On 2/24/2020 9:38 PM, steve wrote: > Hi there, > > Since February 11th at 00:25:09, I am getting the following every 12 > secondes: > > Feb 11 00:25:09 box sshd[17733]: Connection closed by 118.126.105.120 > port 54422 [preauth] > > And when I say every 12 seconds, it is really every 12 seconds, and this > is now going on for more than 13 days, without any interruption. At the > beginning, I thought that this was just standards nmap scans or > something similar and so didn't bother taking any action. But now I'm > asking myself who (in China) would be so stupid to continue this > scanning. > > What should I do? Send an email to the abuse contact? Ignore it and wait > that it's over? It doesn't seem naughty but it's getting irritating. >
Find a way to block/ban this address, fail2ban, firewall and to some extend sshd_config. -- John Doe
