1

I looked at /admin/reports/dblog today. There were five request in two minutes by an anonymous user to view /wp-login.php. These requests have been happening for an hour at least and continue 2-3 times per minute.

  1. What are the possible explanations for this strange behavior?
  2. What can/should I do about it, if anything?
5
  • Sounds like a bot probing your site.
    – Kevin
    Commented Feb 28, 2017 at 20:16
  • 5
    It's just bots scanning for exploits. You don't need to do anything, except serving a faster 404 response for those pages, as described in drupal.stackexchange.com/a/152732/199.
    – apaderno
    Commented Feb 28, 2017 at 20:16
  • Even if these requests have been happening for an hour? Seems odd for a bot to be poking the same thing for such a long time. Commented Feb 28, 2017 at 20:17
  • May be bad programming by the bot, may be multiple bots, there are all sorts of reasons. As kiamlaluno said, nothing to worry about.
    – Jaypan
    Commented Mar 1, 2017 at 1:09
  • Fyi, that's the WordPress login page. They're not targeting your site specifically. Commented Mar 1, 2017 at 18:05

2 Answers 2

3

As kiamlaluno said:

It's just bots scanning for exploits. You don't need to do anything, except serving a faster 404 response for those pages, as described in drupal.stackexchange.com/a/152732/199.

0

For D8 you could use Drupal Perimeter Defence

Basic perimeter defence for a Drupal site. This module bans the IPs who send suspicious requests to the site. The concept is: if you have no business here, go away.

Use the perimeter module if you get a lot of requests to 'wp-admin' or to .aspx urls on a linux server, or other similar requests.

Currently, the module bans users who generate "page not found" events for requesting any of the following url patterns:

  private $bannedPatterns = [
    '/.*\.aspx/',
    '/.*\.asp/',
    '/.*\.jsp/',
    '/\/blog_edit\.php/',
    '/\/blogs\.php/',
    '/\/wp-admin.*/',
    '/\/my_blogs/',
    '/\/system\/.*\.php/',
    '/.*systopice.*/',
  ];

The module is optimized for performance and designed to be activated when a Drupal site is targeted by hackers or bots.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.