I've had attempts that appear in other logs, some of which are the from the same sites. Try checking the logs for ssh, proftp, samba, nfs and others that you have. My attackers have so far gone after root, adm, nobody, anonymous. Some of these guys try awful hard and repeatedly. Alvin