views: 1054
Safety in Obscurity
03-12-2022
Here's a selection of entries from my site's error.log, as various scripts and bots look for weaknesses to exploit. Notice any patterns?
That's... a lot of probing for Wordpress
[Sat Feb 12 20:37:11.957444 2022] script '/var/www/willow.willisnet.io/public_html/wp-login.php' not found or unable to stat [Sun Feb 13 20:44:39.832111 2022] script '/var/www/willow.willisnet.io/public_html/wp-login.php' not found or unable to stat [Mon Feb 14 22:55:03.930622 2022] script '/var/www/willow.willisnet.io/public_html/wp-login.php' not found or unable to stat [Tue Feb 15 13:32:45.147151 2022] script '/var/www/willow.willisnet.io/public_html/wp-login.php' not found or unable to stat [Tue Feb 15 15:04:10.581003 2022] script '/var/www/willow.willisnet.io/public_html/wp-login.php' not found or unable to stat [Fri Feb 18 18:50:10.774268 2022] script '/var/www/shemake.dev/public_html/wp-info.php' not found or unable to stat [Fri Feb 18 18:50:11.766806 2022] script '/var/www/shemake.dev/public_html/wp_wrong_datlib.php' not found or unable to stat [Fri Feb 18 21:14:33.667297 2022] script '/var/www/shemake.dev/public_html/wp-login.php' not found or unable to stat [Sat Feb 19 08:22:15.296714 2022] script '/var/www/shemake.dev/public_html/wp-login.php' not found or unable to stat [Sun Feb 20 09:28:10.262804 2022] script '/var/www/shemake.dev/public_html/wp-login.php' not found or unable to stat [Mon Feb 21 01:28:40.316892 2022] script '/var/www/shemake.dev/public_html/wp-login.php' not found or unable to stat [Mon Feb 21 06:30:19.087131 2022] script '/var/www/shemake.dev/public_html/wp-login.php' not found or unable to stat [Mon Feb 21 18:57:44.810751 2022] script '/var/www/shemake.dev/public_html/wp-login.php' not found or unable to stat, referer: http://shemake.dev/wp-login.php [Mon Feb 21 19:01:19.484654 2022] script '/var/www/shemake.dev/public_html/wp-login.php' not found or unable to stat [Mon Feb 21 19:59:36.747969 2022] script '/var/www/shemake.dev/public_html/wp-login.php' not found or unable to stat [Tue Feb 22 17:51:29.480133 2022] script '/var/www/shemake.dev/public_html/wp-login.php' not found or unable to stat [Tue Feb 22 19:02:22.651241 2022] script '/var/www/shemake.dev/public_html/wp-login.php' not found or unable to stat, referer: http://shemake.dev/wp-login.php [Tue Feb 22 20:26:24.788492 2022] script '/var/www/shemake.dev/public_html/wp-login.php' not found or unable to stat [Tue Feb 22 23:18:54.590501 2022] script '/var/www/shemake.dev/public_html/wp-login.php' not found or unable to stat [Wed Feb 23 20:02:36.310728 2022] script '/var/www/shemake.dev/public_html/wp-login.php' not found or unable to stat [Wed Feb 23 20:06:59.550679 2022] script '/var/www/shemake.dev/public_html/wp-login.php' not found or unable to stat [Thu Feb 24 05:44:55.298579 2022] script '/var/www/shemake.dev/public_html/wp-login.php' not found or unable to stat, referer: http://shemake.dev/wp-login.php [Thu Feb 24 19:15:18.206156 2022] script '/var/www/shemake.dev/public_html/wp-login.php' not found or unable to stat [Thu Feb 24 21:09:26.421540 2022] script '/var/www/shemake.dev/public_html/wp-login.php' not found or unable to stat [Thu Feb 24 21:35:10.110737 2022] script '/var/www/shemake.dev/public_html/wp-login.php' not found or unable to stat, referer: http://shemake.dev/wp-login.php [Fri Feb 25 15:09:08.969243 2022] script '/var/www/shemake.dev/public_html/wp-login.php' not found or unable to stat [Fri Feb 25 15:40:46.461159 2022] script '/var/www/shemake.dev/public_html/wp-login.php' not found or unable to stat [Mon Feb 28 14:42:40.621152 2022] script '/var/www/shemake.dev/public_html/wp-login.php' not found or unable to stat [Mon Feb 28 14:51:32.325764 2022] script '/var/www/shemake.dev/public_html/wp-login.php' not found or unable to stat [Mon Feb 28 19:27:14.406320 2022] script '/var/www/shemake.dev/public_html/wp-load.php' not found or unable to stat, referer: www.bing.com [Mon Feb 28 19:27:39.823995 2022] script '/var/www/shemake.dev/public_html/wp-load.php' not found or unable to stat, referer: www.bing.com [Mon Feb 28 19:27:49.611360 2022] script '/var/www/shemake.dev/public_html/wp-admin.php' not found or unable to stat, referer: www.bing.com [Mon Feb 28 19:27:56.945038 2022] script '/var/www/shemake.dev/public_html/wp_wrong_datlib.php' not found or unable to stat, referer: www.bing.com [Mon Feb 28 19:28:04.029507 2022] script '/var/www/shemake.dev/public_html/wp-signin.php' not found or unable to stat, referer: www.bing.com [Mon Feb 28 19:28:28.269361 2022] script '/var/www/shemake.dev/public_html/wp-booking.php' not found or unable to stat, referer: www.bing.com [Mon Feb 28 19:28:46.917564 2022] script '/var/www/shemake.dev/public_html/wp-plugins.php' not found or unable to stat, referer: www.bing.com [Mon Feb 28 19:29:06.042043 2022] script '/var/www/shemake.dev/public_html/wp-backup-sql-302.php' not found or unable to stat, referer: www.bing.com [Mon Feb 28 19:30:26.163172 2022] script '/var/www/shemake.dev/public_html/wp.php' not found or unable to stat, referer: www.bing.com [Tue Mar 01 15:25:53.635927 2022] script '/var/www/shemake.dev/public_html/wp-login.php' not found or unable to stat [Tue Mar 01 18:51:10.418326 2022] script '/var/www/shemake.dev/public_html/wp-login.php' not found or unable to stat [Tue Mar 01 18:54:32.464058 2022] script '/var/www/shemake.dev/public_html/wp-login.php' not found or unable to stat, referer: http://shemake.dev/wp-login.php [Wed Mar 02 14:18:01.866136 2022] script '/var/www/shemake.dev/public_html/wp-login.php' not found or unable to stat [Thu Mar 03 06:55:41.087085 2022] script '/var/www/shemake.dev/public_html/wp-login.php' not found or unable to stat [Thu Mar 03 18:58:53.708001 2022] script '/var/www/shemake.dev/public_html/wpinfo.php' not found or unable to stat [Sun Mar 06 00:54:34.720632 2022] script '/var/www/shemake.dev/public_html/wp-login.php' not found or unable to stat [Sun Mar 06 01:29:13.364414 2022] script '/var/www/shemake.dev/public_html/wp-login.php' not found or unable to stat [Sun Mar 06 04:04:31.121246 2022] script '/var/www/shemake.dev/public_html/wp-login.php' not found or unable to stat, referer: http://shemake.dev/wp-login.php [Sun Mar 06 10:23:34.497938 2022] script '/var/www/shemake.dev/public_html/class-wp-widget-archives.php' not found or unable to stat [Sun Mar 06 15:0:29.797044 2022] script '/var/www/shemake.dev/public_html/wp-login.php' not found or unable to stat, referer: http://shemake.dev/wp-login.php [Sun Mar 06 20:06:35.347722 2022] script '/var/www/shemake.dev/public_html/wp-login.php' not found or unable to stat [Mon Mar 07 16:51:34.910103 2022] script '/var/www/shemake.dev/public_html/class-wp-widget-archives.php' not found or unable to stat [Tue Mar 08 12:25:14.590671 2022] script '/var/www/shemake.dev/public_html/wp-login.php' not found or unable to stat, referer: http://shemake.dev/wp-login.php [Tue Mar 08 12:38:25.143553 2022] script '/var/www/shemake.dev/public_html/wp-login.php' not found or unable to stat [Tue Mar 08 15:16:15.949123 2022] script '/var/www/shemake.dev/public_html/wp-login.php' not found or unable to stat [Wed Mar 09 14:37:41.474564 2022] script '/var/www/shemake.dev/public_html/wp-login.php' not found or unable to stat [Wed Mar 09 14:51:15.868443 2022] script '/var/www/shemake.dev/public_html/wp-login.php' not found or unable to stat, referer: http://shemake.dev/wp-login.php [Wed Mar 09 16:07:16.961116 2022] script '/var/www/shemake.dev/public_html/wp-login.php' not found or unable to stat [Thu Mar 10 20:51:40.913806 2022] script '/var/www/shemake.dev/public_html/wp-login.php' not found or unable to stat, referer: http://shemake.dev/wp-login.php [Thu Mar 10 22:53:29.004549 2022] script '/var/www/shemake.dev/public_html/wp-login.php' not found or unable to stat
As if that wasn't bad enough, there are twice as many calls to a file called xmlrpc.php, which is a feature of WordPress that allows data transfer.
109 calls to xmlrpc.php in a month
[Sat Feb 19 18:00:13.916334 2022] [php7:error] [pid 92974] [] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Sat Feb 19 19:46:31.207411 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Sun Feb 20 00:22:34.634621 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Sun Feb 20 04:04:30.195892 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Sun Feb 20 09:34:02.176802 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Sun Feb 20 14:24:18.479388 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Sun Feb 20 14:40:12.853496 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Sun Feb 20 16:04:37.444038 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Mon Feb 21 06:23:12.197505 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Mon Feb 21 07:09:31.151635 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Mon Feb 21 07:46:34.627508 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Mon Feb 21 09:23:38.316570 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Mon Feb 21 12:39:04.945627 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Mon Feb 21 13:43:11.140799 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Mon Feb 21 15:11:11.560968 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Mon Feb 21 17:17:00.751196 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Mon Feb 21 17:58:50.568910 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Mon Feb 21 18:01:41.398933 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Mon Feb 21 20:48:18.463503 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Mon Feb 21 22:27:49.283906 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Mon Feb 21 22:39:06.056450 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Mon Feb 21 23:07:24.064453 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Tue Feb 22 00:16:34.484540 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Tue Feb 22 00:49:16.972838 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Tue Feb 22 01:45:56.319873 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Tue Feb 22 02:17:16.543583 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Tue Feb 22 02:45:28.598046 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Tue Feb 22 03:08:43.560319 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Tue Feb 22 03:35:26.596676 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Tue Feb 22 05:04:53.318601 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Tue Feb 22 06:08:31.211389 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Tue Feb 22 10:41:19.934251 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Tue Feb 22 12:42:10.119737 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Tue Feb 22 13:01:53.536232 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Tue Feb 22 13:34:34.599775 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Tue Feb 22 14:18:27.026111 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Tue Feb 22 21:03:20.896592 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Wed Feb 23 01:11:07.182395 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Wed Feb 23 02:17:46.884195 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Wed Feb 23 04:25:31.626344 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Wed Feb 23 05:57:11.034884 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Wed Feb 23 11:07:03.699834 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Wed Feb 23 12:31:56.783554 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Wed Feb 23 14:52:16.168166 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Wed Feb 23 15:09:33.791485 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Thu Feb 24 01:38:44.626099 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Thu Feb 24 04:25:45.880995 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Thu Feb 24 06:12:41.289711 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Thu Feb 24 11:10:28.639067 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Thu Feb 24 14:58:06.822977 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Thu Feb 24 17:57:18.628344 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Thu Feb 24 19:52:30.956302 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Sat Feb 26 08:47:18.158396 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Sat Feb 26 19:47:44.400044 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Sat Feb 26 22:11:22.816484 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Sat Feb 26 22:12:42.404721 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Sun Feb 27 10:51:52.888130 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Sun Feb 27 17:06:22.205891 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Mon Feb 28 04:27:48.898482 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Mon Feb 28 06:19:24.424794 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Mon Feb 28 09:08:26.279074 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Mon Feb 28 15:25:42.278136 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Mon Feb 28 19:27:47.215209 2022] script '/var/www/shemake.dev/public_html/xmlrpcs.php' not found or unable to stat, referer: www.bing.com [Tue Mar 01 11:00:50.216041 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Tue Mar 01 14:57:16.075481 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Tue Mar 01 15:24:13.881870 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Tue Mar 01 15:51:43.276554 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable9; not found or unable to stat [Wed Mar 02 08:14:56.549422 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Wed Mar 02 14:28:39.832759 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Wed Mar 02 15:08:43.141647 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Wed Mar 02 17:37:37.764570 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Thu Mar 03 03:36:42.742816 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Thu Mar 03 11:18:15.755525 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Thu Mar 03 16:41:14.301216 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Fri Mar 04 08:38:45.309492 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Fri Mar 04 12:07:34.324509 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Fri Mar 04 16:24:54.216092 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Sat Mar 05 10:44:50.473540 2022] script '/var/www/shemake.dev/public_html/xmlrpc9;/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Sun Mar 06 12:36:42.176425 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Sun Mar 06 13:43:48.173558 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Mon Mar 07 10:09:35.893359 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Mon Mar 07 16:12:29.201110 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Mon Mar 07 18:50:28.442490 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Tue Mar 08 02:42:04.062507 2022] script '/v39;/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Wed Mar 09 02:04:59.585669 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Wed Mar 09 17:19:17.739505 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Wed Mar 09 17:31:19.287173 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Wed Mar 09 18:45:59.091618 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Wed Mar 09 21:04:53.898336 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Wed Mar 09 23:32:31.169242 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Thu Mar 10 05:42:14.394849 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat [Thu Mar 10 17:36:39.578711 2022] script '/var/www/shemake.dev/public_html/xmlrpc.php' not found or unable to stat
Now, I'm not picking on Wordpress. It has made managing a website easy and accessible for millions. The most recent estimates I could find claim that Wordpress powers over 43% of websites.
Total. On the whole Internet.
Which is a pretty juicy attack vector, if you think about it.
I am not claiming that my own website is unhackable (one, I'm not that arrogant; two, I don't want to make it into a challenge xD), but I will say that small sites like my own enjoy the benefit of obscurity. Like Mac users of the 80s and 90s, we do not present a large enough target for people to develop scripts to hack our sites en masse. If I ever get hacked, it will be because someone spent time and effort to target my site specifically -- not as a drive-by event or as part of a widescale attack.