You are not logged in.

#1 2023-01-19 5:25 pm

Alex Kemp
Moderator
From: Nottingham, England
Registered: 2009-12-02
Posts: 2,333
Website

Ongoing widespread credential stuffing attack

There is a widespread credential stuffing attack by malicious actors attempting to hack into Forum accounts using credentials exposed in data breaches at other sites or have been harvested by Data Stealing Trojans

Most notable IP  109.107.166.230

Do a search and you'll see 300+ recorded events in four days.

Every time I look, the number id events increase.  If you look at the sparse Evidence entries, they are coincidental.

(by request of the author, this is a repost of an original from another SFS member)

Offline

#2 2023-01-21 7:43 pm

pedigree
uıɐbɐ ʎɐqǝ ɯoɹɟ pɹɐoqʎǝʞ ɐ buıʎnq ɹǝʌǝu ɯ,ı
From: New Zealand
Registered: 2008-04-16
Posts: 6,986

Re: Ongoing widespread credential stuffing attack

thanks, ill look at the credibility of the submitter and remove them if found to be anything but 100% legitimate

Offline

#3 2023-01-22 8:00 pm

NeoFox
Member
From: WI, USA, Earth
Registered: 2013-09-26
Posts: 829
Website

Re: Ongoing widespread credential stuffing attack

Good on you folk to be on top of this. Respect.

Offline

#4 2023-01-23 5:40 am

robleyd
Member
From: Adelaide, Australia
Registered: 2012-07-15
Posts: 2

Re: Ongoing widespread credential stuffing attack

I noticed a brief flurry of dormant (not used for several years) forum accounts suddenly promoting crypto pumps, all from this IP; clearly accounts had been compromised. A quick check of the IP revealed that the entire 109.107.166.0/24 range was registered to an individual in UA. Simply banning that IP range seems to have solved the immediate problem for our forum.

Offline

#5 2023-01-23 10:25 am

pedigree
uıɐbɐ ʎɐqǝ ɯoɹɟ pɹɐoqʎǝʞ ɐ buıʎnq ɹǝʌǝu ɯ,ı
From: New Zealand
Registered: 2008-04-16
Posts: 6,986

Re: Ongoing widespread credential stuffing attack

they're being submit by a lot of different accounts, over a dozen so I'm going to spent some time tomorrow going over the specifics.....

New year, new hell at work sad

Offline

#6 2023-01-23 11:39 am

robleyd
Member
From: Adelaide, Australia
Registered: 2012-07-15
Posts: 2

Re: Ongoing widespread credential stuffing attack

And a new PM to top it off.

Offline

Board footer

Powered by FluxBB

Close
Close