Sites under attack

If you have questions about using mojoPortal, you can post them here.

You may want to first review our site administration documentation to see if your question is answered there.

You must sign in to post in the forums.
7/25/2026 4:07:11 AM
Chris Quinn
Gravatar
Total Posts 67
View Posts

Sites under attack

When trying to log in to one of my sites this morning I got a "locked out due to too many password attempts" message, and a quick SQL query of the dbo.mp_users table showed 24 attempts for the account.  I reset the count using SQL and logged in, but querying the admin accounts of all of my sites (multi-site configuratione) many of them are showing elevated and increasing failed password attempts.

select name, loginname, email, failedpasswordattemptcount
FROM [Quizleagues].[dbo].[mp_Users] usr where failedpasswordattemptcount > 0 and loginname = 'admin'

userid    siteid    name    loginname    email    failedpasswordattemptcount
1    1    Admin    admin    admin@quizleagues.co.uk    29
5    4    Admin    admin    admin@wirralql.org.uk    6
12    6    Admin    admin    admin@merseysidequizleagues.org.uk    14
13    7    Admin    admin    admin@ormskirkquizleague.org.uk    12
29    9    Admin    admin    chrisq@blueyonder.co.uk    2
54    16    Admin    admin    chris.quinn@quincunx.co.uk    1
60    19    Admin    admin    admin@quizliverpool.org.uk    13
83    20    Admin    admin    chris.quinn@quincunx.co.uk    5
117    24    Admin    admin    chrisq@blueyonder.co.uk    1
119    25    Admin    admin    chrisq@blueyonder.co.uk    3
132    26    Admin    admin    chrisq@blueyonder.co.uk    5

Is there any way of monitoring these login attempts and blocking them.  I'm not sure what to look for in the log file

7/25/2026 4:21:21 AM
Crispin
Gravatar
Total Posts 547
View Posts
feet planted firmly on the ground

Re: Sites under attack

If it's only you needing to log in, as an administrator, one option is to restrict your login page to just your own IP address, assuming you have a static IP. But if your IP is not static this could lock you out, and you'd need server access to web.config in order to change the blocking rule.

Your IIS logs will show previous requests to your login page, and might show that these all originate from a certain IP address or agent, or a small range of these. In which case you could block them either using IIS or the mojoPortal Banned IP Addresses page (Administration Menu > Advanced Tools >  Banned IP Addresses). But in my experience these kinds of attack often come from distributed networks of thousands of IPs, so blocking is futile. You might still find they come from specific countries, in which case you might be able to block at firewall level (so long as you do not want genuine users from those countries).

7/25/2026 11:17:20 AM
Joe Davis
Gravatar
Total Posts 2267
View Posts

Re: Sites under attack

Hi Chris,

First, I suggest upgrading to the latest version of mojoPortal. Then, follow Crispin's advice. You can restrict your login page by IP through the IIS IP & Domain Restrictions tool. 

I would also suggest changing all admin passwords to ensure they are secure passwords. I personally like Correct Horse Battery Staple: xkcd-Style Password Generator for password generation. Then, make sure you have mojo set to hash your passwords. 

We also tend to use made up email addresses for sites we don't need to receive emails from. This makes it much more difficult to guess the login information. We just generate an alpha-numeric password, use a few of the characters for the user and the rest for the domain, slap .com on the end and that's the login. So 4p25NgFfrC6c becomes 4p25@NgFfrC6c.com. Whatever you do, your site login should not be the same email address that you share with the world.

Thanks,
Joe

You must sign in to post in the forums.