Multiple Servers - Bruteforce messages in error_log

[outeredgeuk]

Hello,

We have been receiving abuse notices that our server is the source of bruteforce attacks. I can't see much evidence to suggest we have besides some unusual messages in the /var/log/httpd/error_log on both servers.

cat: vulnerables.txt: No such file or directory

               private private private

                      scanner

                private usage
Start IP: 76.191.0.0
End   IP: 76.191.255.255
bruteforce ftp on: 76.191.37.25
bruteforce ftp on: 76.191.37.34
Wrong ftp answer from 76.191.37.34
Wrong ftp answer from 76.191.37.25
bruteforce ftp on: 76.191.47.51
bruteforce ftp on: 76.191.47.57
Wrong ftp answer from 76.191.47.51
bruteforce ftp on: 76.191.47.65
bruteforce ftp on: 76.191.47.66
bruteforce ftp on: 76.191.47.68
bruteforce ftp on: 76.191.47.64
bruteforce ftp on: 76.191.47.118

Can anyone help us to diagnose the cause of this? Thanks!

 

[outeredgeuk]

Fixed

Turns out that a script had been uploaded via Squirrel mail, all sorted now.