2

I am hosting more than 20 WordPress website on a single server. The server has other cms based websites too. For better security, I have used CloudLinux CageFS which encapsulates each customer. Even if one WordPress site gets hacked then there is no way that hacker will be able to find other users in the server. S/he can't even see other users by reading /etc/passwd.

Even though I am using such security I see lots of attack on WordPress websites. My question is how is it possible. I know there are sites like yougetsignal which can disclose sites hosted in same IP address but in my case it also does not show other websites. How is the hacker able to find other WordPress sites on my server and how is s/he attacking those sites?

The processes looks like below:

# ps aux| grep wp-login
user1 10904  0.1  0.1 278288 44244 ?        Ss   12:19   0:00 lsphp:/home/user1/public_html/wp-login.php
user1 10905  0.1  0.1 278304 44280 ?        Ss   12:19   0:00 lsphp:/home/user1/public_html/wp-login.php
user2 12171  0.1  0.1 394312 46396 ?        Ss   12:20   0:00 lsphp:ome/user2/public_html/wp-login.php
user2 12614  0.2  0.1 394536 46480 ?        Ss   12:21   0:00 lsphp:ome/user2/public_html/wp-login.php
user3 12687  0.1  0.1 382632 35524 ?        Ss   12:21   0:00 lsphp:home/user3/public_html/wp-login.php
user3 13256  0.0  0.0 382240 27964 ?        Ss   12:21   0:00 lsphp:home/user3/public_html/wp-login.php
user4 14335  0.1  0.0 380504 20460 ?        Ss   12:22   0:00 lsphp:/home/user4/public_html/wp-login.php
user5 14718  0.1  0.0 380296 18408 ?        Ss   12:22   0:00 lsphp:/home/user5/public_html/wp-login.php
user6 14735  0.0  0.0 379564 16376 ?        Ss   12:22   0:00 lsphp:/home/user6/public_html/wp-login.php
user7 14750  0.1  0.0 380272 17376 ?        Ss   12:22   0:00 lsphp:/home/user7/public_html/wp-login.php
root     15078  0.0  0.0 112712   976 pts/0    S+   12:23   0:00 grep --color=auto wp-login

When I checked the access log then I see request to wp-login.php file from different IPs, connections are unique as request from same ip is no more than twice. Is not this an attack? The access log looks like below:

108.169.181.185 - - [22/Sep/2019:14:14:29 +0200] "GET /wp-login.php HTTP/1.1" 200 11911 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
108.169.181.185 - - [22/Sep/2019:14:14:34 +0200] "POST /xmlrpc.php HTTP/1.1" 403 9 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
2403:cfc0:1007:100::10 - - [22/Sep/2019:14:14:34 +0200] "POST /wp-login.php HTTP/1.1" 200 9948 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
2403:cfc0:1007:100::10 - - [22/Sep/2019:14:14:37 +0200] "POST /xmlrpc.php HTTP/1.1" 403 9 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
178.62.98.196 - - [22/Sep/2019:14:15:33 +0200] "GET /wp-login.php HTTP/1.1" 200 11905 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
178.62.98.196 - - [22/Sep/2019:14:15:34 +0200] "POST /wp-login.php HTTP/1.1" 200 11905 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
2

Although you don't provide this level of detail in your question I'll assume that the WordPress sites you host are publicly accessible and that they either have their own domain name or that they are linked from somewhere else. What you might see then is not that an attacker specifically attacking your IP address, but an attacker addressing lots of publicly known sites. Only you have a limited view into this attack, i.e. you only see the attacks targeted at your specific IP address and thus assume that you are the main target of this attack.

Of course, there might be other ways the attacker might specifically address all sites on your IP address, like having access to backups of your server configuration, to passive DNS data or by using services like domaintools. In general these information are not secret so they cannot be relied on to protect sites.

| improve this answer | |
2

Whatever you said is a kind of server or instance hardening. And the scenario that you are saying is basically a probing, not an attack. And you can't stop probing anyways.

Keep in mind one thing, if it's a public hosted website then sooner or later attacker will probe your site anyways. It's not only your site, every available site of their interest; they keep probing. So, don't worry.

Now coming to your question, how they still get to your website even you did so many settings?

The simple answer is the attackers keep checking various public IP hosted in known hosting provider like DigitalOcean, Bluehost, GoDaddy and even Cloud Service providers.

Probing is common, you can ignore it unless and until you see unusual behavior of those traffic like sending lots of fuzzed data to your site, brute-forcing common usernames, lots of requests to your wp-admin/. These are of real concern.

In gist, what you can do to avoid such attacks enable few famous plugins in your websites like JetPack which stops spamming, brute-forcing etc or wordfence for any suspicious activities in your WordPress websites.

I hope that answers your doubt. If not, please ask a specific question, I will try my best to clear those.

| improve this answer | |
  • is it just probing? I have updated the question. Does not look like just probing. – Err0rr Sep 23 '19 at 9:03
  • 1
    ....and I see lots of such logs. Someone is trying to gain wp-login.php credentials. Hence I considered it as an attack. – Err0rr Sep 23 '19 at 9:36
  • These logs look like probing only. In simple words, the attacker is trying various activities one of them can be Brute force. But here it looks someone is trying to login to WP site through some automated tool like wikto etc. It basically they are tring brute-force username. Use some plugin which can rate limit to these attacks. Please dig further and try to put some defense at site level like wordfence or jetpack. – Jassi Sep 23 '19 at 10:04
  • I do not think wordfence or jetpack can stop it. Applying plugins to multiple website is pain. – Err0rr Sep 23 '19 at 10:16
0

In the last hour, the three top hits to my server that result in 404s are:

/wp-login.php
/404testpage4525d2fdc
/404javascript.js

from Ukraine and Honduras allegedly. I don't use Wordpress, I never have used it on my site, and that's why a 404 was sent, but it doesn't mean I was targeted in any way, simply someone just trying out various requests. No doubt you'd see the same if you looked at the ports people are trying to access on your server randomly.

So they might not be finding anything!

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.