING] Authentication failed for user [wwwroot]
May 24 09:31:57 hosting pure-ftpd[343599]: (?@140.143.237.55) [INFO] Logout.
May 24 09:32:02 hosting pure-ftpd[343624]: (?@140.143.237.55) [WARNING] Authentication failed for user [wwwroot]
May 24 09:32:02 hosting pure-ftpd[343624]: (?@140.143.237.55) [INFO] Logout.
May 24 09:32:02 hosting pure-ftpd[343644]: (?@140.143.237.55) [INFO] New connection from 140.143.237.55
May 24 09:32:08 hosting pure-ftpd[343657]: (?@140.143.237.55) [INFO] New connection from 140.143.237.55
I can see that this is a China based IP and no authorised login is expected from this IP.
What should I do? I have blocked the IP in firewwall. A
Anything else to be done? Should I be worried?
Topic: Understanding login attempts (Read 3227 times)
