Odd Persistent Password Bruteforcing

Published: 2014-09-07
Last Updated: 2014-09-07 23:43:02 UTC
by Johannes Ullrich (Version: 1)
6 comment(s)

This isn't something new, but I think it is often overlooked: "slow and low" password brute forcing.

One of the daily reports I like to look at is password brute force attempts. more or less "forever", A few networks stick out in these daily reports. The password brute force attempts are not particularly agressive, with usually less then 10 attempts per day from any particular IP address. The other odd thing is that the accounts being brute forced don't exist, which a heave focus on "@hotmail.com" accounts. 

By far the most agressive network is,"Besthosting" in the Ukraine, followed by an other Ukraining network, (Steephost). 

The top brute forced domains:

    zfymail.com <- this domain is associated with many bots/spam messages.

The intend isn't perfectly clear as the accounts don't exist, and the attempts are not very aggressive (maybe to avoid getting locked out?). 

Anybody observing similar attacks and able to figure out what they are after?


Johannes B. Ullrich, Ph.D.

Keywords: brute force ukraine
6 comment(s)


Which service are they going after? I'm guessing SMTP/POP3/IMAP?
I have checked through some of our logs, and am seeing traffic from the 91.207.7. network on udp/1033 and udp/14482. Pattern is 2 tries per hour within about 30 seconds of each other.
You mentioned in this morning's podcast you used various scripts to scan you server logs. Are any of these something you would share? I'm assuming that you grep the logs with some regex's.

I too am seeing a very low/slow use of these IPs on my secure web server. The IP was active for about 20 connection attempts back from May 28th to June 18th. The IP range saw about 205 attempts from June 25th to September 4th using several IPs. All activity was to port 80 and nothing "upset" my IPS to cause it to capture packets.
Besides "slow and low", "distributed" type brute force attacks are common for the WordPress websites we hosts, i.e. 3-4 login attempts from each source IP.

Few ways to mitigate: captcha, 2FA and geo-blocking.
Geo-blocking was very effective for us; we limit the login page to our country IP range only.
This works because we are not in a big country such as US or Russia
Someone on Reddit mentioned experiencing a similar attack but they found that the person was looking for accounts that may have migrated email addresses while retaining the same password. Basically they had an old credentials list and what they were doing is substituting more popular / modern email providers with the same username. Surprisingly the script kiddie was having some success with the list.


Diary Archives