1

Recently I saw something new (at least for me) in log file [% tools.ua.random() %] as below:

199.246.2.10 - - [21/Aug/2014:13:25:15 +0545] "POST /wp-login.php HTTP/1.1" 200 2809 "http://mywebsite.com/wp-login.php" "[% tools.ua.random() %]"
64.34.173.227 - - [21/Aug/2014:13:25:32 +0545] "POST /wp-login.php HTTP/1.1" 200 2809 "http://mywebsite.com/wp-login.php" "[% tools.ua.random() %]"
91.109.3.166 - - [21/Aug/2014:13:25:32 +0545] "POST /wp-login.php HTTP/1.1" 200 2809 "http://mywebsite.com/wp-login.php" "[% tools.ua.random() %]"

If someone has seen similar kind of log can anybody explain me what is this and how to stop it, may be by applying some rule in modsec. I think it is some kind of software used for ddos attack. I found this in web.

7
  • could it be somewhat brute force? using tools.ua.random
    – cengizUzun
    Aug 21, 2014 at 9:26
  • This is getting bad as it is taking more CPU load. How to stop it from server side. Like if found "tools.ua.random" pattern drop it. BTW we have centos
    – Prakash
    Aug 21, 2014 at 10:29
  • You could drop requests containing that pattern using iptables or mod_security.
    – Polynomial
    Aug 21, 2014 at 10:35
  • @Err0rr 64.34.173.227 and 91.109.3.166 are ips from hosting companies why would a server visit your site?? They are bots or people using VPNs so start blocking them now. What web server are you using?
    – BigBob1000
    Aug 21, 2014 at 10:35
  • @BigBob: those are definitely bots thats why I said "attack" and these are just samples there are lot more ips. I think this is user agent. However I am still searching for this and came to know that it is an user-agent and I somehow manage to stop it from .htaccess like below # BLOCK USER AGENTS RewriteEngine on RewriteCond %{HTTP_USER_AGENT} "[%\ tools\.ua\.random()\ %] [NC] RewriteRule !^robots\.txt$ - [F] # BLOCK BLANK USER AGENTS RewriteCond %{HTTP_USER_AGENT} ^-?$
    – Prakash
    Aug 21, 2014 at 10:57

1 Answer 1

2

I think it is a poorly written robot. [% tools.ua.random() %] looks like a template that should pick a random user agent. But it does not substitute the value (the UA). It must be a bad bot hiding behind various user agents.

To mitigate some attack against WordPress please take a look at my plugin: https://github.com/szepeviktor/wordpress-plugin-construction/tree/master/wordpress-fail2ban The plugin analyses the HTTP request line-by-line.

Use the "must use" (mu-plugin) version, that is the up-to-date one. I hope you understand commented PHP code. I would gladly help you to set this up. It even works without the fail2ban daemon (running on a Linux server) but it is designed to immediately block bads bot through fail2ban.

1
  • Thanks for the response. May be other people suffering from same problem will hit this page and get your answer. I wish your solution will be helpful and I love to give it a try.
    – Prakash
    Oct 23, 2014 at 17:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .