What to do against continuous FTP attack

Question

I have a server (windows 2008) and this server uses WebsitePanel to host some websites. I tried to setup Mozilla FTP server, but I cannot get this to work. As I do not use it I do not mind.

However by accident I almost immediately noticed that a hacker tried to gain access to the FTP.

I can see this because Mozilla FTP shows all failed logons and shos an IP-address. As FTP doesn't work all logons will fail. And as nobody is supposed to use this FTP, it can only be someone with bad intensions. Plus most attacks seem to originate from Russia and Brazil and my websites are all in Dutch.

At first I entered the IP-numbers that Mozilla showed me in IP and domain restricions and FTP domain and IP-restrictions (server wide). But I noticed that when the same IP-address was used (which doesn't happen that often), that they could still try to connect to FTP (my idea was, what is than the use of this IIS protection).

So now I created in my Windows firewall a block restriction for all programs and entered all IP -addresses (over 200).

What I would like to know is how do they do it. I can see they try to logon and they use about 15 attempts, than within a second they change IP-number and again 15 attempts. So I cannot believe these attempts are from different persons.

Are they using IP-spoofing?? If so, can they random choose a new IP-number? Because than there would be no use in blocking these IP-numbers. Or are they using relays, ghost computers or however you want to call it.

Furthermore I noticed they know which websites I have on that server. Did they get access to my server somehow and thus know the names of the websites, or are they using some reverse IP option to find out which websites all go to my IP-address??

Also I noticed that sometimes for a certain period thay use the email accounts I have and spoof their spam email to pretend as if I send it. Again, did they get access to my computer or as they know the websites simply guess some email addresses that go with these websites (email@ and info@ after all is not that hard to guess).

On my server I cannot detect anything strange, no virusses, no strange files, nothing has changed??

I thought I could use the Mozilla FTP as some kind of honey trap and that at some point I would have all the computer IP numbers that they use to do this. But if they can simply choose a random number than there would be no point in doing this.

Answer 1

Your guess is right - the attackers can use an almost unlimited range of IP addresses if they have a botnet. So trying to block IP addresses manually is pointless.

There are tools such as fail2ban that can be setup to block any that meet specific rules, but if all they are trying to do is access a service you do not offer then try not to worry too much.

As regards your email question - generally return-email-address spoofing does not imply they have compromised anything. Anyone cab set their return address to be anything they like.