Suspicious URL being aimed at my site

[2ndmouse]

hi all

my log files are showing attempts to load the following url by someone in the Ukraine. I don't think it's a harmful request as it simply gets a 'bad request' response from the browser. Just wondering if anyone here has seen this type of request before and whether I should block the ip.

URL:

mysite.com/change-log+++++++++++++++++++++++++++++Result:+%E8%F1%EF%EE%EB%FC%E7%EE%E2%E0%ED%FB+%E4%E0%ED%ED%FB%E5+x_fields.txt;+%E8%F1%

Regards and happy new year

[esn003]

If you don't know what it is, I think you shoul block that IP (how do you do that?).
Better safe than sorry.............

[2ndmouse]

yes, I've already put a temporary block on the IP. It's a wordpress site and I use wordfence plugin to block the IP. however, if you have access to the server, the IP can be blocked from there.

[esn003]

"wordfence plugin" thank you for the tip. My site is also a Wordpres

[cheesedude]

Just wondering if anyone here has seen this type of request before and whether I should block the ip.

URL:

mysite.com/change-log+++++++++++++++++++++++++++++Result:+%E8%F1%EF%EE%EB%FC%E7%EE%E2%E0%ED%FB+%E4%E0%ED%ED%FB%E5+x_fields.txt;+%E8%F1%

I get those types of requests all the time, usually from Russia, Ukraine, and China. I'm not sure what the intention is, but my guess is that some bot is probing for any type of security vulnerability it can find. If you block the IP then you can expect to block more IPs because it isn't hard for a hacker to find a new IP address.

[2ndmouse]

Thanks cheesedude

I guess this type of request is not doing any harm. However, I have noticed an attempt to login (this time from USA) to my wordpress admin where the user name was entered as:

"t|post[body]|post[message]|post_comment_root|post_comment_source|post_data[message]|post_message|postcomment|PostComment_ascx$tbComment|poster_"

The login failed, but I'm a little worried by what they are trying to attempt here - any ideas anyone?

Regards

[esn003]

The only thing you can do is to change (or remove) any user's name begining with 'admin'.
The funny point here is that I got the same thing on my site and that leeds me to think of a bot doing "research";-)

[logic_earth]

Running a Wordpress site you are going to be scanned and probed, nothing you can do about that. Wordpress is filled with vulnerabilities, you need to keep it updated. This is why I don't use it for client sites, they always get too lazy and fail to update.

[esn003]

"t|post[body]|post[message]|post_comment_root|post_comment_source|post_data[message]|post_message|postcomment|PostComment_ascx$tbComment|poster_"

You have nothing to worry about here.
1. The user name is to long according to any standard.
2. It contains characters parsed out by WordPress.
3. The login failed...

I am so greatfull to you for suggesting this plugin.
Now I have 'friends' all over the world, some of them........