• Resolved hastibe

    (@hastibe)


    Starting 1/20/20, I’ve begun seeing lots of failed attempts to log-in as “admin” on the Login Transactions Report, followed by a legitimate user successfully logging-in from the same IP address. What could be going on here?

Viewing 7 replies - 1 through 7 (of 7 total)
  • Plugin Author miniOrange

    (@cyberlord92)

    Hi @hastibe,

    Thank you for your query.

    Can you check the IP used to access the “admin”? Are they all from the same IP?
    One possibility is that your team/internal users are trying to access the admin account from the same network. Can you please confirm that?

    If that is not the case, Can you send a query from the support form in the plugin so that we can help you with it?

    Waiting to hear back from you.

    Thank You.

    • This reply was modified 6 years, 2 months ago by miniOrange.
    Thread Starter hastibe

    (@hastibe)

    It’s always a series of failed attempts at logging-in as “admin” and then a (legitimate) successful attempt at logging-in as a user, all from the same IP.

    Then, it will happen again from a different IP address: a series of failed attempts at logging-in as “admin” and then a (legitimate) successful attempt at logging-in as another user, also all from the same IP address (though a different IP address than before).

    …And this repeats and repeats.

    I can confirm that our users are not trying to log-in as “admin”, but are legitimately logging-in under their username in the successful attempt.

    It looks like some sort of logging bug to me, and I will send a query from the support form in the plugin.

    Plugin Author miniOrange

    (@cyberlord92)

    Did you send us an query? Can you check the passwords for these users. If they are not strong please ask them to change and keep a stronger one.

    Then we can also take a look once you contact us.

    Thank You.

    Thread Starter hastibe

    (@hastibe)

    @cyberlord92 – thanks for following-up. We haven’t been able to send a query yet; we also haven’t seen the issue occur since we posted, so we are just continuing to monitor at this point. Again, the users’ accounts haven’t been compromised, so no concerns that way; possibly some conflict with another plugin causing the logging errors.

    Plugin Author miniOrange

    (@cyberlord92)

    If you want send query from the plugin anytime you want.

    It is good to hear that you are not facing this issue. As you are monitoring, let me know if you face it again. Regarding plugin conflict, It it was plugin conflict the issue should have persisted unless you disabled any plugin. Please let us know the plugins you use whenever you send a query to miniOrange.

    Thank You.

    Thread Starter hastibe

    (@hastibe)

    @cyberlord92 — just updated plugin, and can no longer find most of its features. What happened to the Login Transactions Report, settings to limit brute force attacks, etc.?

    Plugin Author miniOrange

    (@cyberlord92)

    Hi @hastibe,

    I think your issue is resolved. Let us know if face any issues.

    Thank You.

Viewing 7 replies - 1 through 7 (of 7 total)

The topic ‘Lots of failed “admin” log-in attempts followed by user log-in from same IP’ is closed to new replies.