Spam?

[rvk]

It should be the IP from which the password-reset request originated.

Should it ? Still consistent with the theory someone tried to reset our passwords. IMHO.
Davo

Yes it is. But at least not originating from our own computers (via virus or something).

https://platform.censys.io/hosts/185.125.171.218

[dbannon]

If I had time to waste, I'd fire up a burner VM and have a look at that website but probably would not tell me anything.

Davo

[rvk]

platform.sensys.io is just a website which shows the who's and exposed services from given IP address. It's a professional search engine for cybersecurity. Gives lots of information about IP.
It shows that that IP hosts a http and ssh service.

Another such search site is
https://www.shodan.io/host/185.125.171.218

(But it's always wise to be careful with links  )

[dbannon]

Er, yeah, I meant I'd browse to the website at that IP address. Its listed as having a web server ...

Davo

[rvk]

Ah. From what I can see on census.io in host.services.endpoints.http.body it just seems to be a default install page of nginx (they also log a connect to those services with result). And from the SSH log it seems a Debian server.

But yes. It could still be some kind of honeypot 

I wonder if the admin here knows more about it?
Login reminder requests for lots of different users from one IP would be considered suspicious 

[Martin_fr]

I don't know if Marc will have some time to look into it...
All I could find are some failed logins. Though not very many.

One possibility is that they hoped someone would post the entire email (incl link) here, and they could see it and use the link. (after all its a password recovery, if you have that link you don't need the password).

Or they didn't know the emails of the users, but they had accessed to hacked email accounts and were randomly trying if any of those mails would go to such a hacked email...

As long as the email ended up with you, and no one else, then its just an annoyance.

[Zvoni]

Haven't received such a mail

BUT: On Monday afternoon (European time) i ran into the dreaded Gateway TimeOut a few times

Coincidence?
A bot grabbing/scraping.... and suddenly 2 days later pretty much all users get bombed with PW-Reset requests?

[Martin_fr]

See the other thread. Marc is doing a check up, but likely it just be an attempt to fish on the user end.

The timeouts are an ongoing issue, as such unlikely to be related.

I think a bit of an increase in spam posts last week. (I don't keep stats, so it may just be me noticing before an other moderator deleted it). Then it could be an attempt to break into existing accounts to use them for spam.

[C0m3b4ck]

But it is from gigahost in Norway ?  Is that right ?

Davo

That's also what I get from whois.

Same here, gigahost from Norway. Forums are experiencing spam raids more often nowadays. Maybe this password reset guy had a few hacked email accounts and counted on getting a password reset.

[rvk]

Maybe this password reset guy had a few hacked email accounts and counted on getting a password reset.

From the other topic... It probably was a misconfigured harvester/crawled.

Thanks,
someone was trying to harvest account names, but failed.
Anyway I've added a ban rule to detect when multiple rare used actions are requested (so be careful if you want to see someone's profile several time in a row)

[Marc]

I don't know why, but the mentioned IP was running some curl script issuing a "forgot password" for hundreds of users. What I fail to see is the use of it since the link is mailed to the user and not the "attacker"
The script also tried to download all members, but it had no permission to do so.

I've configured a ban for repetitive actions like this.

[Thaddy]

That is a very sane decision again. Thanks Marc.

[kupferstecher]

I've configured a ban for repetitive actions like this.

Perhaps it would be better if for password recovery the email address would be required. The way it is now anyone could "prank" any user.

[C0m3b4ck]

I don't know why, but the mentioned IP was running some curl script issuing a "forgot password" for hundreds of users. What I fail to see is the use of it since the link is mailed to the user and not the "attacker"
The script also tried to download all members, but it had no permission to do so.

I've configured a ban for repetitive actions like this.

Thanks!!!