wordpress blog be attacked by IP 217.66.216.68, interesting

cppgohan

Today I found my wordpress blog /wp-login access from IP: 217.66.216.68.
The machine access the /wp-login almost every second, I thought it just want to brute force my admin password then destroy the wordpress content.

Does any guys encounter similar problem, how do you get rid of that?

I just use nginx settings deny IP, I think it isn't good enough.

access.log

217.66.216.68 - - [02/Jul/2014:11:34:26 +0800] "POST /wp-login.php HTTP/1.0" 502 173 "-" "-"
217.66.216.68 - - [02/Jul/2014:11:34:28 +0800] "POST /wp-login.php HTTP/1.0" 502 173 "-" "-"
217.66.216.68 - - [02/Jul/2014:11:34:28 +0800] "POST /wp-login.php HTTP/1.0" 502 173 "-" "-"
217.66.216.68 - - [02/Jul/2014:11:34:29 +0800] "POST /wp-login.php HTTP/1.0" 502 173 "-" "-"
217.66.216.68 - - [02/Jul/2014:11:34:30 +0800] "POST /wp-login.php HTTP/1.0" 502 173 "-" "-"
217.66.216.68 - - [02/Jul/2014:11:34:31 +0800] "POST /wp-login.php HTTP/1.0" 502 173 "-" "-"
217.66.216.68 - - [02/Jul/2014:11:34:32 +0800] "POST /wp-login.php HTTP/1.0" 502 173 "-" "-"
217.66.216.68 - - [02/Jul/2014:11:34:33 +0800] "POST /wp-login.php HTTP/1.0" 502 173 "-" "-"
217.66.216.68 - - [02/Jul/2014:11:34:34 +0800] "POST /wp-login.php HTTP/1.0" 502 173 "-" "-"
217.66.216.68 - - [02/Jul/2014:11:34:40 +0800] "POST /wp-login.php HTTP/1.0" 502 173 "-" "-"

now I forbit the ip:

error.log

2014/07/02 16:00:33 [error] 26426#0: *156 access forbidden by rule, client: 217.66.216.68, server: blog.baozishan.in, request: "POST /wp-login.php HTTP/1.0", host: "blog.baozishan.in"
2014/07/02 16:00:34 [error] 26426#0: *157 access forbidden by rule, client: 217.66.216.68, server: blog.baozishan.in, request: "POST /wp-login.php HTTP/1.0", host: "blog.baozishan.in"
2014/07/02 16:00:35 [error] 26426#0: *158 access forbidden by rule, client: 217.66.216.68, server: blog.baozishan.in, request: "POST /wp-login.php HTTP/1.0", host: "blog.baozishan.in"

Thank all Good advise below!

@nexmark said: Block single ip by iptables

@namhuy said: Use captcha for login from

@wych: fail2ban plugin

@energytech: lockdown plugin to change admin url

nexmark

If it's a single ip, Why not drop it from IPTables?

rds100

Ok, we will send nukes to IRAN to make them stop. And to thousands of other IPs too, bruteforcing innocent wordpress installs on the net.

namhuy

install captcha for your login form, if you are a single user of your blog set directory password. properly just bots doing that.

wych

@namhuy said:
install captcha for your login form, if you are a single user of your blog set directory password. properly just bots doing that.

Captcha's can be easily cracked, get the fail2ban plugin.

energytech

You can use the 'lockdown' plugin to change the admin url

nexmark

Also, Can't you put .htaccess to deny all but your IP into
/wp-admin

wych

@nexmark said:
Also, Can't you put .htaccess to deny all but your IP into
/wp-admin

If your on a static IP yes, if not then I wouldn't.

namhuy

wych said: Captcha's can be easily cracked, get the fail2ban plugin.

for 'basic' protection, captcha plugin it's the easiest to install. How to secure wordpress website http://www.namhuy.net/2260/how-to-secure-wordpress-website.html

wych

@namhuy said:
for 'basic' protection, captcha plugin it's the easiest to install. How to secure wordpress website http://www.namhuy.net/2260/how-to-secure-wordpress-website.html

Im not argueing it offers basic protection, but I wouldn't say its adequate.

If your spending time implementing a solution may aswell go for a more suitable end result using fail2ban than a flawed image OCR system.