proftpd:session ntml

[Gorlist]

Good day, question of slight concern, recently in the logs theirs been allot of sessions open and closed on the proftpd under the user of "ntml", which shouldn't/doesn't exist. Each attempt is from a different IP address location.

Any suggestions on what it could be, and how best to block this?

 

[IgorG]

Seems it was hacker's attack on your Proftpd server. Make sure that you have installed latest version of Plesk with updated proftpd package.
There are no any special related to Plesk recommendation - usual anti-hackers solution can be suggested.

 

[Gorlist]

thanks for the quick reply, just wanted to confirm. - already fully upto date