1

The entry below is from the visitors log in c-panel

Host: .  
/specific legimate-wordpress-post/
Http Code: 503
Date: Jul 24 09:28:06
Http Version: HTTP/1.1
Size in Bytes: 1118
Referer: http://mywebsite.com/
Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/536.28.10 (KHTML, like Gecko) Version/6.0.3 Safari/536.28.10

/?_wfsf=unlockEmail  
Http Code: 200  Date: Jul 24 09:28:06   Http Version: HTTP/1.1  Size in Bytes: 242  
Referer: http://mywebsite.com/specific-legimate-wordpress-post/
Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/536.28.10 (KHTML, like Gecko) Version/6.0.3 Safari/536.28.1

The entry below is from the raw access log in c-panel

. - - [24/Jul/2014:09:28:06 -0500] "GET /specific-legitimate-wordpress-post/ HTTP/1.1" 503 1118 "http://mywebsite.com/" "Mozilla/5.0 Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/536.28.10 (KHTML, like Gecko) Version/6.0.3 Safari/536.28.10"

. - - [24/Jul/2014:09:28:06 -0500] "GET /?_wfsf=unlockEmail HTTP/1.1" 200 242 "http://mywebsite.com/specific-legitimate-wordpress-post/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/536.28.10 (KHTML, like Gecko) Version/6.0.3 Safari/536.28.10"

This site is on a shared server so there is no access to server configuration files. Would you use hosts.deny and .htaccess to stop such a hacker and if so please explain how in detail. Thanks.

  • 3
    Don't try to stop a hacker by banning their IP or host. Stop them by proving your website against the exploits they are using. Even when you would be able to block the attacker that way (you are not - IP and hostname blocks are trivial to circumvent), another hacker will try the same vulnerability. – Philipp Jul 25 '14 at 9:27
  • Sounds like it probes for this one. – Dmitry Janushkevich Jul 25 '14 at 9:43
  • WordFence fixed that vulnerability long ago, but it irritates me that anyone will get the following message with the above hacking attempt: Your request was received We received a request to email "" instructions to unlock their access. If that is the email address of a site administrator or someone on the Wordfence alert list, then they have been emailed instructions on how to regain access to this sytem. The instructions we sent will expire 30 minutes from now. – ovtorne Jul 25 '14 at 18:59
2

You start by figuring out what's going wrong with your logging. Everyone on the Internet has an IP address -- it's a necessary condition for connecting to any other computer out there.

  • Thanks for the heads up. I must admit I am a novice and have little knowledge about these things. I am grateful. I will contact hostgator about the logging problem. – ovtorne Jul 25 '14 at 19:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.