I have a WordPress install which uses the plugin Wordfence. I set Wordfence to block the IP of anyone trying to log in with a non-existent username.
For several months now, I have been getting many login attempts per day with username
admin. The usual pattern is that the attempt is made on an IP, that IP gets blocked, and then about an hour later another attempt is made on an entirely unrelated IP and host.
Sometimes it's more than once an hour, and sometimes I get nothing for a few days.
Today I've noticed a dramatic increase in the number and frequency of attempts. Sometimes I notice that the login attempts are made from similar IPs from the same host at roughly the same time.
So far there aren't any guesses with other usernames other than
admin. Obviously, this doesn't pose a threat to me since it's only trying to get into a non-existent account, but I don't like having to ban, even temporarily, so many IPs.
Is there any way to track down what is causing this? Is it a script with a botnet? Is it a certain proxy being used? Are the IPs being spoofed? Is there a way to recognize the script that is doing this and block it specifically?
Here is info on a few of the most recent attempts to login from today, with attempt time, IP and hostname:
12:51:05 AM User IP: 184.108.40.206 User hostname: kenley.accountservergroup.com 12:51:08 AM User IP: 220.127.116.11 User hostname: cpweb17.idig.net 12:54:36 AM User IP: 18.104.22.168 User hostname: box796.bluehost.com 12:54:38 AM User IP: 22.214.171.124 User hostname: avatar.dicode.nl 12:54:41 AM User IP: 126.96.36.199 User hostname: 188.8.131.52.static.intovps.com 01:04:24 AM User IP: 184.108.40.206 User hostname: www184.your-server.de 01:04:28 AM User IP: 220.127.116.11 User hostname: box390.bluehost.com 01:04:31 AM User IP: 18.104.22.168 User hostname: box692.bluehost.com 01:12:49 AM User IP: 22.214.171.124 User hostname: host402.hostmonster.com 03:14:16 AM User IP: 126.96.36.199 User hostname: www90.your-server.de 03:14:19 AM User IP: 188.8.131.52 User hostname: ip-184-168-112-26.ip.secureserver.net 03:14:22 AM User IP: 184.108.40.206 User hostname: purple.streamblues.com 04:09:13 AM User IP: 220.127.116.11 User hostname: ec2-54-215-196-56.us-west-1.compute.amazonaws.com 04:09:16 AM User IP: 18.104.22.168 User hostname: hos.hostplanet.ca 04:09:17 AM User IP: 22.214.171.124 User hostname: midwestmonitor02.midwestmonitor.com 04:12:00 AM User IP: 126.96.36.199 User hostname: just87.justhost.com 04:24:58 AM User IP: 188.8.131.52 User hostname: box531.bluehost.com 04:25:01 AM User IP: 184.108.40.206 User hostname: box402.bluehost.com 04:25:04 AM User IP: 220.127.116.11 User hostname: box680.bluehost.com 04:27:56 AM User IP: 18.104.22.168 User hostname: 04:27:59 AM User IP: 22.214.171.124 User hostname: box278.bluehost.com 06:26:00 AM User IP: 126.96.36.199 User hostname: 50-87-23-91.unifiedlayer.com 06:26:03 AM User IP: 188.8.131.52 User hostname: web1.xlhost.de 06:26:06 AM User IP: 184.108.40.206 User hostname: host216.hosting.register.com 07:20:55 AM User IP: 220.127.116.11 User hostname: ns237003.ovh.net 07:21:01 AM User IP: 18.104.22.168 User hostname: box575.bluehost.com 07:23:07 AM User IP: 22.214.171.124 User hostname: reach.nseasy.com 07:23:13 AM User IP: 126.96.36.199 User hostname: ava.claimtheweb.com 07:28:18 AM User IP: 188.8.131.52 User hostname: 69-195-75-28.unifiedlayer.com 07:40:47 AM User IP: 184.108.40.206 User hostname: vps.redber.net 07:40:49 AM User IP: 220.127.116.11 User hostname: ec2-23-21-90-33.compute-1.amazonaws.com 09:35:04 AM User IP: 18.104.22.168 User hostname: server.bludomain6.net 09:35:08 AM User IP: 22.214.171.124 User hostname: bsm.at 10:30:13 AM User IP: 126.96.36.199 User hostname: box607.bluehost.com 10:33:19 AM User IP: 188.8.131.52 User hostname: box359.bluehost.com 10:39:05 AM User IP: 184.108.40.206 User hostname: pro.probatelawyer.org 10:39:14 AM User IP: 220.127.116.11 User hostname: oregon.footholds.net 10:39:18 AM User IP: 18.104.22.168 User hostname: hw82.webservidor.net 10:55:42 AM User IP: 22.214.171.124 User hostname: web-62-1.webhotelli.fi 10:55:46 AM User IP: 126.96.36.199 User hostname: vserver.mydevteam.net 10:55:49 AM User IP: 188.8.131.52 User hostname: host238.hostmonster.com 11:26:13 AM User IP: 184.108.40.206 User hostname: 127.51.60.213.static.mundo-r.com 12:44:31 PM User IP: 220.127.116.11 User hostname: host274.hostmonster.com 12:44:34 PM User IP: 18.104.22.168 User hostname: host243.hostmonster.com