I have an endpoint protection from Symantec. Recently, I have been receiving many Symantec Cloud Alert emails.
They have been attacking random domain that is hosted on my server. Most of my website is using a .NET based framework, only a few websites are running on Wordpress. And all the Wordpress ones do not use this
I don't know the definition for this attack (maybe DoS?), but would like some advice on how to fix this issues.
Currently, I just block the IP address using this method, but I'm not sure it will help.
This is a reply from Symantec, that doesn't really help much:
You will see that many of these URLs end with "../wp-config.php". This appears to be a Wordpress exploit of some kind.
I think you should take the following actions:
Run a full scan on each machine and submit any results to our site http://www.symantec.com/security_response/submitsamples.jsp
If you are using Wordpress, have a look at these articles: