Yes, that's an RFC1918 IP (not in a range I use (!)) logging in to a server as root, with password. And there was no wtmp entry or history.
I just came back from full blown forensics mode. Conclusion: everything OK, this was just caused by multiple levels of (third party) stupid.pic.twitter.com/C2kjhAs2I4
-
-
-
Conclusion: the people nominally managing this server (who still use passwords) SFTPed in from the *same* ISP and they fail at CgNAT.
- Show replies
New conversation -
-
-
That is rather satisfying.
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.