Is Site Under Attack by Spoofed IPs or From Behind VPN?

  • Resolved starapple

    (@starapple)


    1 year, 6 months ago

    I get scores of emails per day about IPs being blocked for too many attempts to break into the admin area of our site. What I notice is that while there might be 30 different IP addresses, the usernames might be the same or slight variations of a basic one. For example, I just noticed wadminw was associated with suposed tries from France, Holland and Germany, an almost impossible probability that three hackers in different countries decided on the same username (outside of the usual admin).

    How effective is WordFence really if many of the IP addresses blocked are not those of the hackers but legitimate users who on an off chance might visit the site and find themselves locked out?

    What also befuddles me is that while anyone attempting to access example.com/wp-admin is automatically sent to a 404 page, these many attempts st breaking in can still access the log-in URL.

    Is there something to be fixed or corrected?

    • This topic was modified 1 year, 6 months ago by starapple.
Viewing 4 replies - 1 through 4 (of 4 total)
  • Thread Starter starapple

    (@starapple)

    The latest examples (highlighted) of the same username coming from different supposed countries only seconds apart:

    “The last username they tried to sign in with was: ‘Support‘.
    “The duration of the lockout is 2 months.
    User IP: 13.237.17.8
    User hostname:?ec2-13-237-17-8.ap-southeast-2.compute.amazonaws.com
    User location: Sydney, New South Wales, Australia“

    (2) “The last username they tried to sign in with was: ‘Support‘.
    “The duration of the lockout is 2 months.
    User IP: 52.66.170.70
    User hostname:?ec2-52-66-170-70.ap-south-1.compute.amazonaws.com
    User location: Mumbai, India“

    And then I get a report about all the IPs blocked by country.

    Plugin Support wfpeter

    (@wfpeter)

    Hi @starapple, thanks for your questions.

    If you believe any of these attempts are legitimate users we recommend that online stores, or sites that handle many user logins have strict settings such as Wordfence > All Options > Brute Force Protection > Immediately lock out invalid usernames turned off.

    You can also check if IP detection on your site is working properly to see whether blocks intended for malicious activity are also affecting legtimate visitors. Take note of your own IP – (note that this detection can sometimes not be 100% accurate on cellular phone network connections): https://www.whatsmyip.org. Then head over to Wordfence > All Options > General Wordfence Options > How does Wordfence get IPs and reference the area under that section that says Detected IPs and Your IP with this setting. See if any of the options there when picked accurately reflect your IP. If one does, don’t forget to hit the SAVE CHANGES button in the top-right after you’re done.

    If the above options seem to be fine, seeing many access attempts such as this, especially if there seems to be no logical reason can be frustrating, but is actually quite a normal occurrence. You might find the following blog post interesting: https://www.wordfence.com/blog/2018/03/ask-wordfence-why-is-an-insignificant-site-like-mine-being-attacked/

    Wordfence, as an endpoint firewall cannot stop a bot or human from trying to visit your website altogether, but rather deal with the visits appropriately based on your settings, and their behavior. If you’re noticing many of these are spam registration/sign-in attempts, having reCAPTCHA enabled should dramatically reduce amount of username submissions as shown in your Live Traffic examples above.

    Let me know how you get on!
    Peter.

    Thread Starter starapple

    (@starapple)

    Thanks for your suggestion @wfpeter. I will add the reCAPTCHA presently. I believe it is one person working his butt off trying to gain entry because of the frequency of the usernames in each cycle of attacks. They change their IP but give each username a few tries.

    I’ll read that article because I ask myself the same question.

    Mark.

    Plugin Support wfpeter

    (@wfpeter)

    No worries, best of luck going forward @starapple.

    If you have further Wordfence questions in future by all means start up a new topic and we’ll be glad to help out.

    Peter.

Viewing 4 replies - 1 through 4 (of 4 total)
  • The topic ‘Is Site Under Attack by Spoofed IPs or From Behind VPN?’ is closed to new replies.

Tags