My account is being hacked?

[paul]

Its happened again,  four emails with “Failed Login Attempt”.

Three users with the same ip address, followed by seven users the next day with a different ip address.
However the user names are not found when I “search for members” so I guess the users accounts have already been blocked / deleted  ?

The user names were mostly random letters (again) and the ip addresses are 45.88.82.128 and 195.208.119.20

[MrMobodies]

Just noticed HPIB's country flag is showing Czech Republic and the IP address is assigned to Czech ISP MagnaLink and DDT has a British flag which is a long way away assuming they are in their respective countries according to flag they set.

https://whois.domaintools.com/188.122.198.84

IP Location   Czech Republic Czech Republic Hradec Kralove Magnalink A.s.
ASN   Czech Republic AS57728 HELIOSMB-AS, CZ (registered Oct 21, 2019)
Resolve Host   host84-198-122-188.magnalink.cz
Whois Server   whois.ripe.net
IP Address   188.122.198.84

[bson]

Many internet providers and most cellular network providers these days use carrier grade NAT (CG-NAT) on their IPv4 address space. This means that you could be sharing an IP address between multiple users. There just isn't enough IPv4 addresses to go around so that everyone has their own unique address (even if it's dynamically assigned).

It could also be a bug in the forum software.  If I try to login in as you, will it associate my address with your account?  It shouldn't, but if it does it would result in exactly these messages if someone is trying guess passwords for a large number of users.

[EEVblog]

Its happened again,  four emails with “Failed Login Attempt”.

Three users with the same ip address, followed by seven users the next day with a different ip address.
However the user names are not found when I “search for members” so I guess the users accounts have already been blocked / deleted  ?

The user names were mostly random letters (again) and the ip addresses are 45.88.82.128 and 195.208.119.20

A couple of people have mentioned this recently.
I presume it's just spam bots randomly attacking account.

[timbob]

Just got and email about failed login today while was at work

[Andy Chee]

I imagine it's a data scraper bot that is harvesting the thread subheader, for example:

DimitriP, Gertjan, mk_, darkspr1te, BennoG, RJSV, JMK, slavoy, Kim Christensen, djsb, coppercone2 and 183 Guests are viewing this board.

So a single bot machine (which explains the common IP address) located in India, Russia, North Korea, could scrape this list of names, and tryout some obvious passwords.

There's probably a bot just sitting on the Test Equipment forum (biggest forum) just scraping away.