I logged into a CentOS box today to find the following"
There were 11126 failed login attempts since the last successful login.
Last login: Tue Mar 10 14:36:47 2015 from X.X.X.X
Thats 11 THOUSAND login attempts in the last 3 days. WTF? Please note that this is a brand new IP I got from my provider and the box is brand new. I've yet to publish anything off of this box.
Why would I be getting such a large number of login attempts? Is it some kind of IP / Port scan?
There are essentially 4 culprits, 2 from China (MOVEINTERNET-NETWORK), 1 from Hong Kong (HEETHAI-HK) and 1 from Verizon (Verizon Online LLC (VRIS)).
This is only happening on SSH. No issues on HTTP. Should I Null route the culprit subnets? What do you guys suggest?