logon attempts from 62.252.64.31

bamabama · 06-10-2006, 22:04

One of the boards I used regularly sent me an email.
Account suspended through 5 failed logon attempts. It wasn't me, I was not even in the house !).
Attempted logon came from 62.252.64.31 which is
lutn-cache-10.server.ntli.net
the DCHP server I am actually using is close to the address (.21) and is
lutn-sacmdhcp-1b.server.ntli.net
My IP address is, of course, miles away from either of these (and the lease has been valid from 11 a.m today).

This is all very strange - and slightly worrying...

Any light anyone ?

(please bear in mind I am not a network bod.)

(its my day for creating threads apparently...)

P.S. yep have run the usual checks for naughty software virii etc.

Druchii · 06-10-2006, 22:43

Somone just tried accessing your account entering passwords they thought were right, just contact the board and explain. All will be well

bamabama · 06-10-2006, 22:50

Quote:

Originally Posted by Druchii

Somone just tried accessing your account entering passwords they thought were right, just contact the board and explain. All will be well

Yes but from the same ISP and from a cache machine....(by the looks of it)...

never had this happen before and have not upset anyone on that board (that I know of of course...)

colour me suspicious...

Druchii · 06-10-2006, 22:53

It's not impossible though, i'd leave it this time round, but if it happens again then definitely get worried.

bamabama · 06-10-2006, 22:57

I know there have been 'issues' with NTL proxies - not sure what these issues have been but maybe its worth a poke around about this.... hmmm

As for security - I don't wait for the second hit before investigating. Big fan of Root Cause Analysis.

bamabama · 07-10-2006, 13:28

Any NTL techno bods on here care to comment on this ?? please ? ? ?

Graham M · 07-10-2006, 14:18

All of NTL's web connections go through proxies, someone on the Luton Proxy server got their password wrong 5 times in a row, simple as that.

Wicked_and_Crazy · 07-10-2006, 18:14

Quote:

Originally Posted by Zeph

All of NTL's web connections go through proxies, someone on the Luton Proxy server got their password wrong 5 times in a row, simple as that.

sounds more like someone tried to access the OP's account 5 times

Graham M · 07-10-2006, 18:17

ah yes, just re-read. Spot on Wicked

bamabama · 07-10-2006, 21:54

Just to show my lack of network know how...
How on earth would that register as a logon attempt from the IP address of the proxy - and not the Ip address of the person attemting the logon.
I thought that cacheing proxies were transparent.
If they were not then every user going through that proxy would register as on that same IP address on every website they accessed (not to mention for every ftp they attempted)...and that can't be 'working as designed'.

any Net Heads out there ? ? ? ?

Druchii · 07-10-2006, 21:58

Yep, that's how it works with websites that aren't coded to find the users IP, they rather record the Proxies IP address instead.

It has been known to cause problems with sites like rapidshare.

Graham M · 07-10-2006, 22:01

Simply because vBulletin by default isn't set to register the proxy IP

bamabama · 08-10-2006, 15:06

Point !

am chasing up the recording 'ability' of the board in question with the Mods there.
Will get back when I find out.

bamabama · 09-10-2006, 09:35

Mods on the board in question came back. Their board is coded correctly, it does not record the ISP proxy address, it records the 'real' user IP address.
Hence, currently, this points to 'something' happening at the NTL proxy.

any NTL clues ? ? ?

Graham M · 09-10-2006, 09:43

Well obviously it's not for the login attempts, if it's default vBulletin it doesn't, it takes a fair bit of hacking to get it detecting a real IP Address over the entire board.