What to do if someone is trying to distributed brute force my account?

[kh99]

Originally Posted by JonUrban

I just got two. However, when I logged in here, my original password worked without issue. Very odd. What would they accomplish?

They didn't accomplish anything, they just tried to guess your password and failed. You say you just got those but the time says ~7:30 EDT so I guess the 15 minute lockout elapsed and you were able to log in.

Unless you mean "what do they hope to accomplish with only 5 guesses", then I don't know, seems like they'd have to get really lucky. Or they're just trying to annoy people, or clog the server with emails to send.

[TundraSoul]

Hackers are out tonight!

94.228.204.30 x2

[WetWired]

The lockout is actually IP specific.

[shof515]

I got a similar email too:
Received: from mx5.internetbrands.com (mx5.internetbrands.com [98.158.194.50])
by mtain-mh02.r1000.mx.aol.com (Internet Inbound) with ESMTP id 8B0EA38000083
for <deleted>; Sat, 28 May 2011 19:21:36 -0400 (EDT)
Received: from jelsoft3.internetbrands.com (jelsoft3.internetbrands.com [172.16.229.76])
by mx5.internetbrands.com (Postfix) with ESMTP id 45D432006C
for <deleted>; Sat, 28 May 2011 16:21:36 -0700 (PDT)
Received: from jelsoft3.internetbrands.com (localhost.localdomain [127.0.0.1])
by jelsoft3.internetbrands.com (8.13.8/8.13.8) with ESMTP id p4SNLanG030536
for <deleted>; Sat, 28 May 2011 16:21:36 -0700
Received: (from jelsoft@localhost)
by jelsoft3.internetbrands.com (8.13.8/8.13.8/Submit) id p4SNLaBr030533;
Sat, 28 May 2011 16:21:36 -0700
Date: Sat, 28 May 2011 16:21:36 -0700
X-Authentication-Warning: jelsoft3.internetbrands.com: jelsoft set sender to webmaster@vbulletin.org using -f
To: deleted
Subject: Account on vBulletin.org Forum locked out
From: "vBulletin.org Forum" <webmaster@vbulletin.org>
Auto-Submitted: auto-generated
Message-ID: <201105282336.fc033e6fa850@www.vbulletin.org>
MIME-Version: 1.0
Content-Type: text/plain; charset="ISO-8859-1"
X-Priority: 3
X-Mailer: vBulletin Mail via PHP
Content-Transfer-Encoding: quoted-printable
x-aol-global-disposition: G
X-AOL-SCOLL-SCORE: 0:2:255893488:93952408
X-AOL-SCOLL-URL_COUNT: 0
x-aol-sid: 3039ac1d60d64de183801e9c
X-AOL-IP: 98.158.194.50
X-AOL-SPF: domain : vbulletin.org SPF : permerror

[kh99]

Originally Posted by WetWired

The lockout is actually IP specific.

Oh...so I guess if they have enough ips they can actually guess many times. Seems like it may be something to change in a future version. eta: ...oh, but I guess if it wasn't ip specific it would be easy for someone to keep you from logging in to your account.

[Alfa1]

Maybe vb.org would benefit from installing the bad behavior addon.

[AdrianH]

More here >> https://vborg.vbsupport.ru/showthrea...02#post2201102


I feel positively left out

[King Kovifor]

I've merged both threads about the same attack into the same thread, within the feedback forum.

[jaffaman]

Got the same the 3 times I.P's are ..............

194.85.80.107
94.228.204.30
94.228.204.2

[Delphiprogrammi]

hi,

It happend on mine to

94.228.204.2
178.213.33.129

i guess somebody is looking for freebies