Hack attempt on my account?

[angrygoatface]

Haven't been to these forums in awhile, but I just got this email today:

Dear angrygoatface,

Your account on Photography & Digital Camera Forums has been locked because someone has tried to log into the account with the wrong password more than 5 times. You will be able to attempt to log in again in another 15 minutes.

The person trying to log into your account had the following IP address: 212.143.129.210

Don't forget that the password is case sensitive. Forgotten your password? Use the link below:
http://forums.photographyreview.com/login.php?do=lostpw

All the best,
Photography & Digital Camera Forums

I also have a spam PM in my inbox. I wonder if it's related?

[Photo-John]

These hack attempts started today. I think we're about to apply a solution to the attack.

I don't know anything about the PM spam. How old is it? We had a PM spam problem a few months ago. It could be from back then. Forward it to me and I'll take a look.

[Frog]

Seems to be a busy guy http://allforums.net/showthread.php?t=37510
There were other google hits but they were in German.

[Photo-John]

Seems to be a busy guy http://allforums.net/showthread.php?t=37510
There were other google hits but they were in German.

Interesting. It's the same IP. But I'm pretty sure it's not a person. It's an automated attack and it's actually been going on for a while. It's only today that it made it through to the member accounts and it becamse clear what the intent was.

[angrygoatface]

I forwarded that spam PM.

[A.M.D.A.]

I got the same e-mail as angrygoatface but it said "Dear A.M.D.A" and the hacker's IP address was 212.143.129.217

Then, I searched the number on an IP address locator and it came up as someone from Israel?

[Photo-John]

I got the same e-mail as angrygoatface but it said "Dear A.M.D.A" and the hacker's IP address was 212.143.129.217

Then, I searched the number on an IP address locator and it came up as someone from Israel?

I don't think it's a "someone." I think it's a group or organization or some kind of organized bot attack. In any case, it's been blocked. They shouldn't be able to touch our network anymore.

[A.M.D.A.]

Thanks Photo-John.:thumbsup:

[AKAJohnDoe]

Ditto here. Account locked due to incorrrect password from 212.143.129.202 on 8/12/2008.

Strongly recommend blocking the entire IP address range of the ISP (212.143.129.0 - 212.143.129.255) if not already done.

[Photo-John]

Ditto here. Account locked due to incorrrect password from 212.143.129.202 on 8/12/2008.

Strongly recommend blocking the entire IP address range of the ISP (212.143.129.0 - 212.143.129.255) if not already done.

Yes, it's been done. Thanks for posting!