Account locked?

[Kat-2]

Possible correct theory, but I run visible, and between 5 and 5:30 AM (central time), I received approximately 30 emails saying I was locked out. Umm...I was sound asleep then, so sure was not showing online...

[Max Taxable]

Originally Posted by Kat-2

Possible correct theory, but I run visible, and between 5 and 5:30 AM, I received approximately 30 emails saying I was locked out. Umm...I was sound asleep then, so sure was not showing online...

We don't know how long they keep us showing online though, and we also don't know when the brute force attackers are gathering their target lists. Could be minutes, hours, days? Between gathering the info and launching the attacks.

I only know I have never been targeted and also have never run visible here.

[Kat-2]

Originally Posted by Max Taxable

We don't know how long they keep us showing online though, and we also don't know when the brute force attackers are gathering their target lists. Could be minutes, hours, days? Between gathering the info and launching the attacks.

I suppose. Would have definitely had to have been keeping me showing online for a good 10/12 hours I'd say...if that were the case.

[Max Taxable]

Originally Posted by Kat-2

I suppose. Would have definitely had to have been keeping me showing online for a good 10/12 hours I'd say...if that were the case.

Not necessarily. It depends on when the attackers gathered their target data. This, we have no way to know.

[Kat-2]

All is null as far as I am concerned. Was not a successful attack anyhow.

[Max Taxable]

They only need to get one successful attack.

Gathering the target usernames isn't necessarily happening at the same time the attacks are. In fact, were I doing this I would gather names over at least a week's period, entering them into the brute force cracking software, getting some thousands accumulated before launching the actual attack.

[BirdOPrey5]

Originally Posted by Max Taxable

I've never been hit by this here at vB dot org. And I am wondering if it's because I run "invisible." The brute force attacks might or might not be random - they might be getting active accounts to target from the bottom of the main forum page, the aggregate "what's going on" area.

Just a theory.

You haven't been hit because they always go in alphabetical order and they'be always stopped before M in the past.

[Max Taxable]

Originally Posted by BirdOPrey5

You haven't been hit because they always go in alphabetical order and they'be always stopped before M in the past.

Are they hitting nonexistant accounts, or are they choosing correct names from 'who's online?"

They may have gone further than the letter M, at least one time:

https://vborg.vbsupport.ru/showpost....1&postcount=83

[BirdOPrey5]

They are hitting people who haven't logged in for 7 years... so it's not who's online. It was either a copy of the member's list (made before the attack) or a spider that just crawled the site and captured all the usernames. They would need to sort them anyway to prevent duplicates so it makes sense they are in alphabetical order.

They seem to have skipped accounts that start with a special character, like !username, so I'm not convinced they used the member's list as those names are on top.

[Max Taxable]

Originally Posted by BirdOPrey5

They are hitting people who haven't logged in for 7 years... so it's not who's online. It was either a copy of the member's list (made before the attack) or a spider that just crawled the site and captured all the usernames. They would need to sort them anyway to prevent duplicates so it makes sense they are in alphabetical order.

They seem to have slipped accounts that start with a special character, like !username, so I'm not convinced they used the member's list as those names are on top.

And of course, they don't have a common item in their UA string, like Brutus for example, leaves.

Makes it really difficult to block or inhibit.