• Our team is looking to connect with folks who use email services provided by Plesk, or a premium service. If you'd like to be part of the discovery process and share your experiences, we invite you to complete this short screening survey. If your responses match the persona we are looking for, you'll receive a link to schedule a call at your convenience. We look forward to hearing from you!
  • We are looking for U.S.-based freelancer or agency working with SEO or WordPress for a quick 30-min interviews to gather feedback on XOVI, a successful German SEO tool we’re looking to launch in the U.S.
    If you qualify and participate, you’ll receive a $30 Amazon gift card as a thank-you. Please apply here. Thanks for helping shape a better SEO product for agencies!
  • The BIND DNS server has already been deprecated and removed from Plesk for Windows.
    If a Plesk for Windows server is still using BIND, the upgrade to Plesk Obsidian 18.0.70 will be unavailable until the administrator switches the DNS server to Microsoft DNS. We strongly recommend transitioning to Microsoft DNS within the next 6 weeks, before the Plesk 18.0.70 release.
  • The Horde component is removed from Plesk Installer. We recommend switching to another webmail software supported in Plesk.

Resolved Can i know what happend to my server? somany CP User Login Attempt Failed

N

nightstalker

New Pleskian
I am getting non stop messages like this :

162.158.239.7 [2024-01-21 23:09:19] 'CP User Login Attempt Failed' ('Login Name': 'ZMskyuza' => '')
162.158.239.7 [2024-01-21 23:09:21] 'CP User Login Attempt Failed' ('Login Name': 'ZMskyuza' => '')
162.158.239.8 [2024-01-21 23:09:24] 'CP User Login Attempt Failed' ('Login Name': 'ZMskyuza' => '')
162.158.239.8 [2024-01-21 23:09:26] 'CP User Login Attempt Failed' ('Login Name': 'ZMskyuza' => '')
162.158.238.243 [2024-01-21 23:09:28] 'CP User Login Attempt Failed' ('Login Name': 'ZMskyuza' => '')
162.158.238.39 [2024-01-21 23:09:29] 'Password reset request' ('Login Name': '' => 'tGhYxqFm', 'Reset using': '' => 'Username')
162.158.238.253 [2024-01-21 23:09:29] 'Password reset request' ('Login Name': '' => 'tGhYxqFm', 'Reset using': '' => 'Username')
162.158.238.253 [2024-01-21 23:09:29] 'Password reset request' ('Login Name': '' => 'tGhYxqFm', 'Reset using': '' => 'Username')
162.158.239.22 [2024-01-21 23:09:30] 'CP User Login Attempt Failed' ('Login Name': 'ZMskyuza' => '')
162.158.239.8 [2024-01-21 23:09:33] 'CP User Login Attempt Failed' ('Login Name': 'ZMskyuza' => '')
162.158.239.8 [2024-01-21 23:09:35] 'CP User Login Attempt Failed' ('Login Name': 'ZMskyuza' => '')
162.158.239.7 [2024-01-21 23:09:37] 'CP User Login Attempt Failed' ('Login Name': 'ZMskyuza' => '')
162.158.222.101 [2024-01-21 23:09:40] 'CP User Login Attempt Failed' ('Login Name': 'ZMskyuza' => '')
162.158.239.7 [2024-01-21 23:09:42] 'CP User Login Attempt Failed' ('Login Name': 'ZMskyuza' => '')
162.158.239.21 [2024-01-21 23:09:44] 'CP User Login Attempt Failed' ('Login Name': 'ZMskyuza' => '')
162.158.239.8 [2024-01-21 23:09:46] 'CP User Login Attempt Failed' ('Login Name': 'ZMskyuza' => '')
162.158.239.8 [2024-01-21 23:09:48] 'CP User Login Attempt Failed' ('Login Name': 'ZMskyuza' => '')
162.158.238.243 [2024-01-21 23:09:51] 'CP User Login Attempt Failed' ('Login Name': 'ZMskyuza' => '')
162.158.239.22 [2024-01-21 23:09:53] 'CP User Login Attempt Failed' ('Login Name': 'ZMskyuza' => '')
162.158.239.8 [2024-01-21 23:09:55] 'CP User Login Attempt Failed' ('Login Name': 'ZMskyuza' => '')



Can i know what exactly is this? and how to solve this..thank you
 
Peter Debik said:
Please consider enabling the Fail2Ban "plesk-panel" jail to protect your server from brute force login attempts.
Click to expand...
Thank you very much!

I've enabled it as shown in the image below. Are these settings sufficient, or do I need to make any further changes?

Will enabling fail2ban affect the Google bot ( i read it some where ) ? Please let me know. Thanks."

1705907203537.png
 
Kaspar said:
I recommend increasing the Time interval to 1800 seconds.


No, it will not affect Google bot.
Click to expand...
Thank you, sure, will change time interval to 1800 seconds.


Here is the some more logs. just incase..

----------------------------------------------------------------------------------------------------------------------------------
----------------------------------------------------------------------------------------------------------------------------------
162.158.238.232 [2024-01-21 23:13:13] 'Password reset request' ('Login Name': '' => 'ZMskyuza', 'Reset using': '' => 'Username')
162.158.239.8 [2024-01-21 23:13:15] 'Password reset request' ('Login Name': '' => 'ZMskyuza', 'Reset using': '' => 'Username')
162.158.238.232 [2024-01-21 23:13:17] 'Password reset request' ('Login Name': '' => 'if(now()=sysdate(),sleep(15),0)', 'Reset using': '' => 'Username')
162.158.239.8 [2024-01-21 23:13:19] 'Password reset request' ('Login Name': '' => '0\'XOR(if(now()=sysdate(),sleep(15),0))XOR\'Z', 'Reset using': '' => 'Username')
162.158.238.232 [2024-01-21 23:13:21] 'Password reset request' ('Login Name': '' => '0\"XOR(if(now()=sysdate(),sleep(15),0))XOR\"Z', 'Reset using': '' => 'Username')
162.158.239.8 [2024-01-21 23:13:22] 'Password reset request' ('Login Name': '' => '(select(0)from(select(sleep(15)))v)/*\'+(select(0)from(select(sleep(15)))v)+\'\"+(select(0)from(select(sleep(15)))v)+\"*/', 'Reset using': '' => 'Username')
162.158.238.232 [2024-01-21 23:13:24] 'Password reset request' ('Login Name': '' => '1 waitfor delay \'0:0:15\' -- ', 'Reset using': '' => 'Username')
162.158.239.8 [2024-01-21 23:13:26] 'Password reset request' ('Login Name': '' => 'hG0hwwuL\'; waitfor delay \'0:0:15\' -- ', 'Reset using': '' => 'Username')
162.158.238.232 [2024-01-21 23:13:27] 'Password reset request' ('Login Name': '' => 'QniIW1Su\' OR 356=(SELECT 356 FROM PG_SLEEP(15))--', 'Reset using': '' => 'Username')
162.158.239.8 [2024-01-21 23:13:29] 'Password reset request' ('Login Name': '' => 'SUCYsZFT\') OR 965=(SELECT 965 FROM PG_SLEEP(15))--', 'Reset using': '' => 'Username')
162.158.238.233 [2024-01-21 23:13:31] 'Password reset request' ('Login Name': '' => 'Wt7CAgcq\')) OR 169=(SELECT 169 FROM PG_SLEEP(15))--', 'Reset using': '' => 'Username')
162.158.239.7 [2024-01-21 23:13:32] 'Password reset request' ('Login Name': '' => 'ZMskyuza\'||DBMS_PIPE.RECEIVE_MESSAGE(CHR(98)||CHR(98)||CHR(98),15)||\'', 'Reset using': '' => 'Username')

----------------------------------------------------------------------------------------------------------------------------------
----------------------------------------------------------------------------------------------------------------------------------

can you please check this status- as all are active - make sure - its not blocking google bot. thank you.

1705911003792.png



Thank you very much,
 
You must log in or register to reply here.

Similar threads

Lexz
Resolved 'CP User Login Attempt via API Failed' ('Login Name': '<invalid>' => '')
Replies
3
Views
1K
Lexz
Lexz
TimReeves
Fail2Ban Jail needed for /var/log/sw-cp-server/error_log
Replies
5
Views
7K
roon
R
M
Question fail2ban, can I ban visitors with no user agent?
Replies
1
Views
1K
Kaspar@Plesk
Kaspar@Plesk
P
Forwarded to devs Event 'CP User Login' triggered despite invalid additional authentication step (MFA)
Replies
2
Views
1K
Kaspar@Plesk
Kaspar@Plesk
bradz
Issue Pleask/Linux Server Goes Down & Restarts a Few Times Weekly on Sunday Morning
Replies
8
Views
3K
mow
M
Back
Top