Bitcoin Forum

Economy => Service Discussion => Topic started by: btctalk on September 25, 2013, 06:48:32 AM



Title: Who is fuzzing blockchain.info users? [HACK ATTEMP]
Post by: btctalk on September 25, 2013, 06:48:32 AM
I had this in mind a while ago but I guess someone finally did this.

Today I received an email saying:

Quote
Authorize log-in attempt

An attempt to login to your blockchain.info wallet was made from an unknown browser. Please confirm the following details are correct:

Time: 2013-09-25 03:16:43
IP Address: 23.29.121.166 (United States)
User Agent: Python-urllib/2.7

It's a while that I haven't used my blockchain.info wallet in any forms (chrome plugin, mobile app, etc)
As the Python-urllib says, it's a script doing this login from a probably proxy with the specified ip.

something fishy is going on in shirt! secure your accounts ;)


Title: Re: Who is fuzzing blockchain.info users? [HACK ATTEMP]
Post by: pajak666 on September 25, 2013, 10:13:13 AM
my friend has 0.56 btc stolen from his account today
with this transaction
https://blockchain.info/pl/tx/79adb6e96a6a34017bbd02b4e521ec2a052e219a376210bfc04cf4598cd3c40a


Title: Re: Who is fuzzing blockchain.info users? [HACK ATTEMP]
Post by: bitcoin44me on September 25, 2013, 11:08:35 AM
That could be a bot, or anyone in the world. Just do not click on the link and remove it from your mailbox.


Title: Re: Who is fuzzing blockchain.info users? [HACK ATTEMP]
Post by: btctalk on September 27, 2013, 10:45:08 PM
That could be a bot, or anyone in the world. Just do not click on the link and remove it from your mailbox.

either it's a bot or anyone it is trying to login in my account. and the useragent shows that it's by python so it's probably a large scale hack attempt.


I got another one last night too

Quote
Time: 2013-09-27 07:09:21
IP Address: 96.44.189.101 (United States)
User Agent: Python-urllib/2.7


Title: Re: Who is fuzzing blockchain.info users? [HACK ATTEMP]
Post by: DobZombie on September 28, 2013, 02:08:11 PM
me too!

Quote
Time: 2013-09-28 13:00:14
IP Address: 74.120.13.132 (Anonymous Proxy)
User Agent: Python-urllib/2.7


Title: Re: Who is fuzzing blockchain.info users? [HACK ATTEMP]
Post by: marcovaldo on September 28, 2013, 02:22:33 PM
That could be a bot, or anyone in the world. Just do not click on the link and remove it from your mailbox.

either it's a bot or anyone it is trying to login in my account. and the useragent shows that it's by python so it's probably a large scale hack attempt.


I got another one last night too

Quote
Time: 2013-09-27 07:09:21
IP Address: 96.44.189.101 (United States)
User Agent: Python-urllib/2.7


It does not matter at all, unless your email is compromised and they can click on the link ....


Title: Re: Who is fuzzing blockchain.info users? [HACK ATTEMP]
Post by: vm1990 on September 28, 2013, 02:40:01 PM
this has been going on for a while. someone will be trying top brute force accounts, people with simple passwords like 12345 are pretty screwed or if you password is in a dictionary.. pretty easy to think of a slightly complex password but the hacker only has to get access to 1 or 2 accounts with BTC in them to make it worth his time..

simple rules are
dont be stupid and use a password like Dave or Bob (you use these kinds of passwords then you deserve to get your money taken)
make sure emails arnt scam emails and that you log into the correct site not a clone