| 1   2   | Next
maemo.org - Talk

maemo.org - Talk (https://talk.maemo.org/index.php)
-   Community (https://talk.maemo.org/forumdisplay.php?f=16)
-   -   Multiple Sign-In Attempts from China (https://talk.maemo.org/showthread.php?t=94599)

gerbick 2015-02-12 13:17

Multiple Sign-In Attempts from China
 
Just got an email from TMO stating that my user account has been attempted to sign-in from IP 112.19.4.71 - which is in China.

Just a heads up.

Copernicus 2015-02-12 13:38

Re: Multiple Sign-In Attempts from China
 
Quote:

Originally Posted by gerbick (Post 1460520)
Just got an email from TMO stating that my user account has been attempted to sign-in from IP 112.19.4.71 - which is in China.

Me too - the attempted login to my account was from 219.85.94.162 (apparently in Taiwan). Some sort of distributed attack?

skanky 2015-02-12 13:41

Re: Multiple Sign-In Attempts from China
 
Same here, http://whois.domaintools.com/183.166.84.234

nokiabot 2015-02-12 13:45

Re: Multiple Sign-In Attempts from China
 
my account had two users someday many posts arent mine lol .

Mod edit:
Please refrain from racist posts

klinglerware 2015-02-12 14:10

Re: Multiple Sign-In Attempts from China
 
Same here, with an IP address originating in China

mattaustin 2015-02-12 14:22

Re: Multiple Sign-In Attempts from China
 
Me too, from 117.169.1.219.

handaxe 2015-02-12 14:27

Re: Multiple Sign-In Attempts from China
 
I feel so worthless. Why not MY user account? :-(

coderus 2015-02-12 14:30

Re: Multiple Sign-In Attempts from China
 
Same for me:
Quote:

The person trying to log into your account had the following IP address: 111.10.145.92

robthebold 2015-02-12 15:06

Re: Multiple Sign-In Attempts from China
 
I'll add a "me too". Or should that be "MeeToo"? ;)

IP: 117.135.251.76

whois says it's from "China Mobile communications corporation" (117.128.0.0 - 117.191.255.255) and they've got a remark in their APNIC info: "Please send probe e-mail to security@chinamobile.com"

I guess we better brace ourselves for v1agra pushers, pump and dump scammers and malware phishers. :(

pichlo 2015-02-12 15:09

Re: Multiple Sign-In Attempts from China
 
How do you sign up for those notifications?

robthebold 2015-02-12 15:16

Re: Multiple Sign-In Attempts from China
 
Quote:

Originally Posted by pichlo (Post 1460537)
How do you sign up for those notifications?

I don't think I did sign up for them -- AFAIK, they're automatic

ed: I do have Control Panel|Options|Receive Email From Adminstrators checked, but I don't know if that includes security warnings.

pichlo 2015-02-12 15:21

Re: Multiple Sign-In Attempts from China
 
I deliberately failed to log in from the PC on the next desk. Five times, just for a good measure. An hour later, still no notification. Am I missing something?

endsormeans 2015-02-12 15:31

Re: Multiple Sign-In Attempts from China
 
An an unsuccessful attempt just occurred for me as well.
202.171.253.74 is where mine originated.
Evil Evil B-tards.

szopin 2015-02-12 15:36

Re: Multiple Sign-In Attempts from China
 
Might be worth changing your password, usually the notification is generated when correct password was provided, but different country (would explain no notificatiin on failed attempt from another desk), maybe mods/admins can confirm TMO settings before panic

willi6868 2015-02-12 15:41

Re: Multiple Sign-In Attempts from China
 
Same for me :eek: Got the following e-mail on 9th Februar :

Quote:

Dear willi6868,

Someone has tried to log into your account on maemo.org - Talk with an incorrect password at least 5 times. This person has been prevented from attempting to login to your account for the next 15 minutes.

The person trying to log into your account had the following IP address: 112.105.57.80

All the best,
maemo.org - Talk

pichlo 2015-02-12 15:46

Re: Multiple Sign-In Attempts from China
 
Quote:

Originally Posted by willi6868 (Post 1460546)
...at least 5 times...

That was the answer, thanks! I tried 6 times and got the notification.

endsormeans 2015-02-12 16:08

Re: Multiple Sign-In Attempts from China
 
Oh yeah...
my password is changed...
changed it the moment this crap went down.
now my password makes Rumpelstiltskin look easy :D

lfc22 2015-02-12 16:46

Same here. 5 attempts using incorrect passwd : 117.173.20.179.

It mentions the person will be prevented from further login attempts for the next 15 min. Are u guys recommending changing the passwd despite these failed attempts?

szopin 2015-02-12 16:52

Re: Multiple Sign-In Attempts from China
 
Quote:

Originally Posted by lfc22 (Post 1460549)
Same here. 5 attempts using incorrect passwd : 117.173.20.179.

It mentions the person will be prevented from further login attempts for the next 15 min. Are u guys recommending changing the passwd despite these failed attempts?

Nah, noone mentioned earlier that it was generated based on unsuccessful attempts, some places have such notifications and blocks in place for correct pass but different country (dropbox, gmail too if not using already authenticated client)

pichlo 2015-02-12 16:52

Re: Multiple Sign-In Attempts from China
 
Quote:

Originally Posted by lfc22 (Post 1460549)
Are u guys recommending changing the passwd despite these failed attempts?

Only if your password is easy to guess. If they haven't guessed it yet - which they haven't, otherwise you woud not be getting these alerts - changing it to something of the same complexity will not have any effect.

endsormeans 2015-02-12 16:53

Re: Multiple Sign-In Attempts from China
 
personally if you're password is a simple one to remember...
yeah...I'd make it a little tougher for these B-tards

gerbick 2015-02-12 18:31

Re: Multiple Sign-In Attempts from China
 
Ugh... apparently this is going on all over. Just got hit up for other forums I belong to that were hit the same way.

HtheB 2015-02-12 20:23

Re: Multiple Sign-In Attempts from China
 
Since I didn't receive any notification: did they guessed my password? :p

endsormeans 2015-02-12 20:39

Re: Multiple Sign-In Attempts from China
 
Hmm...
Give it a minute..
If you suddenly start posting about cheap male enhancement products or start offering genuine Nikoa n900 parts then...
1- check if you smell burning toast...
2- if no burning toast smell... then you haven't been posting during a seizure and we can safely assume all "your bases are theirs"
:D

szopin 2015-02-12 20:53

Re: Multiple Sign-In Attempts from China
 
Quote:

Originally Posted by endsormeans (Post 1460570)
Hmm...
Give it a minute..
If you suddenly start posting about cheap male enhancement products or start offering genuine Nikoa n900 parts then...
1- check if you smell burning toast...
2- if no burning toast smell... then you haven't been posting during a seizure and we can safely assume all "your bases are theirs"
:D

Are you sure it is HtheB though? You could be helping a hacker, accessory to crime, by giving hints.

Still weird though, bruteforce attack on forum logins, really? If they could reroll the IP every 5 attempts it could go on unnoticed, so maybe just trying the top 100000 passwords could give them an account or two, then again on tmo the general percentages probably do not apply (then again using very weak password on forums is not that uncommon). Weird it went on other forums (assuming mobile/linux related?) at the same time, so probably not just random script kiddie

xes 2015-02-12 20:55

Re: Multiple Sign-In Attempts from China
 
Since a few hours we have another huge blacklist blocking bad guys.
Maybe some tor exit point is blocked. Sorry for the annoyance

peterleinchen 2015-02-12 21:01

Re: Multiple Sign-In Attempts from China
 
Quote:

Originally Posted by xes (Post 1460572)
Since a few hours we have another huge blacklist blocking bad guys.
Maybe some tor exit point is blocked. Sorry for the annoyance

Huh, is it xes speaking? (thanks btw)
Or "xes" to let us feel we are safe? ;)

pichlo 2015-02-12 21:11

Re: Multiple Sign-In Attempts from China
 
Quote:

Originally Posted by szopin (Post 1460571)
If they could reroll the IP every 5 attempts it could go on unnoticed

You do realize it is you who is now dropping hints, right? ;)

BTW, endso, ITYM "all your bases are belong to them" ;)

And yeah, I wonder what they are trying to achieve. Spamming the forum? Isn't it easier to create 10000 new accounts? Discrediting senior members? More likely (as well as it would explain why they haven't tried me yet :)), but that sounds like too much work for little effect. Most members won't be fooled for long.

peterleinchen 2015-02-12 21:24

Re: Multiple Sign-In Attempts from China
 
More or less a proof of "I can do"?
Or just trying to "ph"ish some account data: mail/pass and try it on more sensitive sites?

endsormeans 2015-02-12 21:26

Re: Multiple Sign-In Attempts from China
 
genuine endsormeans here..
have you guys considered the benefits of a longer lasting erection?
for more info head on over to http://www. ...

heheheheee

endsormeans 2015-02-12 21:28

Re: Multiple Sign-In Attempts from China
 
hmm...just thinking to myself for a moment...and a slightly troubling thought truly entered my cranium.
but I won't post it out loud here...
considering the ever-so-mild dove-soap paranoia I am currently experiencing thanks to pichlo .
instead post it to say...this guy.

szopin 2015-02-12 21:30

Re: Multiple Sign-In Attempts from China
 
Quote:

Originally Posted by endsormeans (Post 1460578)
genuine endsormeans here..
have you guys considered the benefits of a longer lasting erection?
for more info head on over to http://www. ...

heheheheee

oh boy, the lust for bigger longer election got you too, so tempting, can't resist...

pichlo 2015-02-12 21:37

Re: Multiple Sign-In Attempts from China
 
@peterleinchen, that might be it.

I had a mysterious call the other day. I applied for a new credit card online and had a call from the company to verify the application was genuine. All they asked me were some random things from what I provided in the application. I thought, "what's the point? how could that verify that I am not a scammer applying in someone else's name?" Colleagues explained that scammers may not memorize all the data and a random call back may catch them off the guard. Well, maybe...

A colleague then went on to describe a case of three people on his street finding out that someone had taken a loan in their name. Long story short, it was the postman. He stole their passports (here in the UK, passports are delivered by post) and left enough time between that and the loan fraud that people did not immediately make the connection.

The lesson learned: do no reuse passwords.

pichlo 2015-02-12 21:41

Re: Multiple Sign-In Attempts from China
 
Quote:

Originally Posted by endsormeans (Post 1460579)
paranoia I am currently experiencing thanks to pichlo

Glad to be of service ;)

Now, about that v14gr4... ;);)

endsormeans 2015-02-12 21:45

Re: Multiple Sign-In Attempts from China
 
I haven't laffed this much for a while.
For that reason alone I thank the B-tards

endsormeans 2015-02-12 23:28

Re: Multiple Sign-In Attempts from China
 
y'know ...
I can't for the life of me remem. who it was who was attacked this way from China before...
But I remem. someone shooting off a request asking the chinese gov't to please get them to stop and it just escalated through the roof instead...all the while the official statement was ...it wasn't coming from their country.

Hmm.
If only we could do some effective counter-espionage I'd suggest just flooding them with ...
say...
this for example...
http://i.imgur.com/s3dRFKP.gif
just that...
nothing more...

hmmheheheheeee
ah it makes me break out in a fit of laughter everytime I see that gif

Markkyboy 2015-02-13 00:59

Re: Multiple Sign-In Attempts from China
 
Thanks for heads up guys!, also in the UK here, but no emails/attempted sign-ins - nonetheless, I've changed my details, it was due anyway! :o

Regards,

juiceme 2015-02-13 06:08

Re: Multiple Sign-In Attempts from China
 
As it happens, I also received the same warning, but I was already targeted last monday. (which probably makes me the first one, lol :D)

The scroundels' IP address is 222.244.179.243, and yes, it indeed resides in Mainland China, in Hunan province...

minimos 2015-02-13 06:43

Re: Multiple Sign-In Attempts from China
 
Quote:

Originally Posted by juiceme (Post 1460610)
The scroundels' IP address is 222.244.179.243, and yes, it indeed resides in Mainland China, in Hunan province...

By googling for that IP it seems the PEBKAC behind it is a pro in spamming Wordpresses and forums around the world.

robthebold 2015-02-15 20:15

Re: Multiple Sign-In Attempts from China
 
Quote:

Originally Posted by szopin (Post 1460580)
oh boy, the lust for bigger longer election got you too, so tempting, can't resist...

From my experience in the US, trust me, you don't want it. Our elections here last over a year these days. Makes you want to give your TV to your worst enemy.


| 1   2   | Next
All times are GMT. The time now is 12:13.

vBulletin® Version 3.8.8