Discussion
I have a support call in with the hosting provider, but be interested to hear your views. Looking at statistics for a client's site, I notice this:
IP Address: [86.131.68.51] host86-131-68-51.range86-131.btcentralplus.com
Page Views: 129,830
Visits: 6
Hits: 130,042
Bandwidth: 369,532
All the hits from that IP address are to a user login page. My assumption is that this is a hacker trying a brute force attack to gain access. Correct, or completely innocent?
IP Address: [86.131.68.51] host86-131-68-51.range86-131.btcentralplus.com
Page Views: 129,830
Visits: 6
Hits: 130,042
Bandwidth: 369,532
All the hits from that IP address are to a user login page. My assumption is that this is a hacker trying a brute force attack to gain access. Correct, or completely innocent?
From looking at the graph it is obviously a night owl or possible someone from the state trying to get access to the site.
He has probably written some script to automate the attack overnight, and will be using some sort of dictionary file to generate the useranme and password.
He has probably written some script to automate the attack overnight, and will be using some sort of dictionary file to generate the useranme and password.
Edited by stevieb on Wednesday 1st November 16:06
[86.131.68.51] host86-131-68-51.range86-131.btcentralplus.com
Feeding the end bit in to google eventually suggests that British Telecommunications use this domain.
I would suspect someone who's up all night (anything from strange unemployed chav to shift worker) is infected with something and when they crank up the machine off it goes smacking seven bells out of your clients login form.
I'd suggest, just slapping that whole switch in to a .htaccess and give the kids scripts the big F
K OFF (i.e. 403 Access Denied).
Feeding the end bit in to google eventually suggests that British Telecommunications use this domain.
I would suspect someone who's up all night (anything from strange unemployed chav to shift worker) is infected with something and when they crank up the machine off it goes smacking seven bells out of your clients login form.
I'd suggest, just slapping that whole switch in to a .htaccess and give the kids scripts the big F
K OFF (i.e. 403 Access Denied). Cheers guys 
Checked the logs; apart from the userlogin page, they're not going anywhere else. User IP address and login time is logged in a db upon successful login, but this IP address hasn't logged in.
This is a BT broadband IP address; worth a mail to abuse? I'll block the address anyway.
Checked the logs; apart from the userlogin page, they're not going anywhere else. User IP address and login time is logged in a db upon successful login, but this IP address hasn't logged in.
This is a BT broadband IP address; worth a mail to abuse? I'll block the address anyway.
.Flyer said:
This is a BT broadband IP address; worth a mail to abuse? I'll block the address anyway.
Might get the little retards net access revoked. ISP's can be very intollerant and exceptionally biligerent towards kiddies who get discovered.
Although probably just get deleted, but still worth a try and a hypothetical giggle
ThePassenger said:
Might get the little retards net access revoked.
This is a ColdFusion app on IIS, so htaccess isn't available. However, I've just thrown up a quick change to the application.cfc file (that every page references) that gives Mr WannabeHacker a 403 and then locates him to The Serious Organised Crime Agency (SOCA)
That might wake the little fecker up.Gassing Station | Computers, Gadgets & Stuff | Top of Page | What's New | My Stuff