Here's a list of IP addresses that have been found trying to compromise websites hosted by PHP Site Solutions.
Hopefully this list will help others.
Note: This list is in the same format that we've banned the IP addresses in our server firewall. So an IP address that ends as .0/24 is banning that entire IP subnet for bad activity.
If you use the APF firewall under Linux, you can just paste the following IPs into your /etc/apf/deny_hosts.rules file, and then restart APF.
Code:
61.109.250.63
72.47.202.35
72.32.209.74
209.217.76.226
200.165.79.34
209.217.76.244
67.15.206.26
87.106.163.214
208.25.206.130
222.236.47.188
221.139.104.105
213.171.225.234
87.106.64.66
78.111.80.24
94.23.6.5
85.214.32.37
201.232.54.48
74.213.164.118
77.221.130.5
59.124.216.187
74.124.194.104
65.98.61.26
216.67.244.130
217.116.84.254
59.124.218.51
59.124.217.59
193.178.144.180
213.251.129.46
87.106.29.58
202.153.103.135
64.33.81.67
128.121.61.104
69.57.170.33
121.12.180.0/24
58.111.210.62
12.187.141.2
95.24.44.150
67.33.132.237