weird login entry

[Raiu]

Were they able to log in
n 5 00:27:53 HTTP login: Detect abnormal logins at 5 times. The newest one was from 199.182.166.154.
Jun 5 00:27:54 HTTP login: Detect abnormal logins at 10 times. The newest one was from 199.182.166.154.
Jun 5 00:27:55 HTTP login: Detect abnormal logins at 15 times. The newest one was from 199.182.166.154.
Jun 5 00:27:55 HTTP login: Detect abnormal logins at 20 times. The newest one was from 199.182.166.154.
Jun 5 00:27:56 HTTP login: Detect abnormal logins at 25 times. The newest one was from 199.182.166.154.
Jun 5 00:27:57 HTTP login: Detect abnormal logins at 30 times. The newest one was from 199.182.166.154.
Jun 5 00:27:58 HTTP login: Detect abnormal logins at 35 times. The newest one was from 199.182.166.154.
Jun 5 00:27:59 HTTP login: Detect abnormal logins at 40 times. The newest one was from 199.182.166.154.
Jun 5 00:28:00 HTTP login: Detect abnormal logins at 45 times. The newest one was from 199.182.166.154.
Jun 5 00:28:01 HTTP login: Detect abnormal logins at 50 times. The newest one was from 199.182.166.154.
Jun 5 00:28:02 HTTP login: Detect abnormal logins at 55 times. The newest one was from 199.182.166.154.
Jun 5 00:28:02 HTTP login: Detect abnormal logins at 60 times. The newest one was from 199.182.166.154.
Jun 5 00:28:03 HTTP login: Detect abnormal logins at 65 times. The newest one was from 199.182.166.154.

 

[RMerlin]

Were they able to log in
n 5 00:27:53 HTTP login: Detect abnormal logins at 5 times. The newest one was from 199.182.166.154.
Jun 5 00:27:54 HTTP login: Detect abnormal logins at 10 times. The newest one was from 199.182.166.154.
Jun 5 00:27:55 HTTP login: Detect abnormal logins at 15 times. The newest one was from 199.182.166.154.
Jun 5 00:27:55 HTTP login: Detect abnormal logins at 20 times. The newest one was from 199.182.166.154.
Jun 5 00:27:56 HTTP login: Detect abnormal logins at 25 times. The newest one was from 199.182.166.154.
Jun 5 00:27:57 HTTP login: Detect abnormal logins at 30 times. The newest one was from 199.182.166.154.
Jun 5 00:27:58 HTTP login: Detect abnormal logins at 35 times. The newest one was from 199.182.166.154.
Jun 5 00:27:59 HTTP login: Detect abnormal logins at 40 times. The newest one was from 199.182.166.154.
Jun 5 00:28:00 HTTP login: Detect abnormal logins at 45 times. The newest one was from 199.182.166.154.
Jun 5 00:28:01 HTTP login: Detect abnormal logins at 50 times. The newest one was from 199.182.166.154.
Jun 5 00:28:02 HTTP login: Detect abnormal logins at 55 times. The newest one was from 199.182.166.154.
Jun 5 00:28:02 HTTP login: Detect abnormal logins at 60 times. The newest one was from 199.182.166.154.
Jun 5 00:28:03 HTTP login: Detect abnormal logins at 65 times. The newest one was from 199.182.166.154.

Opening the web interface over WAN is a bad idea.

 

[Raiu]

Opening the web interface over WAN is a bad idea.

I know, we were having connection issues so I had it open so could admin in to fix it remotely. Does this mean they were able to log in? I went in a disabled it and changed my log in info so I should be good now even if they were??

 

[netware5]

As Merlin said opening the web interface to WAN is a bad idea. But if you really need it, do it by https not by http.

 

[RMerlin]

I know, we were having connection issues so I had it open so could admin in to fix it remotely. Does this mean they were able to log in? I went in a disabled it and changed my log in info so I should be good now even if they were??

No clue, the log does not report if the user succeeded to log in.

Change your password just in case.

 

[Raiu]

No clue, the log does not report if the user succeeded to log in.

Change your password just in case.

I def didn't leave the password and usuer name as default so there is hopefully some security in that I hope. I did change it. I'm just conserned that they have gained access to my ip cams. So I changed the password to the log in on them. If they did get access then they have a copy of the open vpn client how do I change the info in that other then the passwords for the log in accounts is that enough?

 

[RMerlin]

I def didn't leave the password and usuer name as default so there is hopefully some security in that I hope. I did change it. I'm just conserned that they have gained access to my ip cams. So I changed the password to the log in on them. If they did get access then they have a copy of the open vpn client how do I change the info in that other then the passwords for the log in accounts is that enough?

If you are using certificate-based authentication then you should be fine, unless for some reason you kept a copy of the CA signing key on the router itself).

If you are using password-based authentication, then change the client passwords.

 

[ParanoiA]

Edit: nevermind

 

[synaesthesia]

Possibly Software Performing Security Scan

Good Evening,

This may well be caused by some security scanning software performing an audit/check of your network.

Among others Avast performs this function.

Avast causes this to happen on my ASUS AC68U when I performs security checks.

Hope this helps

Nathan