[Jstylezzz]

Hi all

I noticed 2 people, including a friend of mines, are getting the bad RCON attempt message all the time, and it seems to be coming from 1 IP. Now, all I found out is that it's coming from Moscow > Russia, but I can't say wether it's a individual or a network used by people to do these things. I was wondering, are any of you guys experiencing the same? I'm curious because the 2 persons in question are not related to eachother, but the IP and method used by the RCON 'hackers', if you will, are exactly the same.

Check

The first post

And the second one

The server of the second person, is hosted on his own computer, so it's not the case the 'hackers' are bruteforcing on a company or something, I guess..
Now, am I thinking too much and is this just coincidence and shouldn't we pay attention to it, or are more people experiencing this? I haven't seen it myself yet.

(I know this can be solved by turning off the RCON in the server.cfg, but like I said, I just want to check if there are more people facing this.)

(If this post is too irrelevant, moderators, please remove it. Thank you )

EDIT: So now there are four persons in total, confirmed, who are attacked by this IP. Check the post a little further and a post on the second page.

[punklord]

Yeah,Im curious too..Epic Weirdness..Im still getting that BAD RCON LOGIN Msgs... *_*

[Kitten]

Russians. (Ip traced it )

[[L]azy[H]aze]

Yeh happens to me allot

[punklord]

Quote:

Originally Posted by Kefir Yeh happens to me allot

Same I.P?

[kaisersouse]

BLOCK THE IP RANGE AT THE FIREWALL AND BE DONE WITH IT

[[L]azy[H]aze]

Quote:

Originally Posted by PunkLorD Same I.P?

yes the same.

[punklord]

How peculiar indeed?

[Astralis]

2 IP's doin' it all day.

[kaisersouse]

All CIDR ranges for that entire ISP:

Quote:

212.48.128.0/19 89.20.128.0/19 109.170.0.0/17 79.120.0.0/17 213.141.128.0/19 176.192.0.0/14

Block those and they'll have to get a new ISP to continue getting to your server

[[L]azy[H]aze]

Im just going to disable the rcon i don't really use it

[Frede]

I just added rcon 0 to the server config file and it stopped.

[Rayan_black]

Or just to be more sure, ban everyone who tries to do /rcon login (pass) and writes the wrong pass.

[Kwarde]

Quote:

Originally Posted by Rayan_black Or just to be more sure, ban everyone who tries to do /rcon login (pass) and writes the wrong pass.

1- What if you are permitted to use it but you make a typo? It happens to me sometimes that I fail one time.. which would mean I immediately get banned.
2- Also, the rcon login tried are checked by ip; so if there are two players on a server with on IP, who tried to login?

3- Forgot to mention almost; if you have read the post a bit, this is some kind of attack from someone who is NOT in the server (so console login), that's why they are talking about this 'rcon' in server.cfg (and as far as I know, banning a player doesn't ban him (or her :P) from the console)

@kaisersouse: Is it just me or is everyone ignoring you?
Where'd you get the CIDR/ISP info from by the way? Perhaps it might be usefull one day.

[Rayan_black]

Well, I've been using this on my server and it always worked out for our community (COD5).. we never had a problem with tose fucktards.

[kaisersouse]

Quote:

Originally Posted by Kwarde @kaisersouse: Is it just me or is everyone ignoring you? Where'd you get the CIDR/ISP info from by the way? Perhaps it might be usefull one day.

Hey its fine, its info they can choose to use or not. Heres my method:

****** the IP with "myip.ms" (example: "192.168.0.1 myip.ms" )

On the myip.ms site you'll find things like "All owner IP ranges" etc. Those will give you the IP ranges owned by that ISP (in 162.168.0.1 - 192.168.255.255 format)

Use this site to convert IP ranges to CIDR: http://ip2cidr.com/

Block the CIDR ranges.

Notes:
Sometimes myip.ms gives you the CIDR ranges already
Sometimes you have to click on the ISP entry in myip.ms to find all the ranges
Mileage may vary. You may end up not getting all the ranges, some of the ranges might be from another IP, sometimes the ranges are wrong

BIG NOTE: BLOCKING ENTIRE RANGES/GEOIP LOCATIONS IS LAST RESORT. Understand that if you block entire entities, that will prevent GOOD players using the same ISP from connecting to your server.

[JanZ]

Quote:

Originally Posted by kaisersouse Hey its fine, its info they can choose to use or not. Heres my method: ****** the IP with "myip.ms" (example: "192.168.0.1 myip.ms" ) On that site you'll find things like "All owner IP ranges" etc. Those will give you the IP ranges owned by that ISP (in 162.168.0.1 - 192.168.255.255 format) Use this site to convert IP ranges to CIDR: http://ip2cidr.com/ Block the CIDR ranges. Notes: Sometimes myip.ms gives you the CIDR ranges already Sometimes you have to click on the ISP entry in myip.ms to find all the ranges Mileage may vary. You may end up not getting all the ranges, some of the ranges might be from another IP, sometimes the ranges are wrong BIG NOTE: BLOCKING ENTIRE RANGES/GEOIP LOCATIONS IS LAST RESORT. Understand that if you block entire entities, that will prevent GOOD players using the same ISP from connecting to your server.

Quote:

Originally Posted by kaisersouse Hey its fine, its info they can choose to use or not. Heres my method: ****** the IP with "myip.ms" (example: "192.168.0.1 myip.ms" ) On the myip.ms site you'll find things like "All owner IP ranges" etc. Those will give you the IP ranges owned by that ISP (in 162.168.0.1 - 192.168.255.255 format) Use this site to convert IP ranges to CIDR: http://ip2cidr.com/ Block the CIDR ranges. Notes: Sometimes myip.ms gives you the CIDR ranges already Sometimes you have to click on the ISP entry in myip.ms to find all the ranges Mileage may vary. You may end up not getting all the ranges, some of the ranges might be from another IP, sometimes the ranges are wrong BIG NOTE: BLOCKING ENTIRE RANGES/GEOIP LOCATIONS IS LAST RESORT. Understand that if you block entire entities, that will prevent GOOD players using the same ISP from connecting to your server.

Double-post lmao.

[Anak]

the same ip attacks me too..

[Kwarde]

Quote:

Originally Posted by kaisersouse Hey its fine, its info they can choose to use or not. Heres my method: ****** the IP with "myip.ms" (example: "192.168.0.1 myip.ms" ) On the myip.ms site you'll find things like "All owner IP ranges" etc. Those will give you the IP ranges owned by that ISP (in 162.168.0.1 - 192.168.255.255 format) Use this site to convert IP ranges to CIDR: http://ip2cidr.com/ Block the CIDR ranges. Notes: Sometimes myip.ms gives you the CIDR ranges already Sometimes you have to click on the ISP entry in myip.ms to find all the ranges Mileage may vary. You may end up not getting all the ranges, some of the ranges might be from another IP, sometimes the ranges are wrong BIG NOTE: BLOCKING ENTIRE RANGES/GEOIP LOCATIONS IS LAST RESORT. Understand that if you block entire entities, that will prevent GOOD players using the same ISP from connecting to your server.

Thank you very much!