1

I have a WordPress install which uses the plugin Wordfence. I set Wordfence to block the IP of anyone trying to log in with a non-existent username.

For several months now, I have been getting many login attempts per day with username admin. The usual pattern is that the attempt is made on an IP, that IP gets blocked, and then about an hour later another attempt is made on an entirely unrelated IP and host.

Sometimes it's more than once an hour, and sometimes I get nothing for a few days.

Today I've noticed a dramatic increase in the number and frequency of attempts. Sometimes I notice that the login attempts are made from similar IPs from the same host at roughly the same time.

So far there aren't any guesses with other usernames other than admin. Obviously, this doesn't pose a threat to me since it's only trying to get into a non-existent account, but I don't like having to ban, even temporarily, so many IPs.

Is there any way to track down what is causing this? Is it a script with a botnet? Is it a certain proxy being used? Are the IPs being spoofed? Is there a way to recognize the script that is doing this and block it specifically?

Here is info on a few of the most recent attempts to login from today, with attempt time, IP and hostname:

12:51:05 AM
User IP: 174.121.79.2
User hostname: kenley.accountservergroup.com

12:51:08 AM
User IP: 64.34.111.218
User hostname: cpweb17.idig.net

12:54:36 AM
User IP: 66.147.244.96
User hostname: box796.bluehost.com

12:54:38 AM
User IP: 91.148.192.40
User hostname: avatar.dicode.nl

12:54:41 AM
User IP: 77.81.241.223
User hostname: 223.241.81.77.static.intovps.com

01:04:24 AM
User IP: 188.40.2.4
User hostname: www184.your-server.de

01:04:28 AM
User IP: 69.89.31.190
User hostname: box390.bluehost.com

01:04:31 AM
User IP: 66.147.244.192
User hostname: box692.bluehost.com

01:12:49 AM
User IP: 67.20.76.102
User hostname: host402.hostmonster.com

03:14:16 AM
User IP: 213.133.104.90
User hostname: www90.your-server.de

03:14:19 AM
User IP: 184.168.112.26
User hostname: ip-184-168-112-26.ip.secureserver.net

03:14:22 AM
User IP: 69.160.46.103
User hostname: purple.streamblues.com

04:09:13 AM
User IP: 54.215.196.56
User hostname: ec2-54-215-196-56.us-west-1.compute.amazonaws.com

04:09:16 AM
User IP: 192.163.233.135
User hostname: hos.hostplanet.ca

04:09:17 AM
User IP: 69.73.175.234
User hostname: midwestmonitor02.midwestmonitor.com

04:12:00 AM
User IP: 173.254.28.87
User hostname: just87.justhost.com

04:24:58 AM
User IP: 74.220.219.131
User hostname: box531.bluehost.com

04:25:01 AM
User IP: 69.89.31.202
User hostname: box402.bluehost.com

04:25:04 AM
User IP: 66.147.244.180
User hostname: box680.bluehost.com

04:27:56 AM
User IP: 178.32.177.13
User hostname:

04:27:59 AM
User IP: 69.89.31.78
User hostname: box278.bluehost.com

06:26:00 AM
User IP: 50.87.23.91
User hostname: 50-87-23-91.unifiedlayer.com

06:26:03 AM
User IP: 84.200.252.101
User hostname: web1.xlhost.de

06:26:06 AM
User IP: 209.237.142.216
User hostname: host216.hosting.register.com

07:20:55 AM
User IP: 37.59.34.44
User hostname: ns237003.ovh.net

07:21:01 AM
User IP: 66.147.242.175
User hostname: box575.bluehost.com

07:23:07 AM
User IP: 67.23.226.7
User hostname: reach.nseasy.com

07:23:13 AM
User IP: 63.247.141.31
User hostname: ava.claimtheweb.com

07:28:18 AM
User IP: 69.195.75.28
User hostname: 69-195-75-28.unifiedlayer.com

07:40:47 AM
User IP: 216.22.25.193
User hostname: vps.redber.net

07:40:49 AM
User IP: 23.21.90.33
User hostname: ec2-23-21-90-33.compute-1.amazonaws.com

09:35:04 AM
User IP: 67.23.243.30
User hostname: server.bludomain6.net

09:35:08 AM
User IP: 78.142.160.203
User hostname: bsm.at

10:30:13 AM
User IP: 70.40.220.107
User hostname: box607.bluehost.com

10:33:19 AM
User IP: 69.89.31.159
User hostname: box359.bluehost.com

10:39:05 AM
User IP: 198.57.224.136
User hostname: pro.probatelawyer.org

10:39:14 AM
User IP: 91.146.107.85
User hostname: oregon.footholds.net

10:39:18 AM
User IP: 189.113.5.83
User hostname: hw82.webservidor.net

10:55:42 AM
User IP: 217.149.62.1
User hostname: web-62-1.webhotelli.fi

10:55:46 AM
User IP: 216.246.7.21
User hostname: vserver.mydevteam.net

10:55:49 AM
User IP: 74.220.215.238
User hostname: host238.hostmonster.com

11:26:13 AM
User IP: 213.60.51.127
User hostname: 127.51.60.213.static.mundo-r.com

12:44:31 PM
User IP: 74.220.215.74
User hostname: host274.hostmonster.com

12:44:34 PM
User IP: 74.220.215.243
User hostname: host243.hostmonster.com
Improve this question
4
  • 3
    Who is the easy part, everyone is attacking you. The hard part is making Wordpress secure.
    – rook
    Commented Oct 30, 2013 at 21:10
  • I'm curious, what is your objective here? Supposing you do find out that, say, h4ckergr0up.ru is attacking you using a botnet - does the identity of the attack alter your countermeasures? (I'd suggest it probably doesn't, and so don't worry about the source, just harden WP as best you can).
    – scuzzy-delta
    Commented Oct 30, 2013 at 21:25
  • 1
    I guess I'm not as concerned about who it is as what it is. If there is a way of identifying it then perhaps I can look into the software and figure out how to block it. Or something. I guess my objective is just to generally learn as much about what is going on as possible--you know--knowledge is power. Maybe something could be done?
    – brentonstrine
    Commented Oct 30, 2013 at 21:33
  • 1
    Or you could hire a squad of mercenaries to blow up their lair.
    – Abe Miessler
    Commented Oct 30, 2013 at 21:36

4 Answers 4

Reset to default
1

From your description it sounds like it is a botnet of some kind.

But that information is unlikely to help in any way.

You are unlikely to ever see the script that is running (or the C&C commands being sent to the botnet) so that avenue of defence is unlikely...unless you are the FBI or similar. And botnets can have any IP address and be anywhere.

But to be honest, that end of things is irrelevant. As @Rook stated correctly, the best assumption is that the Internet is attacking you. Just block every IP that you detect attacking. It works. It is standard practice.

Improve this answer
1

This probably is a botnet who tries to find other hosts to infect in an automatic fashion. Most probably, a lot of other systems are similarly targeted, and were randomly selected.

It is the lot of any remotely accessible service to receive such bogus login attempts. Since they come from botnets, who, by definition, use many IP addresses, IP-banning solutions like Wordfence are ineffective (and you see the login attempts from many different addresses precisely because the botnet authors have learned that there are people who automatically block IP addresses).

Improve this answer
1

As the author of Bad Behavior, I've seen these botnet attacks before. I'm proud to say that Bad Behavior is still the only tool that blocks their first attempt and without resorting to IP bans.

The briefest glance at your log was enough to show that they are all compromised web servers, a very familiar pattern. One can easily infer that they are under some sort of central control, since as soon as one of them hits your site another one does shortly afterward.

If the botnet was able to compromise your site by logging into your admin account, it would likely be added to the botnet.

I strongly suggest you spend some time hardening WordPress.

Improve this answer
0

You can place these two code snippets in your .htaccess file. Replace the 000.000.000.000 with whatever IP addresses you log in from. Anyone but you attempting to log in will get a 404.


# allow WP login access from specific IP addresses only
<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$ [OR]
RewriteCond %{REQUEST_URI} ^(.*)?wp-admin$
RewriteCond %{REMOTE_ADDR} !^000.000.000.000$
RewriteCond %{REMOTE_ADDR} !^000.000.000.000$
RewriteCond %{REMOTE_ADDR} !^000.000.000.000$
RewriteRule ^(.*)$ ^http://%{REMOTE_ADDR}/$ [R=301,L]
</IfModule>

# Allow only login requests coming directly from your domain name
<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$ [OR]
RewriteCond %{REQUEST_URI} ^(.*)?wp-admin$
</IfModule>
Improve this answer
2
  • @RoryAlsop What you're saying would make sense if he had contributed a blacklist... but it's a whitelist. Kind of harsh too, for a new user contributing something actually fairly useful (especially for a first post) to be downvoted and then given a critical comment by a mod. It's like, "Welcome to stack exchange! Now hold still while we slap you and give you a fine."
    – brentonstrine
    Commented May 26, 2014 at 20:54
  • Brenton - you have obviously read into my comment something entirely incorrect. If an answer doesn't actually answer the question, a downvote is absolutely appropriate. I added a comment voluntarily to help explain the downvote. You are correct about the distinction between blacklist and whitelist so i agree, my comment mused the point. The basic point though, that this post does not answer the question, still stands.
    – Rory Alsop ♦
    Commented May 26, 2014 at 21:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .