Attacks by OPH’ Kimsufi

Octave Klaba

TO: OVH.com Founder Octave Klaba

SUBJECT: Attacks Generated from OVH IPs

Mr. Klaba,

While I have taken to blocking some countries in total due to all of the attacks on this blog — and France being one of the worst offenders — I have since added more security layers. Unfortunately there are brute force login attempts and scanning occurring from Kimsufi.com and these are the ones that have happened in just the last week:

• 29 December 2012
  • Paris, France attempted a failed login using an invalid username “admin”.
  • IP: 94.23.250.149
  • Hostname: ks383693.kimsufi.com
• 30 December 2012
  • An unknown location at IP 91.121.9.21 attempted a failed login using an invalid username “admin”.
  • IP: 91.121.9.21
  • Hostname: ks22943.kimsufi.com
• 4 January 2013
  • An unknown location at IP 5.135.182.147 attempted a failed login using an invalid username “admin”.
  • IP: 5.135.182.147
  • Hostname: ks3289006.kimsufi.com
• 5 January 2013
  • An unknown location at IP 5.135.182.148 attempted a failed login using an invalid username “admin”.
  • IP: 5.135.182.148
  • Hostname: ks3289007.kimsufi.com
• 5 January 2013
  • An unknown location at IP 5.135.182.150 attempted a failed login using an invalid username “admin”.
  • IP: 5.135.182.150
  • Hostname: ks3289009.kimsufi.com

In addition to these attacks I have logged, I have found over the last several months numerous entries at ProjectHoneypot.org that identify IPs generating from Kimsufi/OVH. 

Please let me know what steps you will take to stop these attacks.

~Steve Borsch