9 responses on “Thanking all the Hackers”

1. Werner January 7, 2016 at 11:00 am

   You are not alone!

   2 2016/01/07 14:56:03 admin LOGIN_FAIL 46.148.18.162
   3 2016/01/07 11:09:06 admin LOGIN_FAIL 46.148.18.162
   4 2016/01/07 07:23:12 admin LOGIN_FAIL 46.148.18.162
   5 2016/01/07 03:44:36 admin LOGIN_FAIL 46.148.18.162
   6 2016/01/07 00:09:10 admin LOGIN_FAIL 46.148.18.162
   7 2016/01/06 21:02:33 admin LOGIN_FAIL 46.148.22.18
   8 2016/01/06 20:00:08 admin LOGIN_FAIL 46.148.18.162
   9 2016/01/06 16:58:54 admin LOGIN_FAIL 46.148.22.18
   10 2016/01/06 15:24:49 admin LOGIN_FAIL 46.148.18.162
   11 2016/01/06 13:01:19 admin LOGIN_FAIL 46.148.22.18
   12 2016/01/06 10:52:20 admin LOGIN_FAIL 46.148.18.162
   13 2016/01/06 09:11:13 admin LOGIN_FAIL 46.148.22.18
   14 2016/01/06 06:32:40 admin LOGIN_FAIL 46.148.18.162
   15 2016/01/06 05:26:36 admin LOGIN_FAIL 46.148.22.18
   16 2016/01/06 02:11:21 admin LOGIN_FAIL 46.148.18.162
   17 2016/01/06 01:29:00 admin LOGIN_FAIL 46.148.22.18
   18 2016/01/05 21:27:37 admin LOGIN_FAIL 46.148.18.162
   19 2016/01/05 21:00:49 admin LOGIN_FAIL 46.148.22.18
   20 2016/01/05 16:19:00 admin LOGIN_FAIL 46.148.22.18
   21 2016/01/05 15:58:44 admin LOGIN_FAIL 46.148.18.162
   22 2016/01/05 12:14:44 admin LOGIN_FAIL 46.148.18.162
   23 2016/01/05 08:51:06 admin LOGIN_FAIL 46.148.22.18

   and so on..
   1. Daniel Pineault Post authorJanuary 7, 2016 at 9:22 pm

      I actually sent an e-mail to the abuse e-mail associated with that IP address, but so far nothing. As I said, Host & Registrars for the most part just see $$$ signs and don’t truly want to halt such people.
2. Säge Null February 29, 2016 at 7:54 am

   They don’t want to “find” anything, but send Spam via your server and the backdoored WP instance…
   1. Daniel Pineault Post authorFebruary 29, 2016 at 9:29 am

      Although, I do agree they want to use other people’s servers to send out mass amounts of SPAM, they also want any information they can get their hands on. We live in the digital age and any information = $$$. They sell everything; e-mail address lists, credit card information, user accounts, …

      But your primary reasoning is very valid! They are most probably trying to simply hack the server to primarily send out more SPAM.

      Even if they do manage, these servers are throttled, so they would quickly hit the maximum allowable number of e-mails!

      Too bad they don’t put these same energies into improving the world instead of destroying it.
3. Abaraxas November 14, 2016 at 11:55 am

   Hackers associated with IPs associated with ponytelecom.eu (a fake company) have been hitting our site hard the past few days, exactly as you described here and on your list. The last two days, all the IPs are in the range of 163.172.66.*

   They just brought down a similar site to ours, Democraticunderground.com, talking to their admin, they are seeing the same IP range.
4. Aston Boston November 29, 2016 at 9:40 am

   If you get hacking attempts from same IP over and over, why don’t you permanently block in your firewall?
   If you are not server administrator, ask the administrator to block the IP. If administrator refuses or will not respond to your request, its time to move on and find a proper hosting company.
   1. Daniel Pineault Post authorNovember 30, 2016 at 10:42 am

      Way ahead of you! Regardless of all the steps one takes (blocking IPs, …) hackers are always changing domains, IPs so it’s a never ending game of cat and mouse. You can do everything in your power and still be victim.

      With VPN hacker rotate their IP in a second and continue hacking, over and over.

      Also, with most websites today, you don’t even need to bother your host as WordPress, Joomla, et al. all have various extensions that can automatically block IP and take step to try and secure things as best they can.
5. M.devries November 23, 2017 at 1:42 am

   Use fail2ban to automatic block.
6. M.devries November 23, 2017 at 1:56 am

   How to ….. block all those punks !!!! See below …

   Check IP adresses at: (To block the complete range)

   http://www.poneytelecom.eu/
   https://www.tcpiputils.com/browse/ip-address/62.210.151.49
   Block ALL poneytelecom.eu Lots of hacking attempts !!!

   Iptables (Linux firewall) Command to block

   iptables -A INPUT -s 62.210.0.0/16 -j DROP
   iptables -A INPUT -s 195.154.0.0/16 -j DROP
   iptables -A INPUT -s 212.129.0.0/18 -j DROP
   iptables -A INPUT -s 212.129.0.0/18 -j DROP
   iptables -A INPUT -s 62.4.0.0/19 -j DROP
   iptables -A INPUT -s 212.83.128.0/19 -j DROP
   iptables -A INPUT -s 212.83.160.0/19 -j DROP
   iptables -A INPUT -s 212.47.224.0/19 -j DROP
   iptables -A INPUT -s 163.172.0.0/16 -j DROP
   iptables -A INPUT -s 51.15.0.0/16 -j DROP
   iptables -A INPUT -s 151.115.0.0/16 -j DROP

   service iptables save (Save rules) Redhat and centos