8

Not sure if I should report it here, but within my website I collect each request in DB, and from time to time view these records. Among data collected are user agent, reqested url, referrer (i.e. previous) url, time, and others.

Today I found a following user agent bot (which seems to hide this):

(Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko

IP:

181.114.49.183

Most of requests are within 1-2 seconds intervals, and the most interesting is what urls it wants my server to check:

| /wp/wp-login.php | | /blog/wp-login.php | | /site/wp-login.php | | /cms/wp-login.php | | /section/wp-login.php | | /wp-admin/wp-login.php | | /wordpress/wp-login.php |

(from my DB)

Referrer in each cases is null (meaning there was no referrer; it expected to find a webpage at this uri).

Why a bot may possibly want to check if there is a wordpress installed on a webpage, and what is its url (my website doesn't use wordpress, or any other CMS)? To me, it's like searching for a possible way to get into an admin panel of the website. And I do have an admin panel which I created myself.

Should I do anything about it?

  • 37
    Welcome to the internet! A place where your door will be knocked on frequently and there is very little you can do about it! Just make sure that a mere knock doesn't grant access :-) – MonkeyZeus Jul 21 '15 at 15:11
  • 5
    Most Hosters allow you to maintain a "blocked IPs" list. If you are not using wordpress, you could place a script in /wp/wp-login.php that writes the bots IP straight to the banlist. – iHaveacomputer Jul 21 '15 at 23:42
27

Every computer with a public IP gets this kind of attention permanently. There's nothing you can do to stop it (I once tried to complain to the provider owning the IP, never got a reply and gave up). What you can do is to make sure you're well protected against a possible attack (this bot seemed to look for WordPress, but there are others looking for apache, ssh, you name it). A few rules:

  • Expose as few services as possible. If you don't need SSH, FTP, etc., disable it.
  • For the services you expose (the web server in your case) make sure you install security patches regularly.
  • If your service has some form of authentication (like WordPress admin page), be sure to pick a strong random password. Online bots usually check for default passwords and extremely weak combinations like root/r00t, but I wouldn't risk using any dictionary word, or anything shorter than 12-16 characters.
  • If you want to stop wasting resources on people who try to guess your password (assuming you have a good password) you can install Fail2Ban which bans an IP address for 10 minutes after 6 failed login attempts, rendering password guessing scripts impractically slow. Of course, you can configure the ban delay and the number of attempts to your liking.
  • For services which are intended for a specific group of users (you, your company etc), you can also use other techniques like port knocking and limiting access to IP ranges you are likely to use to access your services (your country only, your ISP, your work ISP etc.).
  • 5
    Change default ports always if possible, preferably for anything higher than 40.000. It doesn't add security but considerably reduce bots knocking you and wasting resources – Freedo Jul 21 '15 at 16:15
  • I wouldn't risk using any dictionary word, or anything shorter than 12-16 characters The second piece of advice is good. The first piece of advice, however, means that you'll need to write the password down somewhere to remember it, which sort of defeats the point. There are plenty of extremely secure passwords with lots of words in them. Just choose very unlikely / uncommon / difficult to guess combinations. – Parthian Shot Jul 22 '15 at 1:14
  • 1
    I didn't know that wow always learning, well I think this could be a problem if you install anything on your server, but i only install and keep what is needed, and I still think that if i have a rogue program on my box doing what it shouldn't I would have higher concerns than a rogue SSH, and i use public key authentication, at least not having SSH on port 22 avoids you being owned in 10 minutes when a new SSH 0 day appear, i would keep my advice but add : add a firewall rule to forward e.g port 40.000 to a <1024 port – Freedo Jul 22 '15 at 2:26
  • 1
    @ParthianShot You don't have to write down random passwords, just use a password manager for them. I know it's possible to combine dictionary words to get a perfectly secure password, however, there are certain rules to respect if you want it to be secure. As I don't want to bloat my answer with a lengthy passage on how to pick good passwords, I just state the obvious: a random password of a certain lenght is secure. I don't say a dictionary-based password is necessarly bad, but it may be. – Dmitry Grigoryev Jul 22 '15 at 14:35
  • 1
    @ParthianShot I use a key file which is stored on a thumb drive and is never accessible to an online attacker. But if you have a strong password you can remember, that's perfectly fine. – Dmitry Grigoryev Jul 22 '15 at 20:38
1

You could consider restricting the WordPress login access to your own IP by adding a htaccess file to the /wp-admin folder.

Everyone not coming from your IP would receive a 401 error.

However if you allow external users to log in to your site for commenting or posting content they would also be blocked unless you explictly whitelist their IP.

See this question for an example htaccess file.

  • Thanks, yes I know. Fortunetely, I don't use Wordpress as mentioned. Also, I need admin to be active for multiple users / devices, with dynamic IPs as well. – forsberg Jul 21 '15 at 15:50
4

As @william said, there is nothing to worry about if it's a bot (which it most probably is). If you would log also other traffic, you would also see many more bots trying to scan your server, connect via ssh, rdp... I am logging traffic on my ssh server, and each day I have hundreds of failed connection attempts from bots.

But if you notice also other suspicious activity that does not look that automated, you should look into the details.

  • 2
    I recommend you to change your SSH port to something higher than 40.000 . It doesn't add security but from my experience greatly reduce the amount of bots trying to logging in and wasting bandwidth and resources – Freedo Jul 21 '15 at 16:08
  • 2
    @Freedom Changing the port to one over 1023 is likely a bad idea -- it allows unprivileged users on your machine to imitate your SSH service. Sure, the hostkey will change, but so many people skip that blindly that this should be a real concern if you have more users than just yourself. – Chris Down Jul 22 '15 at 1:58
2

It's just an automated bot trying to exploit vulnerable servers that run Wordpress. There's nothing to worry about and nothing to do about it, just make sure you're not running outdated services or one of them might find it like that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.