1

The entry below is from the visitors log in c-panel

Host: .  
/specific legimate-wordpress-post/
Http Code: 503
Date: Jul 24 09:28:06
Http Version: HTTP/1.1
Size in Bytes: 1118
Referer: http://mywebsite.com/
Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/536.28.10 (KHTML, like Gecko) Version/6.0.3 Safari/536.28.10

/?_wfsf=unlockEmail  
Http Code: 200  Date: Jul 24 09:28:06   Http Version: HTTP/1.1  Size in Bytes: 242  
Referer: http://mywebsite.com/specific-legimate-wordpress-post/
Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/536.28.10 (KHTML, like Gecko) Version/6.0.3 Safari/536.28.1

The entry below is from the raw access log in c-panel

. - - [24/Jul/2014:09:28:06 -0500] "GET /specific-legitimate-wordpress-post/ HTTP/1.1" 503 1118 "http://mywebsite.com/" "Mozilla/5.0 Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/536.28.10 (KHTML, like Gecko) Version/6.0.3 Safari/536.28.10"

. - - [24/Jul/2014:09:28:06 -0500] "GET /?_wfsf=unlockEmail HTTP/1.1" 200 242 "http://mywebsite.com/specific-legitimate-wordpress-post/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/536.28.10 (KHTML, like Gecko) Version/6.0.3 Safari/536.28.10"

This site is on a shared server so there is no access to server configuration files. Would you use hosts.deny and .htaccess to stop such a hacker and if so please explain how in detail. Thanks.

3
  • 3
    Don't try to stop a hacker by banning their IP or host. Stop them by proving your website against the exploits they are using. Even when you would be able to block the attacker that way (you are not - IP and hostname blocks are trivial to circumvent), another hacker will try the same vulnerability.
    – Philipp
    Commented Jul 25, 2014 at 9:27
  • Sounds like it probes for this one. Commented Jul 25, 2014 at 9:43
  • WordFence fixed that vulnerability long ago, but it irritates me that anyone will get the following message with the above hacking attempt: Your request was received We received a request to email "" instructions to unlock their access. If that is the email address of a site administrator or someone on the Wordfence alert list, then they have been emailed instructions on how to regain access to this sytem. The instructions we sent will expire 30 minutes from now.
    – ovtorne
    Commented Jul 25, 2014 at 18:59

1 Answer 1

2

You start by figuring out what's going wrong with your logging. Everyone on the Internet has an IP address -- it's a necessary condition for connecting to any other computer out there.

1
  • Thanks for the heads up. I must admit I am a novice and have little knowledge about these things. I am grateful. I will contact hostgator about the logging problem.
    – ovtorne
    Commented Jul 25, 2014 at 19:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .