3 ms·
Yeah me too. Same IP range too, but location listed as Toronto. Not that this means anything.
by emotivehealer 5y ago
Yeah me too. Same IP range too, but location listed as Toronto. Not that this means anything.
- gregsadetsky 5y agoWait sorry, this might be actually critically important. When you say same IP range, what do you mean? The IP that the login attempt happened from starts with 160.? If 4 of us (in this thread) all had quasi-successful login attempts to our accounts, it could mean that some LastPass master passwords have been leaked...?? Or LastPass has been compromised?
- emotivehealer 5y agoBegins with 160.116…
- gregsadetsky 5y agoExactly the same here!!!! Wow, this is fantastically bad.
- krebsonsecurity 5y agoThe location supplied by the LastPass notification for these login attempt IPs seems off. E.g., just taking some of the IPs most frequently posted here as sources of master password login attempts: 196.19.204.79 Stated location: India WHOIS: Poland Warszawa Unit 117, Seychelles (Legacy) AFRINIC AS202769 COOP, US 160.116.206.37 Stated location: Germany WHOIS: Affiliated Computing Services, South Africa AFRINIC AS262287 Maxihost LTD, BR 168.81.122.153 Stated location: Germany WHOIS: Seychelles AFRINIC 202769 COOP, US Someone is probably putting bogus information into the routes for these IP ranges. But what do all of these IPs have in common? According to my records, they are all related to a dodgy hosting provider in the Netherlands called Ecatel, now called Qasi Networks or IP Volume. And this is all disputed AFRINIC IP space, as per: https://krebsonsecurity.com/2019/12/the-great-50m-african-ip-address-heist/ https://krebsonsecurity.com/2019/12/the-great-50m-african-ip...
- emotivehealer 5y agoAlso FWIW I too have not used Lastpass for 2-3 years. Login history doesn’t appear to go back that far but I’d estimate it’s at least 2 years since I logged in.
- Dma54rhs 5y agoMore data (mine as well): Monday, December 27, 2021 at 12:27 PM EST Location INDIA IP address 196.19.204.79