You would follow the forgot password link to reset your password- but unless your password is absurdly easy, no one is getting it from this kind of attack.

The Hacker came from China-
IP= 183.216.190.239

Quote:

IP Location: China Beijing China Mobile Communications Corporation ASN: China AS9808 CMNET-GD Guangdong Mobile Communication Co.Ltd.,CN (registered Jan 10, 2000) IP Address: 183.216.190.239

& Trust me the Chinese are very good at hacking.
Note they have used a mobile device to hack vBulletin

A couple of years ago they even hacked Skype and used/stole all members log in details and money on their accounts. I had a heck of a fight trying to get my money back from Skype - Never happened, cos Skype simply wouldn't admit they had been hacked!

Even Google, Facebook etc have been hacked in the past. That's why I NEVER use any social media site

So don't blame vBulletin forum.

A little tip: NEVER use the same password on all or multi sites. Use your notepads and record your DIFFERENT log-in details for every site your use.....;)

I thank the staff at vBulletin, for their prompt action on this matter....:up:

Hi, I am having the same issue but for some reason, I cannot access https://vborg.vbsupport.ru/profile.php?do=editpassword page. Even when logged in it is still asking for my login / pwd ... when entered it does not log me in again...
I have not accessed this forum for a VERY long time and my pwd was no longer valid. I had to change it using the email reset system...


EDIT : That was an ie11 issue, I was able to access with FF...

Dear rockerzteam,

Your account on vBulletin.org Forum has been locked because someone has tried to log into the account with the wrong password more than 5 times. You will be able to attempt to log in again in another 15 minutes.

The person trying to log into your account had the following IP address: 124.121.248.189

It is not necessary to report this emails. We are aware of the situation. As long as you have a secure password you have nothing to worry about.

Posting the IP addresses is not going to help, but thank you for your effort.

They never try my account :)

Your account on vBulletin.org Forum has been locked because someone has tried to log into the account with the wrong password more than 5 times. You will be able to attempt to log in again in another 15 minutes.

The person trying to log into your account had the following IP address: 117.171.75.185

Don't forget that the password is case sensitive. Forgotten your password? Use the link below:
https://vborg.vbsupport.ru/login.php?do=lostpw

All the best,
vBulletin.org Forum


Many tries last 1hour please block these hackers

Mine was locked 4 times during last 2 days.

Thats not funny.
Please delete my account here. 20 mails in 1.5 hours

From: "vBulletin.org Forum" <webmaster@vbulletin.org>
Date: 10 April, 2014 2:19:20 AM GMT+08:00
Subject: Account on vBulletin.org Forum locked out

Dear evelynpriscilla,

Your account on vBulletin.org Forum has been locked because someone has tried to log into the account with the wrong password more than 5 times. You will be able to attempt to log in again in another 15 minutes.

The person trying to log into your account had the following IP address: 223.83.98.56

Don't forget that the password is case sensitive. Forgotten your password? Use the link below:
https://vborg.vbsupport.ru/login.php?do=lostpw
All the best,
vBulletin.org Forum

We don't delete accounts.

If you don't want your account change your email address to some non-existent address/domain. You will stop getting the emails.

Go to your options and change some settings so you dont get emails
https://vborg.vbsupport.ru/profile.php?do=editoptions

someone tried with my account as well today.. Flipping scammers..

I've received 5 in the last few minutes.

Just had someone from Brazil try it. 177.220.137.138

Add me to the list of people who was locked out and received an email after 5 wrong attempts by someone else.

For me the IP was from China - 117.163.230.160

My pass is impossibly hard, even to remember, and it's not shared anywhere else so no worries. Thank you for keeping the 5 attempt lockout in the forums, all forums need it!

Me too:

These IPs have been attempting to log into my account. Thankfully my password is very secure, but this is alarming and makes me wonder whether this is website based or username based.

117.163.233.182
195.19.214.8
117.175.254.198
223.85.49.51
117.163.231.106

Appears to be using Mikrotik, a software that turns a PC into a router. Likely using infected computers to do the job.

It's happened to me three times, all with different IPs. I changed my password to a much longer one. I did this through my iPad which asked me if I wanted it to suggest a password. I said yes and it entered a very nice and strong password.

The attempts to hack accounts raises. Please hurry to check the IP's.

There is no point to checking/blocking IPs. These IPs are of "Zombie" PCs- they are your friends/neighbors/random people who have been infected with viruses and are now running the commands of hackers. There are millions of them out there and there is no point to try to block them all- they are always changing.

The easiest thing to do is simply delete the emails and continue on with your life.

PS- You're never actually locked out- the lock follows the IP address not the username, so you would always be able to log in so long as the attack isn't coming from your IP address.

I agree! About 50 emails between 10.15 and 10.21! (German local time -> 08.15 UTC)

Am i to? :D

--------------- Added [DATE]1397121364[/DATE] at [TIME]1397121364[/TIME] ---------------

Hehe, first i read "[...] and continue on with your wife." :D

Hmm, also got this, account seems fine however.

I have gotten about 25 in the last 24 hours....

Yeah I keep getting loads, can I request a username change?

Sure :cool: however I cannot do it for you, you will need to send a private message to an Administrator on the site, here is a list of Staff I suggest Lynne or Princeton as Paul is away currently.

https://vborg.vbsupport.ru/info.php?do=staff

A username change likely won't do anything to stop the emails, in fact it will probably just make you get more as they will eventually stop with your account and move on to others.

I keep getting these emails several times a day. Seems a Bot Network is trying to hijacking forum accounts. I?ve managed to change my password to a more secure one!

Massive bruteforcing attack obviously. I have also received several emails. IP addresses of the attackers so far:
80.191.193.2
177.129.88.39
201.211.196.23

Is there any way to disable email notifications at least?

p.s. Suggestion to vbulletin staff: make an option to have one screen/post name and another login name. Thus the attackers will not be able to get login names from posts and will have to bruteforce them first.. and that will greately enhance security and will stop this email spam.

p.p.s. Similar suggestion here - https://vborg.vbsupport.ru/showthrea...=264376&page=2
Using emails for login (only email and not both mail or username as many sites do). Must be pretty easy to implement, 1-2 rows of php here and there?

We are not going to be making massive changes to the software, we do apologize for the inconvenience.

Some people have reported that editing your options and seeing unchecking the option to Allow Administrators to Send You Email stops the account locked emails, but other people say it does not help- honestly I'm not sure if that setting was ever intended to stop such emails since they technically are being sent from the board itself, not an Administrator.

For those who no longer wish to have accounts go ahead and change your emails address on record in the settings to some random/undeliverable value.

Continuing every day! FROM
194.60.227.124
110.77.132.104
221.182.70.192
120.84.239.194
117.164.7.228

I would like to be able to block IP addresses that appear to originate from certain countries from trying to log into my account. Is there a way to do that? Perhaps an easier option would be to PERMIT only an IP address originating in the USA to log into my account.

Ideas?

Belay the previous, I just saw this:

117.139.111.72
128.199.213.232
117.163.222.200
183.220.47.155
117.177.253.233
117.173.196.204

I think the solution is simple, the forum should just stop sending these emails. Clearly, if the block is only IP based, then it doesn't affect your own login attempts, and since no harm is done, your account was always safe.

The only email I might want is perhaps something that says that a successful login took place, from a different IP that my last login.

All I need to know is if someone is changing my password or changing my email or even if they have logged in from an IP not normal for me. This could alert me to a compromised account.

These emails about lockouts don't seem to serve any purpose if the intention is NOT to block every single IP that comes through. I personally can't do jack with the emails, it's not like I can come here and do IP blocks myself. So this may be a case of TMI. Just stop emailing people about failed login attempts.

Is that hard?

This is certainly something we will consider in the future.

Yes - I've been getting the notifications as well. I just delete em, fortunately once the lock kicks in they seem to move on to another username until the following day - no biggie

Ditto. Started a few days ago, happening a lot more today.

No biggie until they eventually hack into your account and get your password. Anyone that says this is no biggie is seriously underestimating what is going on and potentially willing to compromise their account and information here and elsewhere.

200.112.211.80
117.164.142.150

I had 2 attempts on my account at the same time today. (8:09am)

Do not underestimate or downplay this. One IP is from Columbia and another from China in my case.

I've had four attempts in the last few days.

117.164.49.220
117.163.197.94
117.164.132.11
174.140.166.54

What got me worrying is that someone also called my cell phone carrier trying to ascertain my home address. WTF? I've since put extra security measures in place with all utilities and banks as well as changing all forum passwords to something even more complicated than I was already using.

You've already had replies from Staff. This happens every couple of months. If you have a secure password, then you have nothing to worry about. I have not been told of one person who actually has had their account hacked through one of these attacks.