Musarano Posted March 7, 2020 Report Share Posted March 7, 2020 Hi, This morning, there were no phone service.. i went to the logs and found this: Where there was a hostname it only showed the servers IP instead. Then i restarted the whole windows server, everything got back to normal. Any ideas? Thank You Login History 1 Date User URL Address 3/6/2020 9:25:28 PM admin https://myserver/ myserverIP 3/6/2020 10:58:11 AM admin https://myserver/ myserverIP 3/6/2020 8:41:33 AM admin https://myserver/ myserverIP 3/6/2020 1:10:15 PM admin https://x.x.x.x/ x.x.x.x This two lines were with the IP # and not the host3/6/2020 1:09:50 PM admin https://x.x.x.x/ x.x.x.x **** Wtho line is RED COLORED **** 3/5/2020 1:22:20 PM admin https://myserver/ myserverIP 3/5/2020 4:10:26 AM admin https://myserver/ myserverIP 3/5/2020 4:10:02 AM admin https://myserver/ myserverIP 3/5/2020 4:07:01 AM admin https://myserver/ myserverIP 3/5/2020 4:01:29 AM admin https://myserver/ myserverIP 3/3/2020 11:26:53 AM admin https://myserver/ myserverIP 3/1/2020 11:46:24 AM admin https://myserver/ myserverIP 2/26/2020 10:00:11 AM admin https://myserver/ myserverIP 2/25/2020 11:22:37 PM admin https://myserver/ myserverIP 2/25/2020 11:50:41 AM admin https://myserver/ myserverIP 2/25/2020 11:28:24 AM admin https://myserver/ myserverIP 2/25/2020 10:50:42 AM admin https://myserver/ myserverIP 2/25/2020 2:15:52 AM admin https://myserver/ myserverIP 2/25/2020 2:04:54 AM admin https://myserver/ myserverIP 2/25/2020 1:18:32 AM admin https://myserver/ myserverIP 2/24/2020 9:51:47 AM admin https://myserver/ myserverIP Quote Link to comment Share on other sites More sharing options...
Vodia PBX Posted March 8, 2020 Report Share Posted March 8, 2020 Well that means someone was trying to log in - but did not have the right password. You can see from what IP address. This is a reminder to make sure that you have a reasonably good password on the server. If you like, you can also restrict from what IP addresses the admin can log in. Quote Link to comment Share on other sites More sharing options...
Musarano Posted March 8, 2020 Author Report Share Posted March 8, 2020 Humm interesting... Because myserver and myserverIP were the same, does this means someone was trying to loging from withing the server? I check the windows logs and didnt find a login in to windows,.. but some attacks,... I will keep an eye on this. And appreciated your help! -Musarano. Quote Link to comment Share on other sites More sharing options...
Vodia PBX Posted March 9, 2020 Report Share Posted March 9, 2020 If you are using a browser on your own server then you will see something like 127.0.0.1 or ::1. That is normal. Typically attacks come from some anonymous addresses, e.g. dark net and are physically far away. Quote Link to comment Share on other sites More sharing options...
Musarano Posted March 9, 2020 Author Report Share Posted March 9, 2020 Thank You for the TIP, im now more comfortable. PS: Im seen my own public IP instead of the 127.0.0.1, but i believe it is about the same.. (Y) Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.