FYI...  Getting emails: "Failed Login Attempt" for EEVblog - Page 1
Forum section: electronics / general

author: boB
author_rank: Frequent Contributor
timestamp: March 12, 2020, 09:43:02 pm
content: FYI I have had several automatic emails in the last couple of weeks with this subject and IP address.Two came up today and several last week or the week before.Not sure why or who Zacharymit might be ? Searched for Zacharymit but no posts came up.Wondering if anybody else has seen something like this recently ?boBHello boB,We have detected a failed login attempt on your account.Matched forum members with same ip address:ZacharymitIP address of the failed login attempt: 77.243.11.58On 3/12/2020 3:11 AM, EEVblog Electronics Community Forum wrote:> Hello boB,> We have detected a failed login attempt on your account.>>>> IP address of the failed login attempt: 77.243.11.58>

author: Cyberdragon
author_rank: Super Contributor
timestamp: March 12, 2020, 10:14:15 pm
content: Hmmm...https://whatismyipaddress.com/ip/77.243.11.58

author: Domagoj T
author_rank: Frequent Contributor
timestamp: March 12, 2020, 10:28:03 pm
content: You might want to check this:https://haveibeenpwned.com

author: boB
author_rank: Frequent Contributor
timestamp: March 13, 2020, 02:12:31 am
content: Quote from: Cyberdragon on March 12, 2020, 10:14:15 pmThat's the first thing I did I think. Didn't think too much of it until it happened another time.I was just mentioning that someone was trying to login as me

author: boB
author_rank: Frequent Contributor
timestamp: May 15, 2021, 08:24:01 pm
content: This is happening again today. Several login attempts. Just an FYI in case others are seeing this activity on their accounts here.failed login attempt all from the same IP address...FROM:do_not_reply@eevblog.comHello boB,We have detected a failed login attempt on your account.IP address of the failed login attempt: 78.106.87.3

author: eti
author_rank: Super Contributor
timestamp: May 15, 2021, 08:40:23 pm
content: 78.106.87.3 seem to be Germany. I can ping and traceroute it fine.

author: boB
author_rank: Frequent Contributor
timestamp: May 15, 2021, 09:54:45 pm
content: Quote from: eti on May 15, 2021, 08:40:23 pmI wouldn't doubt it ! I'm not worried about it but still...Nothing to get from me here except maybe to be able to spam the forum if they happen to guess my credentials ?Just curious if I am the only one trying to be hacked ? If you can even call it hacking ?

author: Black Phoenix
author_rank: Super Contributor
timestamp: May 16, 2021, 10:42:04 am
content: Quote from: boB on May 15, 2021, 09:54:45 pmNo reports from my part for example. Probably someone got hold of your username and is trying to brute force it. It would not be bad to report it to the Admins for them to block the IPs.

author: fordem
author_rank: Regular Contributor
timestamp: May 16, 2021, 04:11:14 pm
content: Forum admins/moderators generally avoid blocking ip addresses - ip addresses, especially ipv4 addresses are the property of the ISP and are usually not assigned to a specific subscriber, this means that one ip address can be used by numerous people, blocking that one address can affect all of them.I'm not saying don't alert the admins, just don't be too disappointed if they choose not to block the address.

author: Xenon
author_rank: Contributor
timestamp: December 31, 2021, 09:42:36 am
content: Another one here, twice in one minute.Hello Xenon. We have detected a failed login attempt on your account. IP address of the failed login attempt: 92.97.12.155That ip is located in Dubai. I'm not even close to that location.As long as the attempts keep failing I'm not worried.

author: RJSV
author_rank: Super Contributor
timestamp: January 03, 2022, 02:41:28 am
content: Of course, cause for being alert, but ...That could be an attempt, for now to just get (you) to reply, or, since you can't (?), Perhaps next they would sent a more 'urgent' status, like, (perhaps):"We've now detected three, (3), partial logins on your account. Your data is now in jeopardy, please reply now, for download fix code ...".Something bogus like that. The play being, that you are 'gratefull', to supply your password, etc.

author: boB
author_rank: Frequent Contributor
timestamp: June 08, 2022, 11:44:58 pm
content: Got another email from EEVblog today...Hello boB,We have detected a failed login attempt on your account.Matched forum members with same ip address:ktyeczdbjkfvtktifFlamebinderandronychIarananPietrowiczBrightfuryStyurgtnjfhecnbrgtnhzrfrctybzJoJojasufkifAschofftyz[falexanderkvladimirushkatueyzavdotyushkacnfybckfdfgfienfrjcn.hfiroidormeMarianichdfcbkbcfgenashenjveyzgettinginvolvedhbvfvitaliadflifReemielujifrcifNinelkaktczBorislavmiachvaseWakenightajunvfhktyAnushaHiqurJerrygodAndreichrfhbyrfArambatafrosimVasaArtemDalaraabkbggbueczshurunyaDenisychktyeifhbneczCraryujieyznjkzBajinnvfhbczanikiticdtctkmtAntarganloudktjyblsxbkyzandheAlsararfnthbyrfvfhfyfcnfcm.irfktdjyNunyaefrosimdfczyfrjczfytkbrfTimokhavvfyebkrfAdrierdinfylhjybrDarimolgushaBabyangelvfhbfyyfyflt[fAdorarisrfkblrfkbysxlovelyufkbfbyyeirffktyzueifcdtnkfyAllegrouthvfybrNalmeTenaciriAnicasalardzxtckfdrfRusyauheyznrffylhjybqpoutingktrcfyftrustckfdeyzrjkzfhbneyzonionsSalkreerobeuhtwbzFehuginnLeontytahjcbybzrjcn.iffrcbymirfpbyefRhettokDathisaleutinichnastyuhanastasiaMaricelawitchKeleninKornyukhaMirohaMiddevitBonnecmitrichVictoriansShanelyMienedfkthfDularvenedimtujhsxJulianichDickhokybyfyzyfnfkbqufkbyfvfrcItananenBerkohikdzxfdaisytossedtktyzgfdkbyrfJanngoesfightingAndrorimBandilhaladflznfbcfJessakaBloodfireMohitoufktrfAwenesdctdjkjleirfcnfybckfdrfybrbnbxArishacdtneczmuraJaydayutjhubxBevisorldfkthmzynfnfbkifAngelenadbnyzdjkjlzrfarinkaTtexavLlberygooseKyhnerdekabrynychellochkabyekzRanesCarolineHuongokRossojokIvaniushaAurizarseedvfcznfyfjktusxvfzvfyczVeniaminychkerfczfkmbydthjybxrfelvirkaleoniaAhrefasrfvbkkfHermannAlessandracntgeifVitashautvekzfghjcbymzatjljhfniqialexinkaJohneveLoppokxuraBalladonarageniusgenousCelenfrcfhemuleNataliyanfbcm.irfBallagargelinarjkzifvfhbyfynfybksxlecznyutapetraefrosinsledgeFordrernVitanafktifsanyurafybrbnbxvfhktczKeronfyfcnfcm.irfybrekfMalanragtneifyfcnifevdunyavbfczgfykzGuercioDrelandisgenuleBogravenedictushkawhaleEynttohsvetlanichpetrakaLairiushtyzBabeserLavrushkabjfyyemkaBeabornbvf[fKatyushalavruhaamalamaxiandjkzlyudahaahjc.irffhnyzQunorrarGroranAmelyanNtenQagVasyanastepankafhvtybqAkinohnEmilialjyzfgtnrfdtlzutheczbjfyyfgashadarinaIrunyaangelinapetukhatdljrbvsxall-roundQuemalarseniaegorkadfcbkmrjemelyashafuhbgrfSerenyavtkfym.irfdctdjkjlsxOrielomyalexahayfcnfctzbhfblrfhjvfSilverweaveremmanuilychpolinaryAgatiuscthueyzalexaniaNieblaAnaborHagenbuchdiyauekzChristoperdfcbkbccfmatthewkakfapollinarisnfkbyffdljrtzIP address of the failed login attempt: 46.161.11.89

author: Ian.M
author_rank: Super Contributor
timestamp: June 09, 2022, 12:08:50 am
content: *None* of the user names I've tried to search for from the above list are valid. Try some yourself.https://www.eevblog.com/forum/mlist/?sa=searchMaybe that just shows our moderator team are excellent at bouncing malicious users, but IMHO it would be a *VERY* good idea to verify the email you received is genuine, in case RJH is correct and someone is trying to set you up to try to scam you for your EEVblog login. To do so you need the help of a moderator by PM to advise how to submit the email for Dave or Gnif to examine the raw email headers and body, and match it to the server logs. *DON*T post the headers anywhere public!

author: T3sl4co1l
author_rank: Super Contributor
timestamp: June 09, 2022, 12:38:50 am
content: Could also be VPNs, though maybe I'd expect a few random legit users are using random VPNs so maybe there should be a few results in that case (or maybe not, there are a lot of VPN servers out there?).Tim

author: boB
author_rank: Frequent Contributor
timestamp: June 09, 2022, 01:59:37 am
content: Yep, those names do look bogus, don't they ? Not sure why.The return address "says" it is from do_not_reply@eevblog.comI would think that there are plenty of folks here that understand more than I do about this.A partial part of the header says received from :from [192.200.109.226] ([192.200.109.226:44348] helo=cpanel1.eevblog.com) by smtp14.gate.ord1d.rsapps.net (envelope-from <eevblog@eevblog.com>) (ecelerity 4.2.38.62370 r() with ESMTPS (cipher=DHE-RSA-AES256-GCM-SHA384) id 98/18-16649-28E11A26; Wed, 08 Jun 2022 18:11:14 -0400Doing a Trace Route I get...C:\Users\boBWin10Fast>tracert 192.200.109.226Tracing route to cpanel1.eevblog.com [192.200.109.226]over a maximum of 30 hops:1 2 ms 2 ms 2 ms router.asus.com [192.168.50.1]2 22 ms 20 ms 17 ms 10.61.243.1303 14 ms 24 ms 11 ms 24.153.84.2374 9 ms 10 ms 9 ms 69.139.162.2145 10 ms 10 ms 10 ms 69.139.160.2456 10 ms 10 ms 12 ms 24.124.128.2497 13 ms 12 ms 16 ms 24.124.128.1228 11 ms 11 ms 10 ms be-36121-cs02.seattle.wa.ibone.comcast.net [68.86.93.5]9 10 ms 11 ms 23 ms be-2201-pe01.seattle.wa.ibone.comcast.net [96.110.39.206]10 * * * Request timed out.11 20 ms 14 ms * port-channel4.core2.pdx1.he.net [184.105.64.138]12 40 ms 39 ms * port-channel1.core2.slc1.he.net [184.105.80.114]13 40 ms 39 ms 42 ms 100ge1-1.core1.slc1.he.net [184.105.80.113]14 40 ms 40 ms 39 ms webnx-inc.100gigabitethernet0-25.switch2.slc1.he.net [64.71.130.42]15 40 ms 41 ms 41 ms 104-250-156-210.static.gorillaservers.com [104.250.156.210]16 41 ms 39 ms 41 ms cpanel1.eevblog.com [192.200.109.226]Trace complete.So, from this at least, it looks legit. I don't know how good people can spoof these days but I have a feeling this is correct.gorillaservers.com was another name I saw when doing a whois on an IP in the header so that makes sense.Comcast/xfinity is my internet provider here north of Seattle and those are the first several hops.boB

author: Ian.M
author_rank: Super Contributor
timestamp: June 09, 2022, 03:18:56 am
content: Quote from: boB on June 09, 2022, 01:59:37 amToo many look like 'alphabet soup', as one would expect of a spambot using character level random name generation. I checked several of the more human sounding ones.Gorillaservers are in the dedicated server business, and as of 2021, was/is the EEVBLOG datacenter provider (Ref:https://www.eevblog.com/forum/chat/the-big-eevblog-server-fire/), so the IP address you tracerted is almost certainly one of the genuine EEVblog servers. However that doesn't tell you much as email is routed via a series of 'hops' any one of which could theoretically inject fake headers and content, so without access to the server logs, or other known genuine emails from the same source (hint: turn on some notifications) you have to trace back up the chain of Received: headers checking each is valid for the organization it purports to be a mail server of, rather than being some random user-land IP pool address with a box pwned by a botnet on it. If you've got known good headers to compare to, look closely at the differences in the Received: headers chain.Seehttps://alyninc.com/2018/11/10/email-headers-what-can-they-tell-the-forensic-investigator/for a quick intro to the details.*DONT* post more of the headers publicly here as having genuine headers to spoof would significantly help any intelligent 'black hat' spear phishing EEVblog members in your region, and can give away far too many clues to your real identity.

author: Halcyon
author_rank: Unknown
timestamp: June 09, 2022, 07:47:16 am
content: I searched for some of those users and they appear in the banned/blocked list. Mostly because they registered an account but they got blocked by the spam trap.When spammers can't successfully register, they might try to access the accounts of legitimate users.My advice is:1. Use a good password not used anywhere else (and one that hasn't previously been involved in a data leak, check here:https://haveibeenpwned.com/Passwords)2. Enable multi-factor authentication on your forum account (Profile > Summary > Modify Profile > Two-Step Authentication).

author: boB
author_rank: Frequent Contributor
timestamp: June 09, 2022, 05:06:01 pm
content: Quote from: Halcyon on June 09, 2022, 07:47:16 amYes ! That makes total sense !I see the same kind of random-ish names on my company's web forum that I have banned.Thank youboB 🌜