3 ms·
Wait sorry, this might be actually critically important. When you say same IP range, what do you mean? The IP that the login attempt happened from starts with
by gregsadetsky 5y ago
Wait sorry, this might be actually critically important.
When you say same IP range, what do you mean? The IP that the login attempt happened from starts with 160.?
If 4 of us (in this thread) all had quasi-successful login attempts to our accounts, it could mean that some LastPass master passwords have been leaked...?? Or LastPass has been compromised?
- emotivehealer 5y agoBegins with 160.116…
- gregsadetsky 5y agoExactly the same here!!!! Wow, this is fantastically bad.
- krebsonsecurity 5y agoThe location supplied by the LastPass notification for these login attempt IPs seems off. E.g., just taking some of the IPs most frequently posted here as sources of master password login attempts: 196.19.204.79 Stated location: India WHOIS: Poland Warszawa Unit 117, Seychelles (Legacy) AFRINIC AS202769 COOP, US 160.116.206.37 Stated location: Germany WHOIS: Affiliated Computing Services, South Africa AFRINIC AS262287 Maxihost LTD, BR 168.81.122.153 Stated location: Germany WHOIS: Seychelles AFRINIC 202769 COOP, US Someone is probably putting bogus information into the routes for these IP ranges. But what do all of these IPs have in common? According to my records, they are all related to a dodgy hosting provider in the Netherlands called Ecatel, now called Qasi Networks or IP Volume. And this is all disputed AFRINIC IP space, as per: https://krebsonsecurity.com/2019/12/the-great-50m-african-ip-address-heist/ https://krebsonsecurity.com/2019/12/the-great-50m-african-ip...
- emotivehealer 5y agoAlso FWIW I too have not used Lastpass for 2-3 years. Login history doesn’t appear to go back that far but I’d estimate it’s at least 2 years since I logged in.