Suspicious activity

Musudan · Apr 23, 2015

Hey, i'm trying to build my first website, i've installed wordfence plugin and the next day i've noticed some wired activity when i check Live Activity from WF, they all crawlers (0 humans).

I only have 2 posts atm and using WP Construction Mode plugin so nothing is visible, i need to know if this activity is normal.

Thanks for reply.

AutomationSorcerer · Apr 25, 2015

Looks like people scanning your website for vulnerabilities, probably found it through some arbitrary google search specific to the web CMS you have installed.

Back in the day, whenever PHPBB would have a vulnerability, you'd have mass defacing's from people just googling for every PHPBB site out there and running the exploit. There was a security camera at one point with a remote viewer using HTTP protocol; you could find random people's security cameras with a specific search term in google and just go creepy stalker mode on random people.

Same thing happens if you lease a dedicated server, and install SQL Server on the default port open to public. You'll get 1000 login attempts an hour for sa, from random IPs all over the place. I usually change to a different port to prevent the security audit log from filling up.

xNotch · Apr 25, 2015

When you have something running on the internet your going to be hit multiple times a day by random scripts trying to find vulnerabilities in your site. This is kind of just how things are. You should only be worried about these sorts of things if they succeed. So make sure you keep a close I on those logs.

AutomationSorcerer said:
Looks like people scanning your website for vulnerabilities, probably found it through some arbitrary google search specific to the web CMS you have installed.

Back in the day, whenever PHPBB would have a vulnerability, you'd have mass defacing's from people just googling for every PHPBB site out there and running the exploit. There was a security camera at one point with a remote viewer using HTTP protocol; you could find random people's security cameras with a specific search term in google and just go creepy stalker mode on random people.

Same thing happens if you lease a dedicated server, and install SQL Server on the default port open to public. You'll get 1000 login attempts an hour for sa, from random IPs all over the place. I usually change to a different port to prevent the security audit log from filling up.

There's a whole search engine devoted to finding random stuff people have decided to connect to the internet called Shodan.

AutomationSorcerer · Apr 25, 2015

Hah! Shodan is freaking brilliant. I'm definitely bookmarking this.

Suspicious activity

Musudan

Newbie

AutomationSorcerer

Registered Member

xNotch

Registered Member

AutomationSorcerer

Registered Member

Main Menu

Marketplace

Making Money

BlackHat World