Is this a Brute Force Attack?
2 days ago I created a user with the username "test" and password "test". I forgot to delete it afterward, and when I logged in, I noticed my server slowing down. I checked htop and saw a process running and using 100% of the memory. The program was called "./Opera". It said that "test" was running this program. I quickly deleted the user, stopped the program, and changed my root password. Since then, there have been various attempts to log in to my root account. I set up fail2ban today with a rule to ban all IP addresses permanently after 2 failed attempts. This is the list of IPs that have been trying to log in. Is this normal?
2 days ago I created a user with the username "test" and password "test". I forgot to delete it afterward, and when I logged in, I noticed my server slowing down. I checked htop and saw a process running and using 100% of the memory. The program was called "./Opera". It said that "test" was running this program. I quickly deleted the user, stopped the program, and changed my root password. Since then, there have been various attempts to log in to my root account. I set up fail2ban today with a rule to ban all IP addresses permanently after 2 failed attempts. This is the list of IPs that have been trying to log in. Is this normal?