[Xitami] Annoying FTP-Bots

[navy nut]

As of late...
   
  I've been getting hit quite frequently by something that appears to be a BOT of sorts, trying (in rapid succession) to break entry into my FTP login... using a handful of common generic user-names (and probably an assortment of various common passwords).
   
  To my knowledge, this "bot thing" has never successfully gained access... but often hammers away several times per minute, for hours on end, until it finally crashes Xitami (if/when it goes undetected).  This is most annoying, because it means that I have to keep someone periodically monitoring log-files around the clock.
   
  At times when I've caught this activity in action, I've simply just closed port 21 on the router for an hour or two, and the bot goes away... but only to return a few days (or whenever it pleases) later, and always identifies itself by a different IP-address upon it's return.  At least I assume it's the same bot... masked behind an available open proxy.
   
  I'm curious to know if anyone else has had this trouble, and what they've done to correct it.
   
  A SAMPLE CLIP FROM THE ERROR LOG:
   
  140.135.9.174 - admin [07/May/2007:17:44:02 -0700] "ftp://140.135.9.174/" 530 0 "-" ""
140.135.9.174 - admin [07/May/2007:17:44:04 -0700] "ftp://140.135.9.174/" 530 0 "-" ""
140.135.9.174 - admin [07/May/2007:17:44:07 -0700] "ftp://140.135.9.174/" 530 0 "-" ""
140.135.9.174 - admin [07/May/2007:17:44:09 -0700] "ftp://140.135.9.174/" 530 0 "-" ""
140.135.9.174 - admin [07/May/2007:17:44:12 -0700] "ftp://140.135.9.174/" 530 0 "-" ""
140.135.9.174 - admin [07/May/2007:17:44:14 -0700] "ftp://140.135.9.174/" 530 0 "-" ""
140.135.9.174 - admin [07/May/2007:17:44:17 -0700] "ftp://140.135.9.174/" 530 0 "-" ""
140.135.9.174 - admin [07/May/2007:17:44:19 -0700] "ftp://140.135.9.174/" 530 0 "-" ""
140.135.9.174 - admin [07/May/2007:17:44:22 -0700] "ftp://140.135.9.174/" 530 0 "-" ""
140.135.9.174 - admin [07/May/2007:17:44:24 -0700] "ftp://140.135.9.174/" 530 0 "-" ""
   
  Rod
   

       
---------------------------------
Ask a question on any topic and get answers from real people. Go to Yahoo! Answers. 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.xitami.org/pipermail/xitami/attachments/20070508/460b9aca/attachment.htm