Quote from: Holliday on May 20, 2016, 06:35:24 AM

Quote from: sho_road_warrior on May 20, 2016, 05:16:15 AM

I just banned them via core.

I did the same. Banned about 40 of them. Haven't seen any more pop up yet.

Wait 24 hours they will be back (unless you set a higher ban time for core). Todays list of IPs below. They seemed to have kept the connection established longer[1]. I am considering just banning all amazon IPs (already banning /16 subnets anyway) for a longer time. Mainly because I cant take care of this every day or think about a more smooth solution. Might not be needed if Lauda (or someone else) finds a good enough pattern for a fail2ban script.

Code:

52.51.204.60
52.51.204.57
52.51.136.220
52.51.204.88
52.51.170.201
52.51.170.223
52.51.32.197
52.51.186.21
52.17.174.61
52.51.32.197
52.51.204.55
52.51.170.201
52.51.170.223
52.51.204.57
52.51.180.197
52.51.186.21
52.51.204.55
52.51.186.21
52.51.204.60
52.51.136.220
52.51.204.93
52.51.32.197
52.51.204.57
52.51.204.55
52.51.170.223
52.51.204.88
52.51.204.93
52.51.170.201
52.17.174.61
52.51.136.220
52.17.174.61
52.51.204.60
52.51.180.197
52.51.180.197
52.51.204.88
52.51.204.93

[1] http://i.imgur.com/a2xwmwR.png