logon attempts from 62.252.64.31
 

One of the boards I used regularly sent me an email.
Account suspended through 5 failed logon attempts. It wasn't me, I was not even in the house !).
Attempted logon came from 62.252.64.31 which is
lutn-cache-10.server.ntli.net
the DCHP server I am actually using is close to the address (.21) and is
lutn-sacmdhcp-1b.server.ntli.net
My IP address is, of course, miles away from either of these (and the lease has been valid from 11 a.m today).

This is all very strange - and slightly worrying...

Any light anyone ?

(please bear in mind I am not a network bod.)

(its my day for creating threads apparently...)

P.S. yep have run the usual checks for naughty software virii etc.

Re: logon attempts from 62.252.64.31
 

Somone just tried accessing your account entering passwords they thought were right, just contact the board and explain. All will be well :)

Re: logon attempts from 62.252.64.31
 

Yes but from the same ISP and from a cache machine....(by the looks of it)...

never had this happen before and have not upset anyone on that board (that I know of of course...)


colour me suspicious...

Re: logon attempts from 62.252.64.31
 

It's not impossible though, i'd leave it this time round, but if it happens again then definitely get worried.

Re: logon attempts from 62.252.64.31
 

I know there have been 'issues' with NTL proxies - not sure what these issues have been but maybe its worth a poke around about this.... hmmm

As for security - I don't wait for the second hit before investigating. Big fan of Root Cause Analysis.

Re: logon attempts from 62.252.64.31
 

Any NTL techno bods on here care to comment on this ?? please ? ? ?

Re: logon attempts from 62.252.64.31
 

All of NTL's web connections go through proxies, someone on the Luton Proxy server got their password wrong 5 times in a row, simple as that.

Re: logon attempts from 62.252.64.31
 

sounds more like someone tried to access the OP's account 5 times

Re: logon attempts from 62.252.64.31
 

ah yes, just re-read. Spot on Wicked

Re: logon attempts from 62.252.64.31
 

Just to show my lack of network know how...
How on earth would that register as a logon attempt from the IP address of the proxy - and not the Ip address of the person attemting the logon.
I thought that cacheing proxies were transparent.
If they were not then every user going through that proxy would register as on that same IP address on every website they accessed (not to mention for every ftp they attempted)...and that can't be 'working as designed'.

any Net Heads out there ? ? ? ?

Re: logon attempts from 62.252.64.31
 

Yep, that's how it works with websites that aren't coded to find the users IP, they rather record the Proxies IP address instead.

It has been known to cause problems with sites like rapidshare.

Re: logon attempts from 62.252.64.31
 

Simply because vBulletin by default isn't set to register the proxy IP

Re: logon attempts from 62.252.64.31
 

Point !

am chasing up the recording 'ability' of the board in question with the Mods there.
Will get back when I find out.

Re: logon attempts from 62.252.64.31
 

Mods on the board in question came back. Their board is coded correctly, it does not record the ISP proxy address, it records the 'real' user IP address.
Hence, currently, this points to 'something' happening at the NTL proxy.

any NTL clues ? ? ?

Re: logon attempts from 62.252.64.31
 

Well obviously it's not for the login attempts, if it's default vBulletin it doesn't, it takes a fair bit of hacking to get it detecting a real IP Address over the entire board.