I had 17 attempts this morning. China? Go figure. I've banned the entire country from my web server.

This isn't really related to this thread, and probably not the place to post it, but I've been using SpamTrawler on my vBulletin site (and several other of my sites) for several months now and it's done a fantastic job of keeping most of the spammers out.

My account

222.124.19.210
110.74.218.146
125.216.144.199
110.50.80.30
61.153.98.6
178.217.9.18
119.36.87.32
210.43.128.18
80.191.48.210
190.0.17.202
95.161.7.13
189.11.198.141
177.135.236.245
189.115.138.217
223.4.233.162
201.73.70.33
125.39.66.149
78.38.23.242
92.39.54.161
220.132.19.136
222.73.233.146
74.221.211.12


Dear Hakan39,

Your account on vBulletin.org Forum has been locked because someone has tried to log into the account with the wrong password more than 5 times. You will be able to attempt to log in again in another 15 minutes.

The person trying to log into your account had the following IP address: 110.74.218.146

Don't forget that the password is case sensitive. Forgotten your password? Use the link below:
https://vborg.vbsupport.ru/login.php?do=lostpw

All the best,
vBulletin.org Forum


these not my ip number i dont use these any. i think one wanted to seize my account.
at www.vbulletin.org

I have had almost 50 emails saying my account as been locked. Someone is trying to hack in and alot. Every email has a different IP address so posting then would take awhile.

Same problem. What is the solution?

Woke up to a bunch of emails this morning, all within a few seconds of each other.

I know it would lead to a DoS situation, but can the 15 minute lockout apply to any IP trying to access that account? Or at least any IP that hasn't previously logged in, since vBulletin does track that.

:edit:

Figured I would add that all my emails are dated the 12th, but the banner says my last visit was on the 10th. So it doesn't look like they got anywhere.

why the authorities can not find the solution?

There is no real solution. There are much too many IP addresses to block. For the most part these are IP addresses of "innocent" people whose computers are compromised by a virus and being used in this attack.

While we understand it is annoying the reality is for any one user they will get emails for a few minutes to a few hours, after which they stop and move on.

Short of shutting off all forum email (which would cause more issues for people trying to register or change email addresses, and waiting for thread updates) there isn't a whole lot that can be done.

Code modifications can be discussed in the future but they will not come soon enough to help anyone who has already been hit.

Thank you BirdOPrey5

There is something wrong with the cookie that tells the forum that I'm locked out of my account, or however it works. I've been trying every 15 minutes to get into this account and I'm being denied access every single time, no matter which browser I use or which computer I use. I had to reset my password because the password that I was using for this account was not working. I'm currently using a different machine on a completely different connection, which seems to be working fine for me at the moment.

Does 15 minutes really mean something like 60 minutes?

I've never been hit by this here at vB dot org. And I am wondering if it's because I run "invisible." The brute force attacks might or might not be random - they might be getting active accounts to target from the bottom of the main forum page, the aggregate "what's going on" area.

Just a theory.