How bot(s) have guessed my wordpress login page?

Question

I have a wordpress site (fully patched) that used to receive many attempts to log in based on dictionary attacks. I changed my admin user to something uncommon and use a really strong password.

Apart of that I changed my login page using rename wp-login.php plugin. I changed my login url to something like http://foo.com/blog/?pencil. For years the bots failed to guess my login page (still having many 404s).

For the second time in a month. First time I had a failed attempt and changed url to http://foo.com/blog/?paper and didn't think much about it. Second time happened today. Exact events:

19th April

• Successful login from my employer office (via proxy) to http://foo.com/blog/?pencil at 18:00 from my company laptop.
• 2 failed attempts from 70.32.73.128 (report about the IP ), a IP from California, at 02:54am GMT (The server seems to be reported as hacked) using admin username (that btw doesn't exist in my wordpress)
• I changed password and url to http://foo.com/blog/?paper
• I enabled capturing of incoming passwords in log.

Now

• Yesterday (11:10 am) I accessed to blog to correct an entry from my employer network (same proxy).
• Today at 11:55 1 failed attempt from 213.248.63.27 (Virus Total report about the IP), a russian IP with suspicious sites like vrn.sauna.ru (probably NSFW url). It used oscarfoley as username with no password (my username is not oscarfoley or similar)

I feel pretty secure as the bot has to guess the login page, the admin user and the pass. However, by reading this site I am a little bit paranoid. So my main question is:

How the bot has "guessed" the paper or pencil login page?

• Could be my employer proxy/network be compromised? (Like a hacker having access to proxy logs...)
• Could it be a broad dictionary attack (something like a boot scanning all wordpress servers in the internet to see if the login page is pencil)?.. or a exploit in wordpress?
• Is there anything more I should do to protect myself?
• Could it be a personal attack using public information on internet? Or a bot that uses public information for broad attacks?
• Why the empty password?
• How can I be sure I am not hacked? (Forget about this as it is pretty good answered in this question)
• Could be my laptop or my pc at home be hacked and got the url from it? My guess is no because otherwise they would have my password...

EDIT: To be more clear, attacker hit the login url directly with NO failed attempts on other similar urls. Check here last 404 errors:

Answer 1

Many web scanning tools (e.g. Wikto) have the capabilities of launching bruteforce guesses against a URL. There is nothing stopping an attacker from using a dictionary and say curl or wget to bruteforce either:

while read line
 do
   wget -qO - http://yoursite.com/$line
 done < /usr/share/dictionary/wordlist

A common task I would do for pentesting, would be something similar to the above, where I would wget a copy of the site, parse out each word, put each word on a newline, then search the site for directories of any word listed on their site. This also came in handy for username a few times.

Now you mention wordpress, and it should be stated that when you use plugins, some of those plugins can contain "pingbacks" or "hey I also use this plugin" where your site would be listed. This could be another vector where an attacker saw your site elsewhere, and targeted it. As for WP in general, sites like "Scritch" can tell someone what is running on the site (CMS), what plugins are in use, etc. So imagine the following: Attacker sees your site on say a pingback, takes the site name, shoves it into scritch. Determines they will attack you. They don't find the login page, so they use a similar tactic (shell script) to find something.

I would worry little about attackers, and focus on creating say a mod_rewrite rule or htaccess file similar to the following:

<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{REQUEST_URI} ^(.*)?oscarfoley\.php(.*)$ [OR]
RewriteCond %{REQUEST_URI} ^(.*)?wp-admin-login$
RewriteCond %{REMOTE_ADDR} !^1\.2\.3\.4$
RewriteCond %{REMOTE_ADDR} !^5\.6\.7\.8$
RewriteRule ^(.*)$ - [R=403,L]
</IfModule> 

Where 1.2.3.4 is your home addr, and 5.6.7.8 is perhaps your company page and be done with the worries of someone trying to bruteforce their way in via login page. Another alternative which is security through obscurity would be to create a URL based on say a SHA1 checksum of a word, versus a word. E.g.

$ echo 0sc@r | shasum5.16 -a 1
2ee681adc62a5ca2865bb7424b6a97a9050ddcd4  -

Where 2ee681adc62a5ca2865bb7424b6a97a9050ddcd4 becomes your login URL. Again, security through obscurity, but the notion here is that is someone were to guess that URL at some point, you can deduce that your traffic was somehow sniffed, or cached somewhere.

ADDED DUE TO OP EDIT

The 404s from one address mean little to some degree. You have no idea if that address connecting is working in connection with another address doing bruteforce attempts. (e.g. distributed scanning/sharing)

Answer 2

Well, pencil and paper do go together.... so maybe the attacker just guessed after finding

?pencil

Why not just make it a randomly generated thing using something like pwgen, with a ridiculously large length, like 50, so something like

/0gGF9ZAt7us0WbnntE3rqqrRK1PohXjU6Kk6tuRfCMMJdJmZIf

as a login page and login being equally ridiculous?

Answer 3

your solution is IP-based login page. I.e. you have a list of static IP's, they're allowed to open actual login page, others are redirected to a trap to collect username and password for a break-in attempt + blacklist an attacker's IP. Where from it can be guessing? An answer is... your browser toolbars/addons + antivirus "security software". Yes, they DO leak data. Also your employer's proxy logs may be of suspect. Try a blank Linux installed on a Raspberry Pi 2 with blank browser with no addons - and use it and it ONLY to log in to your wordpress, not use it from your employer's proxy. And take a look - will the new login address be in use.