Jump to content

Unknown behavior


Musarano
 Share

Recommended Posts

Hi,

This morning, there were no phone service.. i went to the logs and found this:

Where there was a hostname it only showed the servers IP instead.

Then i restarted the whole windows server, everything got back to normal.

Any ideas?

Thank You

 

Login History
1
Date    User    URL    Address    
3/6/2020 9:25:28 PM        admin    https://myserver/    myserverIP    
3/6/2020 10:58:11 AM    admin    https://myserver/    myserverIP    
3/6/2020 8:41:33 AM        admin    https://myserver/    myserverIP    

3/6/2020 1:10:15 PM        admin    https://x.x.x.x/    x.x.x.x    This two lines were with the IP # and not the host
3/6/2020 1:09:50 PM        admin    https://x.x.x.x/    x.x.x.x    **** Wtho line is RED COLORED ****

3/5/2020 1:22:20 PM        admin    https://myserver/    myserverIP    
3/5/2020 4:10:26 AM        admin    https://myserver/    myserverIP    
3/5/2020 4:10:02 AM        admin    https://myserver/    myserverIP    
3/5/2020 4:07:01 AM        admin    https://myserver/    myserverIP    
3/5/2020 4:01:29 AM        admin    https://myserver/    myserverIP    
3/3/2020 11:26:53 AM    admin    https://myserver/    myserverIP    
3/1/2020 11:46:24 AM    admin    https://myserver/    myserverIP    
2/26/2020 10:00:11 AM    admin    https://myserver/    myserverIP    
2/25/2020 11:22:37 PM    admin    https://myserver/    myserverIP    
2/25/2020 11:50:41 AM    admin    https://myserver/    myserverIP    
2/25/2020 11:28:24 AM    admin    https://myserver/    myserverIP    
2/25/2020 10:50:42 AM    admin    https://myserver/    myserverIP    
2/25/2020 2:15:52 AM    admin    https://myserver/    myserverIP    
2/25/2020 2:04:54 AM    admin    https://myserver/    myserverIP    
2/25/2020 1:18:32 AM    admin    https://myserver/    myserverIP    
2/24/2020 9:51:47 AM    admin    https://myserver/    myserverIP

Link to comment
Share on other sites

Well that means someone was trying to log in - but did not have the right password. You can see from what IP address. This is a reminder to make sure that you have a reasonably good password on the server. If you like, you can also restrict from what IP addresses the admin can log in.

Link to comment
Share on other sites

Humm interesting...

Because myserver and myserverIP were the same, does this means someone was trying to loging from withing the server?

I check the windows logs and didnt find a login in to windows,.. but some attacks,...

I will keep an eye on this.  And appreciated your help!

 

-Musarano.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

×
×
  • Create New...