10

Not sure if I should report it here, but within my website I collect each request in DB, and from time to time view these records. Among data collected are user agent, reqested url, referrer (i.e. previous) url, time, and others.

Today I found a following user agent bot (which seems to hide this):

(Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko

IP:

181.114.49.183

Most of requests are within 1-2 seconds intervals, and the most interesting is what urls it wants my server to check:

| /wp/wp-login.php | | /blog/wp-login.php | | /site/wp-login.php | | /cms/wp-login.php | | /section/wp-login.php | | /wp-admin/wp-login.php | | /wordpress/wp-login.php |

(from my DB)

Referrer in each cases is null (meaning there was no referrer; it expected to find a webpage at this uri).

Why a bot may possibly want to check if there is a wordpress installed on a webpage, and what is its url (my website doesn't use wordpress, or any other CMS)? To me, it's like searching for a possible way to get into an admin panel of the website. And I do have an admin panel which I created myself.

Should I do anything about it?

Improve this question
2
  • 37
    Welcome to the internet! A place where your door will be knocked on frequently and there is very little you can do about it! Just make sure that a mere knock doesn't grant access :-)
    – MonkeyZeus
    Jul 21, 2015 at 15:11
  • 5
    Most Hosters allow you to maintain a "blocked IPs" list. If you are not using wordpress, you could place a script in /wp/wp-login.php that writes the bots IP straight to the banlist.
    – iHaveacomputer
    Jul 21, 2015 at 23:42

4 Answers 4

Reset to default
28

Every computer with a public IP gets this kind of attention permanently. There's nothing you can do to stop it (I once tried to complain to the provider owning the offender's IP, never got a reply and gave up). What you can do is to make sure you're well protected against a possible attack (this bot seemed to look for WordPress, but there are others looking for Apache, SSH, you name it). A few rules:

  • Expose as few services as possible. If you don't need SSH, FTP, etc., disable it.
  • For the services you expose (the web server in your case) make sure you install security patches regularly.
  • If your service has some form of authentication (like WordPress admin page), be sure to pick a strong random password. Online bots usually check for default passwords and extremely weak combinations like root/r00t, but I wouldn't risk using any dictionary word, or anything shorter than 12-16 characters.
  • If you want to stop wasting resources on people who try to guess your password (assuming you have a good password) you can install Fail2Ban which bans an IP address for 10 minutes after 6 failed login attempts, rendering password guessing scripts impractically slow. Of course, you can configure the ban delay and the number of attempts to your liking.
  • For services which are intended for a specific group of users (you, your company etc), you can also use other techniques like port knocking and limiting access to IP ranges you are likely to use to access your services (your country only, your ISP, your work ISP etc.).
Improve this answer
10
  • 5
    Change default ports always if possible, preferably for anything higher than 40.000. It doesn't add security but considerably reduce bots knocking you and wasting resources
    – Freedo
    Jul 21, 2015 at 16:15
  • I wouldn't risk using any dictionary word, or anything shorter than 12-16 characters The second piece of advice is good. The first piece of advice, however, means that you'll need to write the password down somewhere to remember it, which sort of defeats the point. There are plenty of extremely secure passwords with lots of words in them. Just choose very unlikely / uncommon / difficult to guess combinations.
    – Parthian Shot
    Jul 22, 2015 at 1:14
  • 1
    I didn't know that wow always learning, well I think this could be a problem if you install anything on your server, but i only install and keep what is needed, and I still think that if i have a rogue program on my box doing what it shouldn't I would have higher concerns than a rogue SSH, and i use public key authentication, at least not having SSH on port 22 avoids you being owned in 10 minutes when a new SSH 0 day appear, i would keep my advice but add : add a firewall rule to forward e.g port 40.000 to a <1024 port
    – Freedo
    Jul 22, 2015 at 2:26
  • 1
    @ParthianShot You don't have to write down random passwords, just use a password manager for them. I know it's possible to combine dictionary words to get a perfectly secure password, however, there are certain rules to respect if you want it to be secure. As I don't want to bloat my answer with a lengthy passage on how to pick good passwords, I just state the obvious: a random password of a certain lenght is secure. I don't say a dictionary-based password is necessarly bad, but it may be.
    – Dmitry Grigoryev
    Jul 22, 2015 at 14:35
  • 1
    @ParthianShot I use a key file which is stored on a thumb drive and is never accessible to an online attacker. But if you have a strong password you can remember, that's perfectly fine.
    – Dmitry Grigoryev
    Jul 22, 2015 at 20:38
5

As @william said, there is nothing to worry about if it's a bot (which it most probably is). If you would log also other traffic, you would also see many more bots trying to scan your server, connect via ssh, rdp... I am logging traffic on my ssh server, and each day I have hundreds of failed connection attempts from bots.

But if you notice also other suspicious activity that does not look that automated, you should look into the details.

Improve this answer
2
  • 2
    I recommend you to change your SSH port to something higher than 40.000 . It doesn't add security but from my experience greatly reduce the amount of bots trying to logging in and wasting bandwidth and resources
    – Freedo
    Jul 21, 2015 at 16:08
  • 2
    @Freedom Changing the port to one over 1023 is likely a bad idea -- it allows unprivileged users on your machine to imitate your SSH service. Sure, the hostkey will change, but so many people skip that blindly that this should be a real concern if you have more users than just yourself.
    – Chris Down
    Jul 22, 2015 at 1:58
3

It's just an automated bot trying to exploit vulnerable servers that run Wordpress. There's nothing to worry about and nothing to do about it, just make sure you're not running outdated services or one of them might find it like that.

Improve this answer
2

You could consider restricting the WordPress login access to your own IP by adding a htaccess file to the /wp-admin folder.

Everyone not coming from your IP would receive a 401 error.

However if you allow external users to log in to your site for commenting or posting content they would also be blocked unless you explictly whitelist their IP.

See this question for an example htaccess file.

Improve this answer
1
  • Thanks, yes I know. Fortunetely, I don't use Wordpress as mentioned. Also, I need admin to be active for multiple users / devices, with dynamic IPs as well.
    – forsberg
    Jul 21, 2015 at 15:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .