Questions tagged [brute-force-attacks]
The brute-force-attacks tag has no usage guidance.
200
questions
0
votes
1
answer
42
views
I am continuously getting Audit Failure on the computer. Does that mean someone is trying to brute force to the computer?
I am getting lots of Audit Failure errors on Windows Logs/Security in event viewer.
See the image below.
Does that mean someone is trying to brute-force to my computer?
-1
votes
1
answer
73
views
Block unusual traffic from LAN on Switch [closed]
I was wondering if on HP Switches (2920 for example) is there something like storm control but for unicasts?
Let's assume, we have a host in our network who bruteforces some random IP addresses. How ...
- 17
0
votes
0
answers
44
views
Gitea instance is being brute-forcely attacked
My Gitea instance is being brute-forced just as I write this text:
gitea | Invalid user yinsen from 94.23.30.184 port 55154
gitea | Connection closed by invalid user yinsen 94.23.30.184 port 55154 [...
- 111
0
votes
0
answers
247
views
Reverse Proxy (NGinx) with captcha
I am trying to prevent some brute force attacks on an web app by having a captcha before the login page.
The application itself is not modifiable by me, so I cannot change the login form.
I could put ...
- 183
0
votes
2
answers
346
views
fail2ban log activity even if IP has been banned anyway
I would like to know if there is a way to know if a banned IP is still trying to contact my server and what is he trying to do?
The fail2ban.log seems to show who has been banned, but not if a banned ...
- 3
0
votes
1
answer
65
views
Can a bots scanning my server change its source ip? Why do I keep getting attacks even after blocking the IP?
I have a PBX (VOIP server) where phones connect in order to make phone calls. The pbx I am using is Asterisk. That server is not being used and it's only purpose is to analyze attacks.
The PBX service ...
- 312
0
votes
1
answer
200
views
How can I stop this kind of exim attack?
I has been search here, BUT no topic about my question (they just ask for their email was rejcted, but this time, not my email was been reject), it seem someone try to send spam out via my server, ...
- 1
1
vote
2
answers
94
views
Can the bulk execution of "dig domain mx" on 5000 domains be considered an attack to the network?
I have a database containing a lot of invalid emails.
I want to remove all the emails whose domain does not have mx record.
So after I extracted the domain part I wrote a script to bulk check this for ...
- 155
0
votes
0
answers
551
views
Protecting Postfix/Dovecot combo against brute force
Typical mail server with Postfix and Dovecot if well configured, rejects efficiently vast majority of spammers attempts. There are two things though, which are not dealt with in typical configurations ...
- 101
0
votes
0
answers
21
views
Outgoing Brute force attack from my Amazon EC2 [duplicate]
First of all, thank you for reading this.
Today I receive an email from aws saying one of my fresh EC2 is being used for brute force attacks along with some details so I could fix the issue.
...
- 101
0
votes
1
answer
48
views
How to block rdp passwords brute-forcing? [closed]
I've noticed there are significant spikes in cpu consumption on my servers due to bots trying to brute force my rdp password. I tried to change an rdp port, it helps for a while but then it resumes. ...
- 625
0
votes
1
answer
390
views
Disabled SSLv3 in Windows registry but still showing POODLE vulnerability
Windows server 2016 Standard.
Recently we've been getting hit by brute force attempt using POODLE. I did a little research and found we should disable SSLv3. However, when I go into:
...
- 123
2
votes
3
answers
7k
views
SSHD: Difference between "connection closed..." and "disconnected from..." in log file
The sshd service on my Ubuntu server is under constant attack for various IP and user id.
According to /var/log/auth.log file, there are three different types of fails from unknown id and IP address:
...
- 123
0
votes
1
answer
2k
views
Postfix blank sender from= <>
Recently I received spam report form my vps provider and Trend Micro, I think my vps got suspended because a or some unknow "blank sender" using my mail server as a "jump point", I ...
0
votes
2
answers
231
views
Detect service which is trying to access MySQL database with root privileges
I have a server with MySQL database which is accessible by WordPress. In every 1-2 seconds I see the following in MySQL error.log
[Note] Access denied for user 'root'@'localhost'
There is no password ...
0
votes
1
answer
285
views
Server IP spoofed and attacking
I have a server that has been reported as an attacker since January, finally today I found some information about these attacks, however none of the logs on my server shows anything similar. As a ...
- 358
0
votes
1
answer
141
views
How do I prevent unwanted FTP connection attempts on my Windows Server 2012 R2?
It appears that I'm getting FTP connection attempts from unknown sources. The SYN_RECEIVED state is nearly always showing.
netstat output
C:\Users\Administrator>netstat -aon | findstr &...
- 3
0
votes
1
answer
104
views
Network Threat Protection
Today, my Database server unexpectedly restarted. After checking it, I found that since the start of December, I was getting this event, Network Threat Protection Event. Here's the event
Object ...
0
votes
0
answers
150
views
Is there any tool to autoreport brute force attacks?
I'm annoyed by brute force attacks, not because they harm me, my server is pretty secure and no relevant data on it, but because they get away with it and might get someone else.
If I do whois idiot....
- 101
0
votes
1
answer
71
views
How to stop my server from bruteforcing another [duplicate]
There are so many resources on how to stop bruteforce attacks on your server, but I can't find any good on bruteforce attacks FROM a shared hosting server.
I am getting a lot of reports from many ...
- 101
0
votes
0
answers
153
views
Azure container instance receives tremendous traffic even right after its creation
I've created an Azure container instance with MSSQL container image. It starts. However before even login, or even putting the URL in to use, I've checked the container logs and it's being hit with ...
- 201
0
votes
2
answers
218
views
Strange behavior in Apache log
I have a Nextcloud server running on Apache, and disabled my firewall for about 5 minutes while I ran an apt-update. I decided to check the logs after, and found this from an unknown IP. It looks like ...
-1
votes
1
answer
72
views
After cyberattack, a new Administrator account has popped up, what, how and for what? [duplicate]
After what seems a human-directed ransomware attack, I am analyzing the system. It is a Windows Server 2016 and I had created the usual Administrator account. Now I see that during the attack, a new "...
- 487
2
votes
1
answer
1k
views
Block bruteforce attempts with nginx & cloudflare without rate limiting
So I discovered servers trying to bruteforce my API so I want to block them...but my specific scenario made it difficult to work with common solutions found on the internet.
1) I don't want to just ...
- 133
-1
votes
2
answers
48
views
uninstall / deactivate ssh client only on linux server [closed]
How can I uninstall or completely deactivate ssh client only. I still need server to log in.
I just wonna pretend ssh brute force attacks commming out from my server.
Thanks in advance.
- 99
-2
votes
1
answer
181
views
continuous attack on server nginx
nginx access log
There is a continuous attack on server and i am not sure from where it happening.
if someone can understand and guide me on this.
- 1
0
votes
1
answer
308
views
Handling ssh brute force attacks from ::1?
I have an Ubuntu server; first I ran into this, as I couldn't log in via ssh at all:
ssh connection takes forever to initiate, stuck at "pledge: network"
After a hard reboot, I could log ...
- 101
0
votes
1
answer
289
views
SSH Brute Force Login Attempts - enable automated email to abuse-mailbox
Running some servers I noticed increased SSH Brute Force Login Attempts over the years. fail2ban is a great tool which massively slows them down and can email the abuse-mailbox/OrgAbuseEmail of the ...
- 123
0
votes
3
answers
121
views
Sharing IP black lists
Are there any tools similar to fail2ban that would allow sharing of IP black lists? What I'm looking for is something similar to a DNS based blackhole list or real-time blackhole list as is used to ...
- 101
1
vote
1
answer
2k
views
MySQL shutting down on ~ same time and is not starting. Brute Force Attack? Or what?
my portal started to shutting down (1 time a day) and it happening over a week now and i do not know were could issue be. ..
MySQL is shutting down on about the same time and is not starting after ...
- 59
5
votes
0
answers
1k
views
Nginx: Rate limit failed basic auth attempts
Given a simple HTTP Basic Auth setup in Nginx (1.14.1 at time of writing) like this:
server {
...
location / {
auth basic "HTTP Auth Required";
auth basic user file "/path/to/htpasswd";
...
- 421
7
votes
1
answer
384
views
Windows RDP: Attack targeting real account names
We have a Windows 2012 R2 server hosted in a datacenter, and we are using RDP for its administration. Automatic updates are enabled.
RDP login is not allowed for the Administrator account, and there ...
- 171
1
vote
2
answers
1k
views
Brute Force attack in DirectAdmin
I have problem with brute force monitor in direct admin.
Every minute i get info like this:
15705610210001 52.187.17.107 123 1 sshd4 Oct 8 20:56:24 server sshd[10817]: Failed password for ...
- 11
0
votes
2
answers
1k
views
Is it wise to have fail2ban block 301 brute forces when you have http to https redirection enabled?
Recently my servers started getting bombarded by anonymous scanners/brute forces.
This is how my nginx access.log looked like after the attacks :
xxx.xxx.xxx.xxx - - [07/Sep/2019:23:30:16 +0200] "...
- 457
0
votes
2
answers
2k
views
Stopping SSH brute force from China - fail2ban not working
I see things like this in my /var/log/auth.log
sshd[2173]: Unable to negotiate with 218.92.0.205 port 21029: no matching host key type found. Their offer: ssh-rsa,ssh-dss [preauth]
sshd[1964]: ...
- 103
2
votes
0
answers
5k
views
How to protect against backdoor attack? [duplicate]
I've been getting strange page accesses showing up in my apache error log recently. It seems as though someone is trying to access /wp-login.php, /elrekt.php and other pages that don't exist. It's ...
- 21
1
vote
0
answers
38
views
SSH brute-force from my network / domain [duplicate]
Twice a week I receive an email to abuse@mydomain.tld that says:
An attempt to brute-force account passwords over SSH/FTP by a machine in your domain or in your network has been detected. Attached ...
- 111
1
vote
0
answers
27
views
I am getting bruteforce attack from locvangxuanfb2019.com
In my wordpress website, I am getting bruteforce login attempts from locvangxuanfb2019.com and hopquavn2019.com
When I try to ping locvangxuanfb2019.com and hopquavn2019.com I get response from ...
- 135
0
votes
1
answer
3k
views
IIS - Detecting Brute Force Logins and Password Spraying
TLDR;
What techniques are being used to detect brute force logins and/or password spraying on IIS hosted websites (including SharePoint, OWA, etc.)?
ModSecurity
There are many tools for other ...
- 206
0
votes
1
answer
223
views
fail2ban filter matches no lines for xmlrpc attack
I'm trying to jail hosts that brute-force attack a web server, thereby creating (hundreds of) lines in /var/log/apache2/error.log of the form
[Fri Feb 01 11:17:56.158739 2019] [:error] [pid 15870] [...
1
vote
0
answers
150
views
How to Ban WordPress Brute Force Attack by Client From Apache's Server Status Page?
I have a server hosting multiple domains and protected by Fail2Ban with WP Fail2Ban and wordpress-hard + wordpress-soft rules.
Recently I notice that our server is heavily loaded and seems like we ...
- 11
0
votes
1
answer
71
views
Blocking "pokes" of our system
We get tons of these in our apache error log every day.
[Wed Oct 17 03:27:37 2018] [error] [client 103.41.124.159] File does not exist: /var/www/html/phpmyadmin
[Wed Oct 17 03:27:37 2018] [error] [...
- 167
5
votes
4
answers
4k
views
How to secure servers from a cgi-bin/php POST request attack
We got a POST request to our server with the following in it:
%63%67%69%2D%62%69%6E/%70%68%70?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%...
- 397
0
votes
1
answer
80
views
Block outside TCP requests from centos server
I have a centOS server and user to host web systems with LAMP. Server owners are complaining that we are sending abnormal TCP requests to external server.
How can we block these types of requests?
Can ...
- 113
0
votes
1
answer
376
views
Suspicion of brute force attack on mysql
In these last couple of days, one my vps server has crashed twice for no appearant reasons. All sytems on it are up to date. Fail2ban is installed and jailed as much as usual, I trust the server's ...
- 159
1
vote
1
answer
722
views
RDP Server under attack; IP address used is our server address
I have setup a Windows 2016 server for remote desktop access, and installed RDPGuard to block brute force attacks. This worked well for a few days and RDPGuard blocked out a number of IP addresses.
...
- 11
0
votes
1
answer
162
views
My web server is being hit, all resources are maxed out, how to find out the root cause?
Recently my websites appear to be getting hit by something. They slow down and become unresponsive. After I terminal connect to the server, I see that all resources are maxed out, 100% of CPU, Memory, ...
1
vote
1
answer
552
views
Stop HTTP Post Requests with NGINX Before Hitting WordPress Application Log-in Page
Since the bots send HTTP Post requests directly at the known target /wp-login.php to skip the Captcha, would it be possible to check for a custom Post Input such as the Captcha Input or my own custom ...
- 111
1
vote
1
answer
442
views
NGINX Brute Force Detection of devices hiding behind NAT. Block only specific device and not all devices sharing the same IP
I have a AWS EC2 Ubuntu instance with NGINX server configured to listen on IP address 50.0.0.1 (Example) on port 80.
I have a login page in index.php. I want to configure nginx for brute force ...
- 45
0
votes
2
answers
412
views
A smart attack on SMTP evading fail2ban
I have an ongoing brute-force attack on my SMTP server in a way that evades typical fail2ban settings:
attacks take place from several IPs in the same subnet
a single IP attacks in intervals longer ...
- 1,311