SIGNIFICANT INCREASE IN ATTACKS

  • Resolved GIORGOS DIMOPOULOS

    (@giorgos_d2)


    1 year, 4 months ago

    for a few days now, I see it in the plugin statistics and in live traffic every 10-15 minutes are blocked by wordfence and wordfence shows the following from different countries and ip s and everything around has the word wp-config: what’s going on please ???? ?

    example 1

    Type: Blocked

    ? Fall River, Massachusetts, United States was blocked by firewall for Known malicious User-Agents at https://mysite//wp-config.php_original

    4/11/2023 1:30:23 PM (19 minutes ago)

    IP: 50.203.192.242 Hostname: 50.203.192.242

    Human/Bot: Human

    Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0 ?

    Example 2

    ?

    Type: Blocked

    Moscow, Russia was blocked by firewall for Known malicious User-Agents at https://mysite//wp-config.phpb

    4/11/2023 1:58:15 μ.μ. (7 minutes ago)

    IP:95.31.43.101

    Hostname:?95-31-43-101.broadband.corbina.ru

    Human/Bot:Human

    Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0

Viewing 3 replies - 1 through 3 (of 3 total)
  • Plugin Support wfmark

    (@wfmark)

    Hi @giorgos_d2, Thank you for reaching out.

    A user-agent is a way for an internet browser to send information about itself to a web server. These are blocks for user-agents that are fake and account for a lot of malicious traffic. Wordfence blocks common malicious user agents that frequently perform attacks on WordPress sites.

    The requested URLs in your case are  https://mysite//wp-config.phpb and https://mysite//wp-config.php_original which is very suspicious as they are looking to access the wp-config.php file for your site. This explains why these requests were blocked.

    While it’s alarming to see these attacks, there’s nothing more for you to do since Wordfence is already blocking 

    Thanks,

    Mark.

    Thread Starter GIORGOS DIMOPOULOS

    (@giorgos_d2)

    Yes, this has been happening for the last two or three days, please do something, also unlink the second link from my fisrt answer because I can’t edit it anymore and the link leads to my website ( https:// (mysite)//wp-config .phpb )

    Plugin Support wfmark

    (@wfmark)

    Hi @giorgos_d2, Sorry for the delayed response.

    The attacks are already being blocked by Wordfence. I understand  it’s alarming to see these attacks, but there’s nothing more for you to do since Wordfence is already blocking them.

    I cannot edit a topic on my end either but the link redirects to the home page.

    Thanks,

    Mark.

Viewing 3 replies - 1 through 3 (of 3 total)
  • The topic ‘SIGNIFICANT INCREASE IN ATTACKS’ is closed to new replies.