The blocks 192.0.2.0/24 (TEST-NET-1), 198.51.100.0/24 (TEST-NET-2), and
203.0.113.0/24 (TEST-NET-3) are provided for use in documentation per RFC
5737.
On Jun 13, 2013 10:02 AM, "Yaroslav Halchenko" <notifications@github.com>
wrote:

> In testcases/files/logs/proftpd:
>
> > @@ -1,5 +1,8 @@
> >  Jan 10 00:00:00 myhost proftpd[12345] myhost.domain.com (123.123.123.123[123.123.123.123]): USER username (Login failed): User in /etc/ftpusers
> >  Feb 1 00:00:00 myhost proftpd[12345] myhost.domain.com (123.123.123.123[123.123.123.123]): USER username: no such user found from 123.123.123.123 [123.123.123.123] to 234.234.234.234:21
> > +Jun 09 07:30:58 platypus.ace-hosting.com.au proftpd[11864] platypus.ace-hosting.com.au (mail.bloodymonster.net[::ffff:67.227.224.66]): USER username (Login failed): Incorrect password.
> > +Jun 09 11:15:43 platypus.ace-hosting.com.au proftpd[17424] platypus.ace-hosting.com.au (::ffff:101.71.143.238[::ffff:101.71.143.238]): USER god: no such user found from ::ffff:101.71.143.238 [::ffff:101.71.143.238] to ::ffff:123.212.99.194:21
> > +Jun 13 22:07:23 platypus.ace-hosting.com.au proftpd[15719] platypus.ace-hosting.com.au (::ffff:59.167.242.100[::ffff:59.167.242.100]): SECURITY VIOLATION: root login attempted.
>
> Should we may be adhere to convention you introduced to use 1.2.3.4 as the
> sample abuser IP? ;-)
> Also I thought to suggest to use e.g. 1.2.3.44 for those victim IPs
> someone might inject?
> if you have proftpd running -- could you also try simulating injection and
> embedding few nice ones here?
>
> —
> Reply to this email directly or view it on GitHub<https://github.com/fail2ban/fail2ban/pull/252/files#r4677992>
> .
>