{"id":22142,"date":"2013-04-16T09:59:30","date_gmt":"2013-04-16T15:59:30","guid":{"rendered":"http:\/\/rankexploits.com\/musings\/?p=22142"},"modified":"2013-04-22T18:01:06","modified_gmt":"2013-04-23T00:01:06","slug":"superbot-l0gin-attempts-proxies","status":"publish","type":"post","link":"https:\/\/rankexploits.com\/musings\/2013\/superbot-l0gin-attempts-proxies\/","title":{"rendered":"Superbot(?) l0gin attempts: Proxies."},"content":{"rendered":"

The superbotnet warnings have, of course, motivated me to check my logs. (In truth, part of the slow blogging just prior to the warnings were motivated by my seeing more bot activity at the domain I should have called ‘thebothoneypot.com’, but is instead called ‘banNasties.com’.) I installed a wordpress blog on the subdomain ‘blog.bannasties.com’. It is a very boring<\/i> blog and, moreover, a bit dangerous for humans<\/em> to visit. (Not the blog so much. But if you click links that run queries on banNasties.com, there is the possibility of getting banned.) From my point of view, the main function of that blog and domain is for me to keep track of things I noticed in my killed_log.txt files without filling up this<\/I> blog with discussions of bot-attacks and to test stronger rules for ZBblock. <\/p>\n

However, I also know that climate bloggers have been hacked, so I want to describe what I am seeing at that<\/i> site which for various reasons lets me monitor rather intensively. <\/p>\n

One of the things I noticed is that some ‘bad’ IPs have been trying to cloak their IP using proxies. For example: I’m having particular trouble with ‘41.129.119.143’ using a proxy to try to hack into wp-login.php at that site. <\/p>\n

In the past two weeks ending yesterday, it has attempted to log in at least<\/i> 59 times using these proxy IPs:
\n93.176.62.190 , 89.248.96.54 , 89.218.214.122 , 89.218.100.58 , 80.191.78.251 , 78.47.198.26 , 77.104.73.117 , 49.156.57.50 , 46.118.122.151 , 41.78.79.126 , 41.42.194.72 , 41.234.26.165 , 41.234.24.49 , 41.234.2.215 , 41.129.30.32 , 41.129.18.193 , 31.217.215.131 , 27.50.18.219 , 23.30.90.105 , 219.117.232.5 , 203.172.128.158 , 201.252.69.164 , 201.246.1.98 , 201.230.50.222 , 200.42.22.140 , 200.19.108.105 , 2.133.93.82 , 2.133.93.250 , 190.73.150.108 , 190.37.108.169 , 190.12.86.211 , 187.33.89.38 , 186.47.16.165 , 185.2.12.12 , 184.170.246.175 , 180.253.68.146 , 178.89.107.230 , 177.87.242.194 , 177.43.105.18 , 174.136.43.116 , 163.152.133.22 , 139.0.0.178 , 124.81.117.226 , 122.129.108.66 , 121.97.197.108 , 118.99.81.6 , 118.99.76.91 , 118.99.67.158 , 118.99.65.246 , 118.99.64.78 , 118.99.64.120 , 118.97.223.210 , 118.96.136.209 , 112.78.140.235 , 110.74.222.5 , 110.74.196.161 , 109.94.106.249 , 108.178.49.23 <\/code><\/p>\n

This list is limited to IPs that were blocked by my installation of ZBBlock (which includes my custom signatures). Any connections not stopped by ZBBlock would not have made it onto this list. Over the past two weeks, I beefed up blocking of bots visiting that bot-attractant site to block anything<\/i> trying to log into that site<\/i> if it’s headers indicate it is forwarding. I’m reasonably sure that my rules were missing some visits by 46.118.122.151 (or anything similar) at earlier times. (Why about two weeks ago? After all, the superbotnet warming was only last weekened. Well… let’s just say I noticed increased bot activity and increased forwarding. Taking time to tweak to see what the heck is going on so I could report is one of the reason I blogged so lightly here<\/i> in early April!)<\/p>\n

Since the time of super-bot net warning I looked at a few things. With respect to 46.118.122.151, it looks like this particular IP visits do this: <\/p>\n

    \n
  1. IP 46.118.122.151 arrives behind a proxy.<\/li>\n
  2. Many of the proxies themselves are either already identified in ZBblock’s default signatures or look suspicious to me anyway. ( Lots of ‘boys from Brazil’. Some sovam.net.ua forwarding through sovam.net.ua and so on.)<\/li>\n
  3. It tries to connect with each proxy– each of which I ban. ( I’m pretty sure I ban that IP at Cloudflare for at least 7 days).<\/li>\n
  4. I tend to see batches of 4 or 5 attempts, then the script gives up and comes back 3-4 hour later, but sometimes it skips a beat and comes back 6-7 hours later. By 3-4 hours later, I mean: one back came through around 15:57:xx for 4 visits on Monday and returned at 18:52:xx- 18:58:xx (5 visits). It skipped and came back again at 1:57:xx (6 visits). Sometimes there are somewhat longer interruptions between these pattern. <\/li>\n<\/ol>\n

    Of course I can’t be sure what is driving these visits. I certainly know if this is part of the super botnet or even a regular botnet consisting of zombie-drone pcs and macs to forward requests. The fact is, my skillzzzz in knowing what the script-kiddies could do are limited. But the regular timing could be consistent with a script kiddie (or even someone with script writing skillz of his own!) who has access to a batch of proxy IPs. He’s got a script programmed to visit certain uri’s which the script tries to load. If an IP is banned, it tries another one; eventually runs through those IPs and possibly moves to another uri. Later in the day, loads up a new batch of proxy IPs and comes back. Or something. <\/p>\n

    Anyway, I’d suggest it’s certainly a script and it’s certainly a break in attempt. The super botnet warning suggest that the script tries to brute force passwords for username ‘admin’. If so, that bot ain’t going to get in anyway. I haven’t tried to log whether it’s trying to post or send “admin” as the user name! If I get curious, I might do it. Checking that could constitute a new ‘good rule’ for ZBblock. <\/p>\n

    I would suggest those bloggers who self host consider monitoring their wp-login.php attempts for anything that’s obviously forwarding. Because these are forwarding, plugins like “Limit Login” or “Login Lockdown” probably can’t helpe. If there is a wordpress plugin that blocks IPs that shows multiple entries in the X_forward headers from wp-login, finding it and activating it would be prudent. Mind you, I currently prefer adding a rule to ZBBlock and I think it is a vastly superior solution to the plugins mentioned in various security announcements. So I’m not going to look for a WordPress plugin nor write it. But if you use plugins, try to find one that blocks connections to wp-login. php that are forwarding.<\/p>\n

    Open Thread.<\/p>\n","protected":false},"excerpt":{"rendered":"

    The superbotnet warnings have, of course, motivated me to check my logs. (In truth, part of the slow blogging just prior to the warnings were motivated by my seeing more bot activity at the domain I should have called ‘thebothoneypot.com’, but is instead called ‘banNasties.com’.) I installed a wordpress blog on the subdomain ‘blog.bannasties.com’. It … Continue reading Superbot(?) l0gin attempts: Proxies.<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[15],"tags":[],"class_list":["post-22142","post","type-post","status-publish","format-standard","hentry","category-data-comparisons"],"_links":{"self":[{"href":"https:\/\/rankexploits.com\/musings\/wp-json\/wp\/v2\/posts\/22142","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rankexploits.com\/musings\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rankexploits.com\/musings\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rankexploits.com\/musings\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/rankexploits.com\/musings\/wp-json\/wp\/v2\/comments?post=22142"}],"version-history":[{"count":0,"href":"https:\/\/rankexploits.com\/musings\/wp-json\/wp\/v2\/posts\/22142\/revisions"}],"wp:attachment":[{"href":"https:\/\/rankexploits.com\/musings\/wp-json\/wp\/v2\/media?parent=22142"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rankexploits.com\/musings\/wp-json\/wp\/v2\/categories?post=22142"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rankexploits.com\/musings\/wp-json\/wp\/v2\/tags?post=22142"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}