3

From today morning, I am witnessing a series of continuous POST requests hitting on one of blog running on wordpress software on my server.

Few things about this pattern:

  1. These continuous requests last for 2 minutes every-time
  2. In this 2 minute duration, 4 POST request hits every second at wp-login.php
  3. Then these requests go silent, and start again after 1 hour, again last for 2 minutes, with 4 request every second.
  4. Everytime IP address is different
  5. All IPs traced belong to China
  6. Tried blocking IPs but its easy for them to evade, as every hour they hit with new IP

I am using nginx, is there any way by which I can block such attempts to hack. It is a bigger concern because when these requests come, several times, other websites running on same server gets hampered. If anyone can provide any pointers of how to secure your server from such attempts, are most welcome.

Please find below, excerpt from logs.

xx.153.217.xxx - - [12/Jan/2015:13:45:13 +0530] "POST /wp-login.php HTTP/1.1" 200 3662 "http://blog.xxxxxx.in/wp-login.php" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)"
xx.153.217.xxx - - [12/Jan/2015:13:45:13 +0530] "POST /wp-login.php HTTP/1.1" 200 3662 "http://blog.xxxxxx.in/wp-login.php" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)"
xx.153.217.xxx - - [12/Jan/2015:13:45:13 +0530] "POST /wp-login.php HTTP/1.1" 200 3662 "http://blog.xxxxxx.in/wp-login.php" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)"
xx.153.217.xxx - - [12/Jan/2015:13:45:13 +0530] "POST /wp-login.php HTTP/1.1" 200 3662 "http://blog.xxxxxx.in/wp-login.php" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)"
xx.153.217.xxx - - [12/Jan/2015:13:45:14 +0530] "POST /wp-login.php HTTP/1.1" 200 3662 "http://blog.xxxxxx.in/wp-login.php" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)"
xx.153.217.xxx - - [12/Jan/2015:13:45:14 +0530] "POST /wp-login.php HTTP/1.1" 200 3662 "http://blog.xxxxxx.in/wp-login.php" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)"
xx.153.217.xxx - - [12/Jan/2015:13:45:14 +0530] "POST /wp-login.php HTTP/1.1" 200 3662 "http://blog.xxxxxx.in/wp-login.php" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)"
xx.153.217.xxx - - [12/Jan/2015:13:45:14 +0530] "POST /wp-login.php HTTP/1.1" 200 3662 "http://blog.xxxxxx.in/wp-login.php" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)"
xx.153.217.xxx - - [12/Jan/2015:13:45:15 +0530] "POST /wp-login.php HTTP/1.1" 200 3662 "http://blog.xxxxxx.in/wp-login.php" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)"
xx.153.217.xxx - - [12/Jan/2015:13:45:15 +0530] "POST /wp-login.php HTTP/1.1" 200 3662 "http://blog.xxxxxx.in/wp-login.php" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)"
xx.153.217.xxx - - [12/Jan/2015:13:45:15 +0530] "POST /wp-login.php HTTP/1.1" 200 3662 "http://blog.xxxxxx.in/wp-login.php" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)"
xx.153.217.xxx - - [12/Jan/2015:13:45:15 +0530] "POST /wp-login.php HTTP/1.1" 200 3662 "http://blog.xxxxxx.in/wp-login.php" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)"
xx.153.217.xxx - - [12/Jan/2015:13:45:16 +0530] "POST /wp-login.php HTTP/1.1" 200 3662 "http://blog.xxxxxx.in/wp-login.php" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)"
xx.153.217.xxx - - [12/Jan/2015:13:45:16 +0530] "POST /wp-login.php HTTP/1.1" 200 3662 "http://blog.xxxxxx.in/wp-login.php" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)"
xx.153.217.xxx - - [12/Jan/2015:13:45:16 +0530] "POST /wp-login.php HTTP/1.1" 200 3662 "http://blog.xxxxxx.in/wp-login.php" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)"
xx.153.217.xxx - - [12/Jan/2015:13:45:16 +0530] "POST /wp-login.php HTTP/1.1" 200 3662 "http://blog.xxxxxx.in/wp-login.php" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)"
13

My preferred way of dealing with this is to block access to anything in the /wp-admin/ folder and /wp-login.php to everywhere except a known static IP, say the IP of your office. Barring that, look into fail2ban or any number of wordpress plugins that can handle mitigating these brute-force hacking attempts.

  • I do that server-wide with a htpasswd in a Apache <Location> block instead. You can even include the username/password in the 'realm' and therefore in the message the user sees. It still protects against bots. However, I had to reconsider including /wp-admin in that, because there are plug-ins that are loaded from there. Some image viewer was one. A customer called and said that one of their image pages asked for a password... – Halfgaar Jan 12 '15 at 19:59
  • @Halfgaar Yup, I do something similar, but instead of globally, I use a Location block that I include in the vhost file for any WP site. – EEAA Jan 12 '15 at 20:06
3

Yep, it probably is a series of attempts to compromise your server.

Keep your entire system updated, don't use weak passwords, and keep a series of backups in case they manage to succeed.

  • This, and perhaps implement a plugin which enforces increasing delays to an account/IP after multiple login attempts – Jon Story Jan 12 '15 at 16:22
  • @JonStory it's better to do that using fail2ban or just restricting the login page to a known IP at the web server level; it'll be less resource-hungry than hitting the database on each login attempt. – user186340 Jan 12 '15 at 16:53
  • Fail2Ban would also work, and is on the same basic theory as a login-delaying plugin, it depends whether you care about 4 requests a second (as in this case) in terms of resources. On the systems I run, 4 requests per second is trivial and I'm far more concerned with account security. --- Restricting logins to known IPs will work under many circumstances, but is entirely unfeasible in others, it's effective but very situational. – Jon Story Jan 12 '15 at 16:55
  • There's a few packages that aid in that, yes. Solutions like fail2ban, denyhosts, and others of their ilk are usually highly recommended. Keeping the number of listening services to a minimum, intelligent firewall management, and signature based IPS are good too. That said, I think a a full DMZ hardening white paper for an answer would be way outside the scope. – Hyppy Jan 12 '15 at 16:56
  • Problem with restricting access to IP is that, is blog has multiple authors sitting at different geographies and on top of that they have dynamic IP allocated to them by their ISP makes it very hard to keep IP as a constraint – Abhi Jan 13 '15 at 6:47
0

looks like someone is trying to breakin to yoour system. Nowadays there are lots of brute forcing tools like THC hydra brutus which help to do these kind of attacks. What i personally suggest is to restrict all other entry except for to particular IP. For this you can make use of the .htaccess.
you can also make use of the fail2Ban to provice additional protection. Hope this helps

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.