|
|
|
|
#1
05-06-2005, 03:02
|
|||
|
|||
|
Login bruteforcer at ExeTools?
I had a 5 logins at my account attempt here at ExeTools. It seems that someone here is trying to gain illegal access or sth.
The attempt made by the IP: 218.86.217.58 Which by the way is online now. Anyone had similar experience? 
|
|
#2
05-06-2005, 04:48
|
|||
|
|||
|
Same thing for my account, same IP.
|
|
#3
05-06-2005, 04:56
|
|||
|
|||
|
This is about as close as one can get to the IP:
Search results for: 218.86.217.58 OrgName: Asia Pacific Network Information Centre OrgID: APNIC Address: PO Box 2131 City: Milton StateProv: QLD PostalCode: 4064 Country: AU Seems someone "down under" may be attempting something they shouldn't. Keep me advised. We may have to ban that IP range or something. Regards,
__________________
JMI
|
|
#4
05-06-2005, 07:52
|
|||
|
|||
|
It seems that the bruteforcer didnt knew how things and member levels work in ExeTools (= isnt a member or never been) because bruteforcing my account doesnt make any sense, since my level allows basic and limited things in forum and only uploading in FTP (the interesting part for most).
Anyway, a forum/ftp ban to the C class (218.86.217.*) would be good solution for now. And I dont believe that is an open proxy because ports 8080 and 1080 are closed.
|
|
#6
05-06-2005, 15:50
|
|||
|
|||
|
Yes, i know C Class is 255 IPs. Usually, admins ban the whole IP range to ensure that user will not use a neighbor ip to attempt more attacks.
|
|
#7
05-06-2005, 16:14
|
||||
|
||||
|
same here, the type and extension of the attack make me thinking of a simple robot used by some guy connected to an ISP..VisualRoute also reports some other infos
inetnum: 218.86.128.0 - 218.86.255.255 netname: CHINANET-GZ descr: CHINANET Guizhou province network descr: Data Communication Division descr: China Telecom country: CN admin-c: CH93-AP tech-c: DL72-AP mnt-by: MAINT-CHINANET mnt-lower: MAINT-CHINANET-GZ status: ASSIGNED NON-PORTABLE changed: [email protected] 20020424 changed: [email protected] 20040927 source: APNIC so banning a single class is meaningless, better would be to ban the whole provider..try looking at the contact's log in the china area of the forum instead..if a there's a log..
__________________
Ŝħůb-Ňìĝùŕřaŧħ ₪) There are only 10 types of people in the world: Those who understand binary, and those who don't http://www.accessroot.com
|
|
#8
05-06-2005, 20:50
|
||||
|
||||
|
Quote:
1. Knowing user password. 2. Knowing user email address and thus pretty often user country. 3. Reading user private messages. 4. Trying to use ExeTools password (or slighty modified) on user email box - often it will work. Imagine what will happen. Now you see how dangerous it can be. Last edited by dyn!o; 05-06-2005 at 20:54.
|
|
#9
05-06-2005, 21:34
|
|||
|
|||
|
Quote:
 Btw, I agree with all provider BAN.
|
|
#10
05-06-2005, 23:40
|
|||
|
|||
|
Well this is strange. Yesterday when I searched for the IP 218.86.217.58 I got the posting I got the information I listed in Post #3 above. I just wrote here that this was not the same as the one posted by Shub-Nigurrath:
218.86.128.0 - 218.86.255.255 but when I checked the original IP again I got the same information Shub-Nigurrath posted. I thought I had copied and pasted the original IP into the search engine, but I apparently did something wrong, because it is clearly from China, and not Australia.  However, I do not believe it would be a good idea to attempt to ban as wide a range of IPs using the C component (rather than the D component), since it would effectively ban the entire Guizhou province. Aaron's IP might even be from that group, I haven't checked recently. Then we'd all be in trouble.  It would be a GOOD IDEA to tighten up the security of your passwords, both here and on your email.  Regards,
__________________
JMI
|
|
#11
05-07-2005, 00:03
|
|||
|
|||
|
HI!
Maybe this will sound stupid idea which I apologize for that. This attack comes from a program (bot)? Is it possible that the login control contains a generated image with scrambled text and writen in a wierd way. A buch of random text readable only by human which is for example on the yahoo site when you apply for a new account. User would have to enter this code upon login which should prevent attacks from a bot. But it is annoying sometimes to enter this code every time you log-in but it will definetly increase security. Also what is intresting how this person obtains user names to attack? Does he visit this forum or have a program that searches for a name inside for example public forum. It could be also something especialy writen for this php bulletin thing. my 2 cents
|
|
#12
05-07-2005, 05:06
|
|||
|
|||
|
Quote:
------------------------------------- ARIN OrgName: Asia Pacific Network Information Centre OrgID: APNIC Address: PO Box 2131 City: Milton StateProv: QLD PostalCode: 4064 Country: AU NetRange: 218.0.0.0 - 218.255.255.255 NetType: Allocated to APNIC Comment: This IP address range is not registered in the ARIN database. Comment: For details, refer to the APNIC Whois Database via Comment: WHOIS.APNIC.NET or http://www.apnic.net/apnic-bin/whois2.pl ------------------------------------- APNIC inetnum: 218.86.128.0 - 218.86.255.255 netname: CHINANET-GZ descr: CHINANET Guizhou province network descr: Data Communication Division descr: China Telecom country: CN source: APNIC
|
|
#14
05-12-2005, 01:36
|
|||
|
|||
|
I was received similar email with this IP too at this date ...
This IP wasn't online, when i checked.
|
|
#15
05-25-2005, 15:27
|
|||
|
|||
|
bruteforcetry...
tried me too, but is some month ago, I had to reactivate my account, I overlooked it, cause I couldn't change it, so I cannot say the IP anymore...
maybe someone behind a proxy? if we close this spezific IP maybe others couldn't come in anymore...
|
 |
|
|
Hybrid Mode
