Jump to content
Vodia PBX forum
Musarano

Unknown behavior

Recommended Posts

Hi,

This morning, there were no phone service.. i went to the logs and found this:

Where there was a hostname it only showed the servers IP instead.

Then i restarted the whole windows server, everything got back to normal.

Any ideas?

Thank You

 

Login History
1
Date    User    URL    Address    
3/6/2020 9:25:28 PM        admin    https://myserver/    myserverIP    
3/6/2020 10:58:11 AM    admin    https://myserver/    myserverIP    
3/6/2020 8:41:33 AM        admin    https://myserver/    myserverIP    

3/6/2020 1:10:15 PM        admin    https://x.x.x.x/    x.x.x.x    This two lines were with the IP # and not the host
3/6/2020 1:09:50 PM        admin    https://x.x.x.x/    x.x.x.x    **** Wtho line is RED COLORED ****

3/5/2020 1:22:20 PM        admin    https://myserver/    myserverIP    
3/5/2020 4:10:26 AM        admin    https://myserver/    myserverIP    
3/5/2020 4:10:02 AM        admin    https://myserver/    myserverIP    
3/5/2020 4:07:01 AM        admin    https://myserver/    myserverIP    
3/5/2020 4:01:29 AM        admin    https://myserver/    myserverIP    
3/3/2020 11:26:53 AM    admin    https://myserver/    myserverIP    
3/1/2020 11:46:24 AM    admin    https://myserver/    myserverIP    
2/26/2020 10:00:11 AM    admin    https://myserver/    myserverIP    
2/25/2020 11:22:37 PM    admin    https://myserver/    myserverIP    
2/25/2020 11:50:41 AM    admin    https://myserver/    myserverIP    
2/25/2020 11:28:24 AM    admin    https://myserver/    myserverIP    
2/25/2020 10:50:42 AM    admin    https://myserver/    myserverIP    
2/25/2020 2:15:52 AM    admin    https://myserver/    myserverIP    
2/25/2020 2:04:54 AM    admin    https://myserver/    myserverIP    
2/25/2020 1:18:32 AM    admin    https://myserver/    myserverIP    
2/24/2020 9:51:47 AM    admin    https://myserver/    myserverIP

Share this post


Link to post
Share on other sites

Well that means someone was trying to log in - but did not have the right password. You can see from what IP address. This is a reminder to make sure that you have a reasonably good password on the server. If you like, you can also restrict from what IP addresses the admin can log in.

Share this post


Link to post
Share on other sites

Humm interesting...

Because myserver and myserverIP were the same, does this means someone was trying to loging from withing the server?

I check the windows logs and didnt find a login in to windows,.. but some attacks,...

I will keep an eye on this.  And appreciated your help!

 

-Musarano.

Share this post


Link to post
Share on other sites

If you are using a browser on your own server then you will see something like 127.0.0.1 or ::1. That is normal. Typically attacks come from some anonymous addresses, e.g. dark net and are physically far away.

Share this post


Link to post
Share on other sites

Thank You for the TIP, im now more comfortable.

PS: Im seen my own public IP instead of the 127.0.0.1, but i believe it is about the same..

(Y)

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...

×
×
  • Create New...