最近我公司技术人员发现，我们的服务器受到多个国家黑客攻击，百度搜索一下发现，由于俄乌冲突，大量黑客暴力破解中国的服务器，通过控制中国服务器，向俄罗斯发出各类攻击信息，在此提醒国内的技术人员，加强网络安全措施，不要中了恶势力的黑招。
下面列举一下昨天的暴力破解的日志信息：
[root@website01 ~]# lastb -30
root ssh:notty 167.172.184.252 Sat Apr 23 16:54 - 16:54 (00:00)
root ssh:notty 167.172.184.252 Sat Apr 23 16:54 - 16:54 (00:00)
root ssh:notty 167.172.184.252 Sat Apr 23 16:54 - 16:54 (00:00)
root ssh:notty 167.172.184.252 Sat Apr 23 16:54 - 16:54 (00:00)
root ssh:notty 167.172.184.252 Sat Apr 23 16:54 - 16:54 (00:00)
root ssh:notty 167.172.184.252 Sat Apr 23 16:54 - 16:54 (00:00)
room ssh:notty 167.172.184.252 Sat Apr 23 16:54 - 16:54 (00:00)
room ssh:notty 167.172.184.252 Sat Apr 23 16:54 - 16:54 (00:00)
room ssh:notty 167.172.184.252 Sat Apr 23 16:54 - 16:54 (00:00)
room ssh:notty 167.172.184.252 Sat Apr 23 16:54 - 16:54 (00:00)
room ssh:notty 167.172.184.252 Sat Apr 23 16:54 - 16:54 (00:00)
room ssh:notty 167.172.184.252 Sat Apr 23 16:54 - 16:54 (00:00)
room ssh:notty 167.172.184.252 Sat Apr 23 16:54 - 16:54 (00:00)
room ssh:notty 167.172.184.252 Sat Apr 23 16:54 - 16:54 (00:00)
root ssh:notty 127.0.0.1 Sat Apr 23 10:52 - 10:52 (00:00)
mx ssh:notty 104.248.30.201 Fri Apr 15 14:32 - 14:32 (00:00)
mxuser ssh:notty 104.248.30.201 Fri Apr 15 14:32 - 14:32 (00:00)
mxuser ssh:notty 104.248.30.201 Fri Apr 15 14:32 - 14:32 (00:00)
mxintadm ssh:notty 104.248.30.201 Fri Apr 15 14:32 - 14:32 (00:00)
mxintadm ssh:notty 104.248.30.201 Fri Apr 15 14:32 - 14:32 (00:00)
[root@mail ~]# lastb -30
zzzezhar ssh:notty 138.68.106.113 Sat Apr 23 10:16 - 10:16 (00:00)
zzzezhar ssh:notty 138.68.106.113 Sat Apr 23 10:16 - 10:16 (00:00)
zzy ssh:notty 138.68.106.113 Sat Apr 23 10:16 - 10:16 (00:00)
zzy ssh:notty 138.68.106.113 Sat Apr 23 10:16 - 10:16 (00:00)
zzy ssh:notty 138.68.106.113 Sat Apr 23 10:16 - 10:16 (00:00)
zzy ssh:notty 138.68.106.113 Sat Apr 23 10:16 - 10:16 (00:00)
zzy ssh:notty 138.68.106.113 Sat Apr 23 10:16 - 10:16 (00:00)
zzq ssh:notty 138.68.106.113 Sat Apr 23 10:16 - 10:16 (00:00)
zzy ssh:notty 138.68.106.113 Sat Apr 23 10:16 - 10:16 (00:00)
zzq ssh:notty 138.68.106.113 Sat Apr 23 10:16 - 10:16 (00:00)
zzq ssh:notty 138.68.106.113 Sat Apr 23 10:16 - 10:16 (00:00)
zzn ssh:notty 138.68.106.113 Sat Apr 23 10:16 - 10:16 (00:00)
zzq ssh:notty 138.68.106.113 Sat Apr 23 10:16 - 10:16 (00:00)
zzn ssh:notty 138.68.106.113 Sat Apr 23 10:16 - 10:16 (00:00)
zzgong ssh:notty 138.68.106.113 Sat Apr 23 10:16 - 10:16 (00:00)
zzgong ssh:notty 138.68.106.113 Sat Apr 23 10:16 - 10:16 (00:00)
zzgong ssh:notty 138.68.106.113 Sat Apr 23 10:16 - 10:16 (00:00)
zzgong ssh:notty 138.68.106.113 Sat Apr 23 10:16 - 10:16 (00:00)
zzgong ssh:notty 138.68.106.113 Sat Apr 23 10:16 - 10:16 (00:00)
zzgong ssh:notty 138.68.106.113 Sat Apr 23 10:16 - 10:16 (00:00)
zzg ssh:notty 138.68.106.113 Sat Apr 23 10:16 - 10:16 (00:00)
zz ssh:notty 138.68.106.113 Sat Apr 23 10:16 - 10:16 (00:00)
友情提醒：遇到上面的暴力破解，linux系统直接将这个IP拉黑即可，具体命令举例如下(拉黑IP：138.68.106.113)：
iptables -I INPUT -s 138.68.106.113 -j DROP
如果有其它问题可与我们联系。
联系我们
