0

We have been contacted by our server host provider about Unwanted and or Abusive Web http Requests going out from our server. The information they gave us are.

  • Block Type: New Ban
  • Time: 2015-10-01 17:26:23-07:00
  • Port: 80
  • Service: http
  • Targeted Range: ip
  • Targeted URL: wp-login.php
  • User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0
  • GET/POST Arguments Sent: pwd, wp-submit, testcookie, log

How can I find out what website or script send out the request. I check all my logs files for the above information but couldn't find any record or may be I have checked wrong log files. Appreciated for any type of help.

Forgot to mention that our server has linux CENTOS 6 OS installed. The request is going out from our server, targeting a wordpress website, means may be a module in our website is requesting or trying to login to other websites to get some information.

0

Since you're posting on the Unix and Linux Stack Exchange site, I assume that the server in question is Linux, or a BSD varian. The User Agent string implies a Windows operating system. It's not so much that another website made the request, it's that a program (script or executable) that your sever executed made the request. The GET/POST arguments sent are consistent with a WordPress login. I conclude that your server has probably been hacked, and that the hackers ran a WordPress login guesser - a program that tries logging in to a WordPress site with every password and user ID that it has in a file or set of files.

I'm not even sure where to tell you to start looking for the login guesser, given how little information you've given us to start with, so edit your question to add more information for any additional help.

  • Thanks for your reply, and yes its Linux in our server. I have checked all log files using 'grep' and 'cat' but couldn't find information as mentioned. Is there any other way (command) to find out http requests gone out from our server? Also I am trying to search much I can. – Fazli Hassan Oct 2 '15 at 15:46
  • You should look for the login guesser itself. I sincerely doubt it will leave a log file behind, but stranger things have happened. You will not find any record of its outgoing HTTP requests, unless you are doing egress filtering or something like that. Since the login guesser is a hacker tool, it's not going to be polite and put entries in some other system's log file. – Bruce Ediger Oct 2 '15 at 18:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.