1

Recently I saw something new (at least for me) in log file [% tools.ua.random() %] as below:

199.246.2.10 - - [21/Aug/2014:13:25:15 +0545] "POST /wp-login.php HTTP/1.1" 200 2809 "http://mywebsite.com/wp-login.php" "[% tools.ua.random() %]"
64.34.173.227 - - [21/Aug/2014:13:25:32 +0545] "POST /wp-login.php HTTP/1.1" 200 2809 "http://mywebsite.com/wp-login.php" "[% tools.ua.random() %]"
91.109.3.166 - - [21/Aug/2014:13:25:32 +0545] "POST /wp-login.php HTTP/1.1" 200 2809 "http://mywebsite.com/wp-login.php" "[% tools.ua.random() %]"

If someone has seen similar kind of log can anybody explain me what is this and how to stop it, may be by applying some rule in modsec. I think it is some kind of software used for ddos attack. I found this in web.

  • could it be somewhat brute force? using tools.ua.random – cengizUzun Aug 21 '14 at 9:26
  • This is getting bad as it is taking more CPU load. How to stop it from server side. Like if found "tools.ua.random" pattern drop it. BTW we have centos – Err0rr Aug 21 '14 at 10:29
  • You could drop requests containing that pattern using iptables or mod_security. – Polynomial Aug 21 '14 at 10:35
  • @Err0rr 64.34.173.227 and 91.109.3.166 are ips from hosting companies why would a server visit your site?? They are bots or people using VPNs so start blocking them now. What web server are you using? – BigBob1000 Aug 21 '14 at 10:35
  • @BigBob: those are definitely bots thats why I said "attack" and these are just samples there are lot more ips. I think this is user agent. However I am still searching for this and came to know that it is an user-agent and I somehow manage to stop it from .htaccess like below # BLOCK USER AGENTS RewriteEngine on RewriteCond %{HTTP_USER_AGENT} "[%\ tools\.ua\.random()\ %] [NC] RewriteRule !^robots\.txt$ - [F] # BLOCK BLANK USER AGENTS RewriteCond %{HTTP_USER_AGENT} ^-?$ – Err0rr Aug 21 '14 at 10:57
2

I think it is a poorly written robot. [% tools.ua.random() %] looks like a template that should pick a random user agent. But it does not substitute the value (the UA). It must be a bad bot hiding behind various user agents.

To mitigate some attack against WordPress please take a look at my plugin: https://github.com/szepeviktor/wordpress-plugin-construction/tree/master/wordpress-fail2ban The plugin analyses the HTTP request line-by-line.

Use the "must use" (mu-plugin) version, that is the up-to-date one. I hope you understand commented PHP code. I would gladly help you to set this up. It even works without the fail2ban daemon (running on a Linux server) but it is designed to immediately block bads bot through fail2ban.

  • Thanks for the response. May be other people suffering from same problem will hit this page and get your answer. I wish your solution will be helpful and I love to give it a try. – Err0rr Oct 23 '14 at 17:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.