This is pretty common. We see short bursty attacks via FTP periodically. Since the IP addresses will most likely change over time, blocking the IP isn't feasible. However, you might implement a process that locks a particular ID after X attempts, and unlocks it after Y minutes from the last attempt, to avoid intrusion... or implement a process to alert you to the intrusion attempt.
If this is the admin ID they are attempting, you would do well to change it to something other than administrator or admin. Obviously any processes you have running under that ID need to be altered to accommodate the name change as well. Hope this helps, Darin. ----- Original Message ----- From: "Greg Shepherd" <[EMAIL PROTECTED]> To: "IMail Forum (E-mail)" <[email protected]> Sent: Monday, April 03, 2006 3:09 PM Subject: [IMail Forum] OT - MSFTPSRV Under WINNT4.0 Server SP6a, I am getting bad or wrong password errors under administrator for approx. 3 minutes per day. This server is on the public side of CISCO PIX515E Firewall. This server runs Imail and my website. I think somewhere some is attempting to break in. Can anyone tell me preferably off line, 1.) What potentially is going on? Good or Bad? 2.) How Can I find who it is? 3.) How to Block? Thanks for your assistance!!! Greg Shepherd Catalyst Manufacturing Services, Inc Test Engineering 2507 Wayne Street Endicott, New York 13760 Phone: 607-786-6300 x328 Fax: 607-748-8557 Email: [EMAIL PROTECTED] **************************************************************************** The contents of this email and any attachments may be privileged, Confidential, and protected from disclosure. It is intended only for the use of the individual to whom it is addressed. Access to this email by anyone else is unauthorized. If you are not the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you received this communication in error, please notify us immediately by replying to the message and deleting it from your computer. Additional assistance can be obtained by emailing [EMAIL PROTECTED] Thank you. **************************************************************************** To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
