Account locked?

[Brandon Sheley]

got this message the other day, then just now as well..

The person trying to log into your account had the following IP address: 223.84.180.232

I deleted the other email, so no idea what the proxy ip was.. not that it really matters

[teou]

Several more ips from today:
119.46.203.37
183.221.174.3
117.172.66.7

Originally Posted by ANGLICO

I would like to be able to block IP addresses that appear to originate from certain countries from trying to log into my account. Is there a way to do that? Perhaps an easier option would be to PERMIT only an IP address originating in the USA to log into my account.

Ideas?

Belay the previous, I just saw this:

I have researched this matter 1-2 years ago. There are such geo-ip apache modules - you need root access to your server to install it. But it is reasonable to do only for very localized non-english language forums. Not to mention that this approach gives false positives or negatives sometimes.

Originally Posted by zackw

I think the solution is simple, the forum should just stop sending these emails. Clearly, if the block is only IP based, then it doesn't affect your own login attempts, and since no harm is done, your account was always safe.

The only email I might want is perhaps something that says that a successful login took place, from a different IP that my last login.

All I need to know is if someone is changing my password or changing my email or even if they have logged in from an IP not normal for me. This could alert me to a compromised account.

These emails about lockouts don't seem to serve any purpose if the intention is NOT to block every single IP that comes through. I personally can't do jack with the emails, it's not like I can come here and do IP blocks myself. So this may be a case of TMI. Just stop emailing people about failed login attempts.

Is that hard?

99% of the ordinary users in the world, esp. in the "post ip v4" era when there is shortage and recycling of IP blocks, are using DYNAMIC addresses. So, unless this is made as an option in the User Control Panel that can be turned off, this is not very clever solution.

Originally Posted by Digital Jedi

As was mentioned multiple times, if your password is secure, you have nothing to worry about. You do realize that this happens on every account you have across the internet, right? Daily. It's just vBulletin has a built in notification process when it happens. Most places, you'd never know unless you have an awful password. Seriously, though. Knowing your PayPal email address is about as potentially dangerous as someone knowing your last name. Everyone we did business with already knows it.

We really have to stop this paranoia every time hacking bots randomly pick this site as a target. Everything that can be done on the administration end has been done. Now you have to secure your password, just like you would everywhere else on the web. I can't understand why this doesn't sink in.

I agree it is not really dangerous, but it is just very annoying. VB Staff should just turn off these emails - can't be that hard.

Originally Posted by VargTimmen

I am also affected. Changed my password. Maybe this is caused through the heartbleed case?

This has nothing to do with it.

Originally Posted by Lynne

You guys who say this only happens on vbulletin.org - do you ever check your server access logs? I'm not talking about the apache access_logs, but the ones that show when someone tries to brute force your server. This, at vbulletin.org, is nothing compared to that!

That is true. I am administering also a PHPBB3 forum - on a very micro forum (read less than 10 K posts) i get around 10-20 such bruteforce attempts per day on average. Initially i was annoyed at the PHPBB guys, because these were not logged, not autobanned, there in no notification and these are stored in a temporary SQL table that gets auto-cleared. But after i looked at how many times these attacks happen i saw this was the right decision, otherwise the logs on the server will get HUGE.
Here is how it looks in mysql right now:

attempt_ip 	attempt_browser 	attempt_forwarded_for 	attempt_time 	user_id 	username 	username_clean
89.169.5.251 	Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/53... 		1397188458 	0 	Claytonwemn 	claytonwemn
199.15.233.139 	Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (K... 		1397172673 	0 	TimothyKACH 	timothykach
89.169.5.251 	Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/53... 		1397184431 	0 	Claytonwemn 	claytonwemn
95.26.157.169 	Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (K... 		1397199455 	0 	FishPn 	fishpn
46.119.6.88 	Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (K... 		1397153747 	0 	Ormostere 	ormostere
89.169.5.251 	Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (K... 		1397180266 	0 	Claytonwemn 	claytonwemn
95.28.228.160 	Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (K... 		1397160780 	0 	FishPn 	fishpn

The conclusion: VB Staff, please disable email spam, thank you.

[BirdOPrey5]

Originally Posted by Mr.Windows

Is there a way to just delete my account? I no longer participate in the VB community and would rather just remove this vector of internet from attachment to me.

In the future I hope we can make some changes to stop sending these emails to customers and instead send them to a local email address where network admins can keep an eye out. However- with the nature of the way things work here- it won't come soon enough to stop this attack, only hope it won't happen again in the future.

Originally Posted by SyrLinus

Add 117.164.9.166 as they tried again tonight. I will be glad when this OpenSSL issue is addressed.

Not an OpenSSL issue. Completely unrelated- vBulletin.org doesn't use SSL. Even if it did, a brute force attack isn't a symptom of the OpenSSL issue- they would already have the sensitive data, they wouldn't be trying to figure it out.

Originally Posted by sb225

I am too getting a lot of emails from the past, that some one is trying to loginto my account, can you keep my account in safe place.

As long as you have a decently secure password you are safe. Make sure all websites, especially vBulletin.org has a secure (complex/long) and unique password. The unique part being perhaps the most importing. With a unique password the absolute worst thing a hacker could do is post as you- which isn't high on the severity meter.

Originally Posted by teou

c
The conclusion: VB Staff, please disable email spam, thank you.

We hear you and will do something as soon as we can, but it won't be today unfortunately.

[AdrianH]

Joe, I would think long and hard about turning off the warnings.

All that will happen is on the next attack , staff and the forum will be swamped with people whining that their account was locked, that they couldn't get mods, that nobody warned them, and they should have been told that someone was attempting to access their account.

Been there, done it .......... you can't win.

As forum admins the members here should know what the emails mean, after all their own forums do exactly the same when the Bots are active.

[Lightly_Toasted]

Very irritating... 5 emails concerning this in less than a minute.

[BirdOPrey5]

Originally Posted by AdrianH

All that will happen is on the next attack , staff and the forum will be swamped with people whining that their account was locked,

No one is locked out. Even when they get the emails, they aren't locked out. The lock only applies to the IP address causing the problem, so unless their own computer is part of the attack they can always access their account.

[smacklan]

Got an email about the account lock myself yesterday. IP was 80.80.209.186 (Uzbekistan). First time I've logged in here in a very long time...last time was to change my password from the last big security flaw in vB.

[JeansJoe]

I got around 20 of these emails. 10 yesterday 10 today in my inbox.
I switched Passwords just to be safe.

It's a lot of different IP's tho.
Could this be a DDoS?

[HawkeBoE]

Same here, got lots of lockout mails with different IPs.
Because of timedifference my phone made me crazy last night... & had to turn of nortifications for mail receive

[lgnd]

I got 5 emails in two days also changed my pw is there anything else I can do to prevent this? Thanks!