Ever since I finally got the server's email system properly configured, I began receiving nightly summaries from the LogWatch script. Part of the report details system logins and attempted logins. There are usually a handful of failed login attempts each day, but yesterday was the worst I've seen. There were over 2,000 login attempts coming from three separate hosts. A MaxMind GeoIP lookup of these IP addresses showed that most came from an ISP based out of New York while others came from a Danish ISP and a handful of others came from our good friends at Brasil Telecom.
