still getting same attacks user ADMIN but I have blocked the IP already

Viewing 3 replies - 1 through 3 (of 3 total)

  • Did you get a response to this? I’m having the exact same issue. I’ve completely locked down my admin area and change the login page name twice. Still getting at least 80 emails a day showing different IP’s trying to use ADMIN as a login. Thinking it’s an issue with the wp-login file? Anyone have a solution?

    I have a similar problem! This attack from the blocked IP.

    Also, I occasionally get messages about changing the files on my site.

    People, please give competent advice!

    [email protected]

    (@jjacksonmakeitcompletecom)

    I have the same problem. I am running a server with about 100 WP sites. I also have fail2ban running on the server. There may be a conflict with the 2. I can see in my logs where the user starts getting a 403 after a number of login attempts.

    91.210.146.126 – – [26/Jun/2016:06:41:01 -0400] “POST /wp-login.php HTTP/1.1” 200 10233 “https://rory.com/wp-login.php” “Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.57 Safari/537.36”
    91.210.146.126 – – [26/Jun/2016:06:41:03 -0400] “POST /wp-login.php HTTP/1.1” 200 10849 “https://rory.com/wp-login.php” “Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.57 Safari/537.36”
    91.210.146.126 – – [26/Jun/2016:06:48:21 -0400] “POST /wp-login.php HTTP/1.1” 200 10233 “https://rory.com/wp-login.php” “Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.57 Safari/537.36”
    91.210.146.126 – – [26/Jun/2016:06:48:27 -0400] “POST /wp-login.php HTTP/1.1” 200 10849 “https://rory.com/wp-login.php” “Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.57 Safari/537.36”
    91.210.146.126 – – [26/Jun/2016:06:55:30 -0400] “POST /wp-login.php HTTP/1.1” 403 2243 “https://rory.com/wp-login.php” “Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.57 Safari/537.36”
    91.210.146.126 – – [26/Jun/2016:06:55:33 -0400] “POST /wp-login.php HTTP/1.1” 403 2185 “https://rory.com/wp-login.php” “Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.57 Safari/537.36”

    However I continue to see log entries for blocking.

Viewing 3 replies - 1 through 3 (of 3 total)
  • The topic ‘still getting same attacks user ADMIN but I have blocked the IP already’ is closed to new replies.