Pay attention to what was said: the pool servers are fine, they didn't get hacked. The portal, however, is a different story. Wiz is on it.
Wiz: I hope you're logging IP addresses, and have some back logs to troll. I'd be interested in knowing if the jack wagon changing the NMC address did so from the same IP as one of your registered users. He'd be a poor hacker if he did, but half these script kiddies don't understand how network services work, anyway.
Wiz: I hope you're logging IP addresses, and have some back logs to troll. I'd be interested in knowing if the jack wagon changing the NMC address did so from the same IP as one of your registered users. He'd be a poor hacker if he did, but half these script kiddies don't understand how network services work, anyway.
The IP of the attacker is 178.252.115.200, but this obviously isn't all that useful. This IP is actually associated with some attempted low-hashrate mining with the following addresses: 141Ui93eV83HSnpyDcvdtGtR3UqwYss5q7, 17hpCt7vWLCksCpUgQpFURjWHjZDhNDYhz, 1MsMx8hfYW6tS1Y9oGZhAbSqvrD8DDgNzN. But, no earnings to speak of on these, really.
Note: I have no issues publicly revealing private data like this on attackers.
Yeh. thx for sharing
Russian IP from Saint Petersburg based home internet. fun to know at least
That ISP appears only to have 8K addresses, I'd be curious to know how many Eligius members also hail from the 178.252.96.0 - 178.252.127.255 block.
This, honestly, is my fault, because I generally at the very least do a cursory parse through the NMC payout list before submitting it to the network. In my haste I did not today and seems that was a mistake on my part which will not happen again. There is enough NMC buffer to cover the loss and I will make sure everyone gets paid properly once I correct the issues.