2

yesterday, when I tried to log into my Drupal 7 site with my admin account, I was informed that there had been to many incorrect login attempts with this account and that therefor I have to wait some time before I'm able to log in again. I checked with all other persons who have the credentials and all told me, that they didn't log in recently or had had any issue with providing the correct credentials.

I then checked the "flood" table and found several entries regarding failed user login attempts from the IP 127.0.0.54. Now that gives me pause. That address should be part of the local network. Does anyone have an idea what could be the cause of this?

  • Which version of Drupal core? Is it 7.38? – Pierre.Vriens Jul 9 '15 at 6:04
  • Local user without login credentials tried to brute-force admin pw? – Free Radical Jul 9 '15 at 6:20
  • @Pierre.Vriens Drupal core version is 7.38. A brute force attempt is what I think as well, but the source IP address is what I find strange. May it be that the local network is compromised? – DerpMeister Jul 9 '15 at 19:33
  • Try to locate the source of 127.0.0.54. Are you able to setup a trace to this point? It is a local address but somebody should have it :-) – Justme Jun 15 '18 at 19:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.