0

Running some servers I noticed increased SSH Brute Force Login Attempts over the years. fail2ban is a great tool which massively slows them down and can email the abuse-mailbox/OrgAbuseEmail of the network admin's IP range by querying the RIPE Database automatically.

The login attempts mostly stem from networks of companies I would trust to be at least interested in fighting abuse (not some bullet-proof servers in overseas).

  1. Are Brute Force Login Attempts considered abuse at all?
  2. As I am not a hosting provider for arbitrary customers but merely a server admin, I have no clue whether I would simply disregard/drop those automated email as a hosting provider or whether I would take action. Personally, I never received any complaint, so I really don't know.
  3. Can I trust the data on RIPE? Can automated email to the abuse contact be abused itself, if enabled?
1
  • 1
    You should expect the server and domain you send from to get flagged as spam, even though it isn't. Very few networks will read the emails. If they get enough, they will just block you. I am not aware of any ISP's that stop people from brute forcing. This also does nothing. Their scripts will detect bots offline and just switch to a dozen of the thousands of compromised hosts in their pool. Even if you managed to block 10%, they would just get more compromised hosts. IMO the best you could do would be to tarpit them as long as you can rather than block them if you wanted to slow them.
    – Aaron
    Mar 10, 2020 at 15:27

1 Answer 1

0

Don't. Spam selling Viagra is bad enough, hundreds of mails each minute for failed SSH attempts from hijacked IP addresses from all over the world just won't be looked at.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .