Questions tagged [brute-force-attacks]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
2answers
39 views

Detect service which is trying to access MySQL database with root privileges

I have a server with MySQL database which is accessible by WordPress. In every 1-2 seconds I see the following in MySQL error.log [Note] Access denied for user 'root'@'localhost' There is no password ...
0
votes
1answer
70 views

Server IP spoofed and attacking

I have a server that has been reported as an attacker since January, finally today I found some information about these attacks, however none of the logs on my server shows anything similar. As a ...
0
votes
1answer
36 views

How do I prevent unwanted FTP connection attempts on my Windows Server 2012 R2?

It appears that I'm getting FTP connection attempts from unknown sources. The SYN_RECEIVED state is nearly always showing. netstat output C:\Users\Administrator>netstat -aon | findstr &...
0
votes
1answer
32 views

Network Threat Protection

Today, my Database server unexpectedly restarted. After checking it, I found that since the start of December, I was getting this event, Network Threat Protection Event. Here's the event Object ...
0
votes
0answers
33 views

Ban ip address from log

I have Ubuntu server and I have brute force attacks this is my log location /var/log/test/access_filter_error_log I want all requests (IP) coming there there automatically go on ban
0
votes
0answers
43 views

Is there any tool to autoreport brute force attacks?

I'm annoyed by brute force attacks, not because they harm me, my server is pretty secure and no relevant data on it, but because they get away with it and might get someone else. If I do whois idiot....
0
votes
0answers
17 views

How to stop Brute Force SSH Login attack on Windows Server? [duplicate]

I'm facing very strange attack on my server where I've received logs from Hosting Provider that, the attack is happening from my IP address. Attack is - Brute Force SSH Login Attack. When I scanned ...
0
votes
1answer
51 views

How to stop my server from bruteforcing another [duplicate]

There are so many resources on how to stop bruteforce attacks on your server, but I can't find any good on bruteforce attacks FROM a shared hosting server. I am getting a lot of reports from many ...
0
votes
0answers
60 views

Azure container instance receives tremendous traffic even right after its creation

I've created an Azure container instance with MSSQL container image. It starts. However before even login, or even putting the URL in to use, I've checked the container logs and it's being hit with ...
0
votes
2answers
66 views

Strange behavior in Apache log

I have a Nextcloud server running on Apache, and disabled my firewall for about 5 minutes while I ran an apt-update. I decided to check the logs after, and found this from an unknown IP. It looks like ...
-1
votes
1answer
57 views

After cyberattack, a new Administrator account has popped up, what, how and for what? [duplicate]

After what seems a human-directed ransomware attack, I am analyzing the system. It is a Windows Server 2016 and I had created the usual Administrator account. Now I see that during the attack, a new "...
2
votes
1answer
612 views

Block bruteforce attempts with nginx & cloudflare without rate limiting

So I discovered servers trying to bruteforce my API so I want to block them...but my specific scenario made it difficult to work with common solutions found on the internet. 1) I don't want to just ...
0
votes
0answers
125 views

Microsoft Log Event ID 4625 - Multiple logins failed account ended with $

Recently, we discovered that in some unknown cases windows generates multiple logons failed (log id 4625). In all cases, the linked account name ended with $ that means computer account login failed. ...
-1
votes
2answers
36 views

uninstall / deactivate ssh client only on linux server [closed]

How can I uninstall or completely deactivate ssh client only. I still need server to log in. I just wonna pretend ssh brute force attacks commming out from my server. Thanks in advance.
-2
votes
1answer
36 views

continuous attack on server nginx

nginx access log There is a continuous attack on server and i am not sure from where it happening. if someone can understand and guide me on this.
0
votes
1answer
108 views

Handling ssh brute force attacks from ::1?

I have an Ubuntu server; first I ran into this, as I couldn't log in via ssh at all: ssh connection takes forever to initiate, stuck at "pledge: network" After a hard reboot, I could log ...
0
votes
1answer
105 views

SSH Brute Force Login Attempts - enable automated email to abuse-mailbox

Running some servers I noticed increased SSH Brute Force Login Attempts over the years. fail2ban is a great tool which massively slows them down and can email the abuse-mailbox/OrgAbuseEmail of the ...
0
votes
3answers
85 views

Sharing IP black lists

Are there any tools similar to fail2ban that would allow sharing of IP black lists? What I'm looking for is something similar to a DNS based blackhole list or real-time blackhole list as is used to ...
1
vote
1answer
671 views

MySQL shutting down on ~ same time and is not starting. Brute Force Attack? Or what?

my portal started to shutting down (1 time a day) and it happening over a week now and i do not know were could issue be. .. MySQL is shutting down on about the same time and is not starting after ...
2
votes
0answers
680 views

Nginx: Rate limit failed basic auth attempts

Given a simple HTTP Basic Auth setup in Nginx (1.14.1 at time of writing) like this: server { ... location / { auth basic "HTTP Auth Required"; auth basic user file "/path/to/htpasswd"; ...
7
votes
1answer
203 views

Windows RDP: Attack targeting real account names

We have a Windows 2012 R2 server hosted in a datacenter, and we are using RDP for its administration. Automatic updates are enabled. RDP login is not allowed for the Administrator account, and there ...
1
vote
2answers
1k views

Brute Force attack in DirectAdmin

I have problem with brute force monitor in direct admin. Every minute i get info like this: 15705610210001 52.187.17.107 123 1 sshd4 Oct 8 20:56:24 server sshd[10817]: Failed password for ...
0
votes
2answers
577 views

Is it wise to have fail2ban block 301 brute forces when you have http to https redirection enabled?

Recently my servers started getting bombarded by anonymous scanners/brute forces. This is how my nginx access.log looked like after the attacks : xxx.xxx.xxx.xxx - - [07/Sep/2019:23:30:16 +0200] "...
0
votes
2answers
1k views

Stopping SSH brute force from China - fail2ban not working

I see things like this in my /var/log/auth.log sshd[2173]: Unable to negotiate with 218.92.0.205 port 21029: no matching host key type found. Their offer: ssh-rsa,ssh-dss [preauth] sshd[1964]: ...
2
votes
0answers
5k views

How to protect against backdoor attack? [duplicate]

I've been getting strange page accesses showing up in my apache error log recently. It seems as though someone is trying to access /wp-login.php, /elrekt.php and other pages that don't exist. It's ...
1
vote
0answers
38 views

SSH brute-force from my network / domain [duplicate]

Twice a week I receive an email to abuse@mydomain.tld that says: An attempt to brute-force account passwords over SSH/FTP by a machine in your domain or in your network has been detected. Attached ...
1
vote
0answers
25 views

I am getting bruteforce attack from locvangxuanfb2019.com

In my wordpress website, I am getting bruteforce login attempts from locvangxuanfb2019.com and hopquavn2019.com When I try to ping locvangxuanfb2019.com and hopquavn2019.com I get response from ...
0
votes
1answer
1k views

IIS - Detecting Brute Force Logins and Password Spraying

TLDR; What techniques are being used to detect brute force logins and/or password spraying on IIS hosted websites (including SharePoint, OWA, etc.)? ModSecurity There are many tools for other ...
0
votes
1answer
118 views

fail2ban filter matches no lines for xmlrpc attack

I'm trying to jail hosts that brute-force attack a web server, thereby creating (hundreds of) lines in /var/log/apache2/error.log of the form [Fri Feb 01 11:17:56.158739 2019] [:error] [pid 15870] [...
1
vote
0answers
104 views

How to Ban WordPress Brute Force Attack by Client From Apache's Server Status Page?

I have a server hosting multiple domains and protected by Fail2Ban with WP Fail2Ban and wordpress-hard + wordpress-soft rules. Recently I notice that our server is heavily loaded and seems like we ...
0
votes
1answer
66 views

Blocking “pokes” of our system

We get tons of these in our apache error log every day. [Wed Oct 17 03:27:37 2018] [error] [client 103.41.124.159] File does not exist: /var/www/html/phpmyadmin [Wed Oct 17 03:27:37 2018] [error] [...
5
votes
4answers
3k views

How to secure servers from a cgi-bin/php POST request attack

We got a POST request to our server with the following in it: %63%67%69%2D%62%69%6E/%70%68%70?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%...
0
votes
1answer
74 views

Block outside TCP requests from centos server

I have a centOS server and user to host web systems with LAMP. Server owners are complaining that we are sending abnormal TCP requests to external server. How can we block these types of requests? Can ...
0
votes
1answer
272 views

Suspicion of brute force attack on mysql

In these last couple of days, one my vps server has crashed twice for no appearant reasons. All sytems on it are up to date. Fail2ban is installed and jailed as much as usual, I trust the server's ...
1
vote
1answer
555 views

RDP Server under attack; IP address used is our server address

I have setup a Windows 2016 server for remote desktop access, and installed RDPGuard to block brute force attacks. This worked well for a few days and RDPGuard blocked out a number of IP addresses. ...
0
votes
1answer
110 views

My web server is being hit, all resources are maxed out, how to find out the root cause?

Recently my websites appear to be getting hit by something. They slow down and become unresponsive. After I terminal connect to the server, I see that all resources are maxed out, 100% of CPU, Memory, ...
1
vote
1answer
352 views

Stop HTTP Post Requests with NGINX Before Hitting WordPress Application Log-in Page

Since the bots send HTTP Post requests directly at the known target /wp-login.php to skip the Captcha, would it be possible to check for a custom Post Input such as the Captcha Input or my own custom ...
1
vote
1answer
310 views

NGINX Brute Force Detection of devices hiding behind NAT. Block only specific device and not all devices sharing the same IP

I have a AWS EC2 Ubuntu instance with NGINX server configured to listen on IP address 50.0.0.1 (Example) on port 80. I have a login page in index.php. I want to configure nginx for brute force ...
0
votes
2answers
319 views

A smart attack on SMTP evading fail2ban

I have an ongoing brute-force attack on my SMTP server in a way that evades typical fail2ban settings: attacks take place from several IPs in the same subnet a single IP attacks in intervals longer ...
0
votes
2answers
344 views

Windows and Apache Block IP by Country

I'm having DDoS attacks and brute force, my clients are only from a Latin American country and I did not find attacks from that country, so I think my solution would be to find a way to block ips from ...
1
vote
1answer
98 views

Brute Forcing IPs

I have random IPs constantly targetting my Apache server. A sample of what I get in my log: 80.108.96.31 - - [18/Aug/2017:16:16:08 +0000] "GET /machine.xml HTTP/1.1" 403 520 "-" "Mozilla/4.0 (...
0
votes
2answers
973 views

Automatic exim4 ban ip

I would like to know if it is possible to automatically ban/filter an IP for few time in case of multiple authentication failure in exim4 server.
0
votes
2answers
4k views

Brute force attack with no IP to trace

I am getting constant event 4625 messages saying that accounts are failing to log in with non-existent usernames. Names such as: SALES, USER, TEST, HELPDESK, SUPPORT, PROGRAMMER are not users of ours, ...
2
votes
1answer
2k views

Auto-ban IP from “wp-login.php” attackers

When I look at my Apache log other_vhosts_access.log, I see many many attempts, from a few different IP per month like this: www.example.com:80 91.200.x.x - - [25/Jun/2017:17:20:19 +0200] "POST /wp-...
0
votes
0answers
137 views

How to ban abusers who use my public SOCKS5 proxy server to brutforce 3-rd party sites?

We have been thinking for very long time about it. It's easy to escape abusers who use my server to send email spam by blocking email ports, but how to ban abusers who use my public SOCKS5 proxy ...
3
votes
2answers
9k views

Blocking IPs in HAProxy

A client's website is currently under attack, and I've been called in to fix it. A huge number of IPs (easily over 5,000) is constantly hitting /login, presumably trying to bruteforce their way in. ...
10
votes
3answers
4k views

Securing linux servers: iptables vs fail2ban

I would like to pick the community's brain regarding linux server security, specifically regarding brute-force attacks and using fail2ban vs custom iptables. There are a few similar questions out ...
0
votes
3answers
4k views

Using iptables to prevent SSH brute force attacks and DDOS attacks

I have the following lines at the very top of iptables, these are used to prevent SSH brute force attacks and DDOS attacks: iptables segment to prevent SSH brute force attacks and DDOS attacks What ...
1
vote
1answer
807 views

fail2ban with vsftpd explicit sftp

The fail2ban vsftpd default config doesn't take care of blocking brute force requests when tls is enabled on vsftpd. At the moment the vsftpd log only shows the below lines which don't match the regex....
1
vote
1answer
6k views

Too many TIME_WAIT connections on mysql from an outside host

My netstat is showing over 2,000 mysql connections with the state of TIME_WAIT that seems to be stuck and won't go away. It's been like that for several hours and many of the connections are coming ...