Tixy wrote: >> Since February 11th at 00:25:09, I am getting the following every 12 >> secondes: >> >> Feb 11 00:25:09 box sshd[17733]: Connection closed by 118.126.105.120 >> port 54422 [preauth] > > I'm getting that too. +1 :( and I am not using standard port 22, so they scanned all 30000 ports and found out what is open (well filtered) and now are trying to do brute force on SSH. Others are trying to exploit apache/php & Co.