[!]

For weeks, maybe even months (?) they have tried to login to the server! I saw it because suddenly, one of my accounts got locked for too many failed login tries. I thought wtf... so I checked the logs.

I blocked the entire range! So many different IPs.

What the fuck do they even want? lol.... the files and pictures attached here are online on the forum already to download openly. LOL ...it's not like we take money from people to download PROBLEMCHYLD's service pack!

One weird thing was that they guessed one of my account names! Very strange. It's just some random characters. I changed it already of course but still, it was kinda creepy.

Screenshot_20210412-085759~2.png (254.15 KiB) Viewed 13468 times

[Steven W]

https://blog.malwarebytes.com/detections/185-202-2-147/

Try using VOIP and opening ports. Ring, ring, ring.

[Steven W]

badpackets.jpg (54.88 KiB) Viewed 13462 times

[!]

https://blog.malwarebytes.com/detections/185-202-2-147/

Try using VOIP and opening ports. Ring, ring, ring.

Damn!

[!]

It's among the IPs that are trying to login to the server.

[!]

Added another range. This is crazy.

Screenshot_20210413-010255~2.png (203.36 KiB) Viewed 13457 times

[Steven W]

The sad thing is, there's probably some legit users in those ranges, but I suppose the odds of them trying to access this site are somewhat slim.

[Steven W]

The SIP protocol desperately needs upgraded or replaced.

[!]

The sad thing is, there's probably some legit users in those ranges, but I suppose the odds of them trying to access this site are somewhat slim.

Yeah, true but I really had no choice. They were hitting the server 24x7, totally crazy. As you said, I don't think anyone from those ranges will visit here anyway though.

[PROBLEMCHYLD]

That shit is crazy.