Are humans crawling the web trying basic passwords on admin logins?

I was scrolling through the live traffic portion of my wordfence today after getting an alert that someone was blocked for trying to login to a nonexistent admin account.

I was suprised how often what wordfence thinks is a human tries to login and access my sites admin. at times as often as every 5 minutes ... I was sure that someone was using some software to do it but maybe this is just a bunch of random people ?

If it is random real people there must by millions of people crawling websites seeing if they can guess their way in ?

I was curious if anyone has some knowledge in this area? Are these likely all different people or one person/network using some sort of slow hacking brute force on me?

Thanks for any input

Me and a friend of mine did this in the past, when we were bored at school. I think it's a mix of bored kids, hobby-hackers and professionals around the globe. While the first two groups likely just want to troll people, the professionals would try to exploit your website and squeezing every penny out of it.

I don't know if this is true, but based on what I've heard and read, I would guess it's a mix of these 3 groups.

Nekronomikon said:

Me and a friend of mine did this in the past, when we were bored at school. I think it's a mix of bored kids, hobby-hackers and professionals around the globe. While the first two groups likely just want to troll people, the professionals would try to exploit your website and squeezing every penny out of it.

I don't know if this is true, but based on what I've heard and read, I would guess it's a mix of these 3 groups.

Click to expand...

The site is so new I wonder where they found it at. When I saw all the attempts I tightened up my firewall settings further.

I was recently thinking sites like cutestats and all the others to check rankings/speed etc would be an easy place for people to pickup easy targets.

One more reason to not spend my time running my site through stuff like that hah.

Probably a bot impersonating a human.

MountainGuy said:

The site is so new I wonder where they found it at. When I saw all the attempts I tightened up my firewall settings further.

I was recently thinking sites like cutestats and all the others to check rankings/speed etc would be an easy place for people to pickup easy targets.

One more reason to not spend my time running my site through stuff like that hah.

Click to expand...

If I had to guess, I would say the hackers try to find new, fresh websites to hijack noobs, who don't have secured their website the proper way right from the beginning. These are very easy targets...

Usually bots/botnets/software.

I set my websites to ban all ip's after 1 failed password attempt and I'll often get (obviously) the same guy try a new ip/server about 1 second after the previously failed attempt. Humans would never be that fast.

What makes you think it's a human? Our servers are constantly under attack from people trying to guess login details sometimes several hundred per hour.

Using a decent password and by the looks of it a brute force hack detector which you already have you should be fine, until a Wordpress vulnerability is found.

Soucha said:

Usually bots/botnets/software.

I set my websites to ban all ip's after 1 failed password attempt and I'll often get (obviously) the same guy try a new ip/server about 1 second after the previously failed attempt. Humans would never be that fast.

Click to expand...

That is one way to weed out the casual kiddies playing about and those intent on getting in.

DamoHG said:

What makes you think it's a human? Our servers are constantly under attack from people trying to guess login details sometimes several hundred per hour.

Using a decent password and by the looks of it a brute force hack detector which you already have you should be fine, until a Wordpress vulnerability is found.

Click to expand...

I was suspicious it was not. I was just going off of how wordfence has them labeled when I am looking at the live traffic page.

it`s a botnet which searches the site by keywords; use a captcha and limit 3 attempts and you will be fine.

Some of them are really clever they contact by page/plugin source; as for example I have a dead dropshipping store in a pet niche; not even 1 visit; somehow I received an email via contact page from an Aliexpress seller in the same niche with an offer.

Really impressed.

Happened to me a couple of times and it always have me the spook. I changed my passwords to something stronger and more random each time. Thankfully, none of my sites have been hacked. Yet!

Definitely bots. Across my sites I get 1000's of login attempts daily. Some look very realistic.

I've created my own javascript checks, no standard stuff they could guess the variable names, and they still are able to attempt. Bot writers be state of the art these days.

MountainGuy said:

I was scrolling through the live traffic portion of my wordfence today after getting an alert that someone was blocked for trying to login to a nonexistent admin account.
I was suprised how often what wordfence thinks is a human tries to login and access my sites admin. at times as often as every 5 minutes ... I was sure that someone was using some software to do it but maybe this is just a bunch of random people ?
If it is random real people there must by millions of people crawling websites seeing if they can guess their way in ?
I was curious if anyone has some knowledge in this area? Are these likely all different people or one person/network using some sort of slow hacking brute force on me?
Thanks for any input

Click to expand...

At first, Wordfence it's very bad choice against password hack tries.
At second Wordfence it's also very bad because often block legal traffic and for this reason you can lose many valuable customers.
At third, if you host your site at VPS or dedicated server - you can block high number of requests from same IP at iptable level.

The strong password (not from dictionary, not such admin1) is the best way to protect you against password hack tries.
If you using weak password, hacker is able to easy make 10 000 attempts, where each will be from different IP address.

Because WP have a lot of footprints, there is very easy way to find all WP sites by making just 500 millions http requests,
As the next step, there will be only tries to hack blogs with weak passwords.

And NOT, it's not the human job - there are very fast and effective bots with list of most popular passwords,
as you can find for example on https://www.passwordrandom.com/most-popular-passwords

Cheers, Greg.