So I feel like a security BOSS right now...

We have just adopted the firewall Watchguard system and I have been slowly learning it. Today we were experiencing a slow down and watchguard will point out who is doing it (Super Handy!). While investigating that, I stumbled across a rouge IP that was trying to FTP to one of our servers. Finding this strange, i looked it up on whatsmyipaddress and it was an ISP in China!!

Continuing down this strange tale, I check our FTP site and everything seemed ok (no missing or "new" data), I then went to the logs. It appears our boys in China were trying a Brute-Force attack against the FTP server with all the usual names (admin, administrator, root....etc). They have now joined the illustrious BAN-HAMMER group on watchguard and our company is safe for another day! (Cue cape and superhero theme!)

hehehe Just had to share :)