Happy Valentine’s Day, and someone loves me out there on the Internet, because they used a botnet to try to break into my site. You are very welcome, whomever you are, but I am trying to find out who is my secret admirer.
There are 12 IPs involved. The each try 2 times.
User Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.89 Safari/537.36
Yet another brute force attack that I would like to document. The first two, from China and India, are bad dudes.
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:40.0) Gecko/20100101 Firefox/40.0
42.62.11.58 s Forest Eternal Com Cn, Risk 10/10, spam, bots malware (200): Spam Zero-Day, Doc.Dropper.Agent-5664104-0
117.245.8.122 s Wimax Bharat Sanchar Nigam BSNL In, Risk 7.1/10, spam, bots, malware: Spam Zero-Day, Doc.Dropper.Agent-5664104-0
213.119.94.181 s Telenet Operaties Belgium, Risk 8.6/10, spam, bots, scanning IPs
They are banned, never to return with these IPs
It is always good to see international cooperation amongst different nations in this great world. However, when China, India and Russia cooperate to try to break into my site, forgive me when I get a little upset. While I usually file complaints to internet host providers, in this case the complaint would fall on deaf ears: hosts in China, India and Russia ignore abuse emails. Then most hosts from all over the world ignore abuse emails.
Number of login attempts: 417
All the user agent names are the same: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:40.0) Gecko/20100101 Firefox/40.0
The first technique is to use a low number of IPs, but try numerous times. UA: “Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:40.0) Gecko/20100101 Firefox/40.0”
37.159.245.182 VODAFONE-IT: 51 login attempts
91.234.226.103 SIPCOM UA: 116 login attempts
183.64.62.26 CHINANET Jiangsu: 109 login attempts
223.196.88.191 Idea Cellular In: 51 logi attempts