Re: [tor-relays] SSH Bruteforce Attempts

2017-10-04 Thread tanous .c
Thank you all for replying, I will answer the notification with the template mentioned by Rejo and include the link for ExoneraTor recommended by Jon. Best Regards, Tanous 2017-10-04 11:34 GMT-03:00 Jonathan Proulx : > Here's my version of the same: > > Hello, > > The source address 128.52.128.

Re: [tor-relays] SSH Bruteforce Attempts

2017-10-04 Thread Jonathan Proulx
Here's my version of the same: Hello, The source address 128.52.128.105 is a Tor exit node, and is not the origin point for the traffic in question. See http://tor-exit.csail.mit.edu (which is the host in your logs) for details. Any action taken on this node would simply result in the problem t

Re: [tor-relays] SSH Bruteforce Attempts

2017-10-04 Thread Rejo Zenger
Hey, Yes, I do more or less the same. If the complaint is sent using some automated system, I "do nothing." If the complaint is sent by a human, I'll answer them with a template, see below. If there is a followup response to that, I'll do some more explaining, oftentimes pointing them at the bl

Re: [tor-relays] SSH Bruteforce Attempts

2017-10-03 Thread teor
> On 3 Oct 2017, at 22:35, tanous .c wrote: > > Have any of you had this sort of problem? I'm having difficulty determining > if this log information represents a normal exit relay ocurrence or if my > server has been compromised... What could i do in order to solve this? Yes, Profihost sent

[tor-relays] SSH Bruteforce Attempts

2017-10-03 Thread tanous .c
Hi, I have been running one tor exit relay for about 51 days and i recently got this abuse report: Good afternoon, Your Ip address (212.47.239.73) has been reported to us by profihost because it seems to have attempted to bruteforce. Thank you to take the necessary action as soon as possible.