Hi Cs-carters,
I have been seeing the following in my logs consistently, ips are always the same.
Does this mean someone is trying to use brute force to gain access or is it just a spam.
What the easiest way to stop it ? Has someone faced this issue before ?
Apr 22, 2013, 10:13 - Users (failed login) User: hcqhrilvc
IP address: 216.99.152.122
Apr 22, 2013, 10:13 - Users (failed login) User: ybtsyjfnr
IP address: 216.99.152.122
Apr 22, 2013, 10:11 - Users (failed login) User: cvbtmovtt
IP address: 216.99.152.122
[quote name='shikhar' timestamp='1366637756' post='160417']
Hi Cs-carters,
I have been seeing the following in my logs consistently, ips are always the same.
Does this mean someone is trying to use brute force to gain access or is it just a spam.
What the easiest way to stop it ? Has someone faced this issue before ?
Apr 22, 2013, 10:13 - Users (failed login) User: hcqhrilvc
IP address: 216.99.152.122
Apr 22, 2013, 10:13 - Users (failed login) User: ybtsyjfnr
IP address: 216.99.152.122
Apr 22, 2013, 10:11 - Users (failed login) User: cvbtmovtt
IP address: 216.99.152.122
[/quote]
just done a quick google search for this ip address and comes up as from a spammer, I would recommend blocking the ip address
John
Thanks for replying John, but these ip addresses are now changing. So really clueless what to do.
Leaving it for now.
When a login fails (after a few attempts) it should be blocking the IP for some period of time.