от хостера пришло интересное сообщение

"It appears that a user from your network has been trying to hack into our web server. We respectfully request that you investigate this incident as soon as possible and that this person immediately cease and desist from further brute force attacks on our server. See our servers Brute Force Detection log below.
Thank you for your cooperation in this matter."

The remote system **.***.5.154 was found to have exceeded acceptable login failures on dedicated.azriver.com; there was 23 events to the service sshd. As such the attacking host has been banned from further accessing this system. For the integrity of your host you should investigate this event as soon as possible.

Executed ban command:
/etc/apf/apf -d **.**.5.154 {bfd.sshd}

The following are event logs from **.***.5.*54 on service sshd (all time stamps are GMT -0700):

Jun 4 08:45:27 dedicated sshd[2367]: Failed password for root from **.***.5.154 port 50126 ssh2
Jun 4 08:45:29 dedicated sshd[2375]: Failed password for root from **.***.5.154 port 50204

Hello from AT&T Hosting and Applications Services. I am a Security Engineer here trying to track down a security incident that appears to have originated from your network
on June 04, 2009. Please investigate a TCP sweep of port 22 from the IP **.***.5.154 and inform me of the results (account cancelled, user warned, etc). I will require this
information in order to close the ticket on this activity. I have attached a portion of the log details as evidence. All times are EDT (GMT -4).

(NOTE: This is an automated email response to the incoming scan/attack.)

15:25:27 **.**.5.154 0.0.0.0 [TCP-SWEEP] (total=398,dp=22,min=212.1.185.0,max=212.1.184.255,Jun04-15:25:27,Jun04-15:25:27) (USI-amsxaid01)
15:26:13 **.**.5.154 0.0.0.0 [TCP-SWEEP] (total=159,dp=22,min=212.1.189.0,max=212.1.190.255,Jun04-15:25:27,Jun04-15:25:28) (USI-amsxaid01)