Tag: brute force

Brute Force Login Attack, 2017 Feb 14

Happy Valentine’s Day, and someone loves me out there on the Internet, because they used a botnet to try to break into my site. You are very welcome, whomever you are, but I am trying to find out who is my secret admirer.

There are 12 IPs involved. The each try 2 times.
User Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.89 Safari/537.36

This is a preview of Brute Force Login Attack, 2017 Feb 14. Read the full post (412 words, 0 images, estimated 1:39 mins reading time)

Brute Force Login Attack: 2017 Feb 11

Yet another brute force attack that I would like to document. The first two, from China and India, are bad dudes.

UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:40.0) Gecko/20100101 Firefox/40.0

42.62.11.58 s Forest Eternal Com Cn, Risk 10/10, spam, bots malware (200): Spam Zero-Day, Doc.Dropper.Agent-5664104-0

117.245.8.122 s Wimax Bharat Sanchar Nigam BSNL In, Risk 7.1/10, spam, bots, malware: Spam Zero-Day, Doc.Dropper.Agent-5664104-0

213.119.94.181 s Telenet Operaties Belgium, Risk 8.6/10, spam, bots, scanning IPs

They are banned, never to return with these IPs

Permanent link to this post (83 words, 0 images, estimated 20 secs reading time)

Pan China Brute Force Login Attack

It is always warming to see the two Chinas, the PRC and Taiwan, getting along. Today they ganged up and tried to break into my site.

60.217.64.210 s China Unicom Shandong, level 10 risk, malware Spam Zero-Day
60.248.0.230 s Hinet Chunghwa Tel Taiwan, known for bots and infected zombie computers
183.167.228.134 s Chinanet Anhui, level 10 risk, malware Spam Zero-Day
218.21.43.238 s Dou shi-BAR Yin chuan Ningxia, level 10 risk, malware Spam Zero-Day

The last one, from Ningxia, looks surprisingly small as compared to the usually huge number of IP addresses for Chinanet or China Unicom, but they are part of Chinanet Ningxia, which is large.

This is a preview of Pan China Brute Force Login Attack. Read the full post (146 words, 0 images, estimated 35 secs reading time)

Brute Force Login Attack: 2017 Jan 23

It is always good to see international cooperation amongst different nations in this great world. However, when China, India and Russia cooperate to try to break into my site, forgive me when I get a little upset. While I usually file complaints to internet host providers, in this case the complaint would fall on deaf ears: hosts in China, India and Russia ignore abuse emails. Then most hosts from all over the world ignore abuse emails.

Number of login attempts: 417
All the user agent names are the same: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:40.0) Gecko/20100101 Firefox/40.0

This is a preview of Brute Force Login Attack: 2017 Jan 23. Read the full post (2247 words, 0 images, estimated 8:59 mins reading time)

Brute Force Login Attacks: 2016 Dec 20, Two Types

Why is today so special? It looks like two separate groups tried their own brute force login attacks on my site, each using a different technique. There were a total of 510 login attempts today on my site.

The first technique is to use a low number of IPs, but try numerous times. UA: “Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:40.0) Gecko/20100101 Firefox/40.0”

37.159.245.182 VODAFONE-IT: 51 login attempts
91.234.226.103 SIPCOM UA: 116 login attempts
183.64.62.26 CHINANET Jiangsu: 109 login attempts
223.196.88.191 Idea Cellular In: 51 logi attempts

This is a preview of Brute Force Login Attacks: 2016 Dec 20, Two Types. Read the full post (1899 words, 0 images, estimated 7:36 mins reading time)

Brute Force Login Attack: 2016 Dec 19

Again, they come, but this time with individual IPs. Huh? Not so funny anymore. 18 individual IP, all timed differently.

UA: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.89 Safari/537.36

103.1.173.103 [19/Dec/2016:05:57:06
103.18.5.22 [19/Dec/2016:04:57:30
139.59.1.139 [19/Dec/2016:05:47:03
144.208.66.8 [19/Dec/2016:06:26:51
162.220.58.205 [19/Dec/2016:02:47:14
173.188.123.130 [19/Dec/2016:06:24:53
185.103.197.198 [19/Dec/2016:05:00:34
189.1.168.10 [19/Dec/2016:06:09:05
198.1.91.13 [19/Dec/2016:05:06:45
200.34.204.5 [19/Dec/2016:01:26:45
201.160.106.35 [19/Dec/2016:03:27:25
216.157.108.17 [19/Dec/2016:04:17:17
31.210.61.34 [19/Dec/2016:02:58:33
37.187.240.112 [19/Dec/2016:06:34:02
64.37.49.155 [19/Dec/2016:05:33:19
71.92.251.210 [19/Dec/2016:03:28:52
92.243.29.161 [19/Dec/2016:06:24:52
96.30.62.52 [19/Dec/2016:04:44:31

96.30.62.52

Permanent link to this post (71 words, 0 images, estimated 17 secs reading time)

Brute Force Login Attack on WordPress: Case Study

Strong, WordPress is, otherwise it would have been breached long ago. These three attackers did a brute force login attack on me today. This is not the first and will certainly not be the last. While I can track down the IP and ISP, and ban them, their origins I will never know. This is the murky world of the internet, and it is worldwide.

41.76.123.243: 41.76.123.0 – 41.76.123.255 WIFLY GA GABON has tried security hacks on my site before, 6 attempts
171.25.194.89 mes.megion.ru 171.25.194.0 – 171.25.195.255 Lider Telecom Ru, 52 attempts
117.255.233.117 117.255.224.0 – 117.255.255.255 Wimax New Delhi IN, 8 attempts
117.253.234.15

Three hackers, one from Africa, one from Russia, one from India. This is the global entity called the Internet.

This is a preview of Brute Force Login Attack on WordPress: Case Study. Read the full post (602 words, 0 images, estimated 2:24 mins reading time)

Brute Force xmlrpc.php Attack on WordPress: Case Study

Brute force attacked, I was, for the xmlrpc.php API in WordPress. Thankfully WordPress was strong enough to ward off this attack. I’ve had random attacks on xmlrpc.php before, but nothing this organized. I thought I’d document a case of 57 xmlrpc.php POST attempts here for all to see. Maybe someone can identify the culprit, as I could not.

I had 57 POSTs to xmlrpc.php on WordPress. They are randomly spaced apart throughout the day, use different IP addresses and hosts, but use the same POST (POST /wp/xmlrpc.php HTTP/1.0), referrer (http://dontai.com/wp/xmlrpc.php) and user agent (Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; Touch; rv:11.0) like Gecko)

This is a preview of Brute Force xmlrpc.php Attack on WordPress: Case Study. Read the full post (1619 words, 0 images, estimated 6:29 mins reading time)