مشکل بروت فورس از سرور به خود سرور ! ! ! مشکوک !

[p30pdf]

به نام خدا
عرض سلامو خسته نباشید دوستان و اساتید متخصص مشکلی هست که با هر کدام از دوستان در میان گذاشتم متوجه نشدن علتش چیه ببینید من از مدیریت محتوای وردپرس استفاده می کنم و زمانی که میرم داخل پنل ادمین دایرکت ادمین تو قسمت تیکت ها مدام لاگ عملیات بروت فورس از آی پی خود سرور میاد اینم یه لاگ از درخواست ها به نظر! ممنون میشم بررسی کنید :

14242747210000    *.*.*.*        1    wordpress1    *.*.*.* - - [18/Feb/2015:19:21:03 +0330] "POST /wp-login.php HTTP/1.1" 302 1264 "http://www.example.com/login" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.111 Safari/537.36"
14242745410000    *.*.*.*        1    wordpress1    *.*.*.* - - [18/Feb/2015:19:18:22 +0330] "POST /wp-login.php?action=register HTTP/1.1" 302 472 "http://www.example.com/register" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.111 Safari/537.36"
14242733410000    *.*.*.*    example    1    phpmyadmin2    Feb 18 18:58:02:: pma auth user='example' status='not authenticated' ip='*.*.*.*'
14242714210001    198.46.135.126    smmsp    1    exim2    2015-02-18 18:26:42 login authenticator failed for (WIN-PVGBZOUR9UM) [198.46.135.126]: 535 Incorrect authentication data (set_id=smmsp)
14242714210000    198.46.135.126    mailnull    1    exim2    2015-02-18 18:26:41 login authenticator failed for (WIN-PVGBZOUR9UM) [198.46.135.126]: 535 Incorrect authentication data (set_id=mailnull)
14242710010000    *.*.*.*        1    wordpress1    *.*.*.* - - [18/Feb/2015:18:19:15 +0330] "POST /wp-login.php HTTP/1.1" 302 1156 "http://www.example.com/login" "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36"
14242709410000    *.*.*.*        1    wordpress1    *.*.*.* - - [18/Feb/2015:18:18:53 +0330] "POST /wp-login.php?action=resetpass HTTP/1.1" 200 1354 "http://www.example.com/wp-login.php?action=rp" "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36"
14242708810001    *.*.*.*        1    wordpress1    *.*.*.* - - [18/Feb/2015:18:17:57 +0330] "POST /wp-login.php HTTP/1.1" 200 2125 "amgwheels.my/administrator/index.php" "Mozilla/5.0 (Windows NT 6.0) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/24.0.1290.1 Safari/537.13"
14242708810000    *.*.*.*        1    wordpress1    *.*.*.* - - [18/Feb/2015:18:17:07 +0330] "POST /wp-login.php?action=lostpassword HTTP/1.1" 302 469 "http://www.example.com/forgot" "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36"
14242708210002    *.*.*.*        1    wordpress1    *.*.*.* - - [18/Feb/2015:18:16:59 +0330] "POST /wp-login.php HTTP/1.1" 200 2140 "http://www.example.com/wp-login.php" "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36"
14242708210001    *.*.*.*        1    wordpress1    *.*.*.* - - [18/Feb/2015:18:16:48 +0330] "POST /wp-login.php HTTP/1.1" 200 2140 "http://www.example.com/wp-login.php" "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36"
14242708210000    *.*.*.*        1    wordpress1    *.*.*.* - - [18/Feb/2015:18:16:39 +0330] "POST /wp-login.php HTTP/1.1" 200 2132 "http://www.example.com/login" "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36"
14242707610000    *.*.*.*        1    wordpress1    *.*.*.* - - [18/Feb/2015:18:15:26 +0330] "POST /wp-login.php?action=register HTTP/1.1" 200 4046 "http://www.example.com/register" "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36"
14242641010000    *.*.*.*        1    wordpress1    *.*.*.* - - [18/Feb/2015:16:24:33 +0330] "POST /wp-login.php HTTP/1.1" 302 1129 "http://www.example.com/login" "Mozilla/5.0 (Windows NT 6.2; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0 AlexaToolbar/alxf-2.21"
14242634410000    80.82.64.27    admin@example3.com    1    dovecot1    Feb 18 16:13:08 da dovecot[2991]: pop3-login: Aborted login (auth failed, 1 attempts in 2 secs): user=<admin@example3.com>, method=PLAIN, rip=80.82.64.27, lip=*.*.*.*, session=<++05KVwPTwBQUkAb>
14242620010000    *.*.*.*        1    wordpress1    *.*.*.* - - [18/Feb/2015:15:49:26 +0330] "POST /wp-login.php HTTP/1.1" 302 1098 "http://example2.com/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; rv:35.0) Gecko/20100101 Firefox/35.0 AlexaToolbar/alxf-2.21"
14242612810000    *.*.*.*        1    wordpress1    *.*.*.* - - [18/Feb/2015:15:37:41 +0330] "POST /wp-login.php HTTP/1.1" 302 1314 "http://www.example.com/login" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.111 Safari/537.36"
14242611010000    *.*.*.*        1    wordpress1    *.*.*.* - - [18/Feb/2015:15:34:08 +0330] "POST /wp-login.php?action=register HTTP/1.1" 302 471 "http://www.example.com/register" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.111 Safari/537.36"
14242610410000    *.*.*.*        1    wordpress1    *.*.*.* - - [18/Feb/2015:15:33:02 +0330] "POST /wp-login.php HTTP/1.1" 200 2126 "http://www.example.com/wp-login.php?checkemail=confirm" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.111 Safari/537.36"
14242605010000    *.*.*.*        1    wordpress1    *.*.*.* - - [18/Feb/2015:15:24:02 +0330] "POST /wp-login.php?action=lostpassword HTTP/1.1" 302 468 "http://www.example.com/wp-login.php?action=lostpassword" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.111 Safari/537.36"
14242604410001    *.*.*.*        1    wordpress1    *.*.*.* - - [18/Feb/2015:15:23:50 +0330] "POST /wp-login.php?action=lostpassword HTTP/1.1" 200 2033 "http://www.example.com/forgot" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.111 Safari/537.36"
14242604410000    *.*.*.*        1    wordpress1    *.*.*.* - - [18/Feb/2015:15:23:22 +0330] "POST /wp-login.php?action=register HTTP/1.1" 200 4013 "http://www.example.com/register" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.111 Safari/537.36"
14242602610002    *.*.*.*        1    wordpress1    *.*.*.* - - [18/Feb/2015:15:20:47 +0330] "POST /wp-login.php?action=lostpassword HTTP/1.1" 200 2032 "http://www.example.com/wp-login.php?action=lostpassword" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.111 Safari/537.36"
14242602610001    *.*.*.*        1    wordpress1    *.*.*.* - - [18/Feb/2015:15:20:31 +0330] "POST /wp-login.php?action=lostpassword HTTP/1.1" 200 2033 "http://www.example.com/forgot" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.111 Safari/537.36"
14242602610000    *.*.*.*        1    wordpress1    *.*.*.* - - [18/Feb/2015:15:20:12 +0330] "POST /wp-login.php HTTP/1.1" 200 2125 "http://www.example.com/login" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.111 Safari/537.36"
14242591210004    *.*.*.*        1    wordpress1    *.*.*.* - - [18/Feb/2015:15:01:11 +0330] "POST /wp-login.php HTTP/1.1" 200 2345 "http://example2.com/wp-login.php" "Opera/9.80 (Windows NT 6.1) Presto/2.12 Version/12.16"
14242591210003    *.*.*.*        1    wordpress1    *.*.*.* - - [18/Feb/2015:15:01:10 +0330] "POST /wp-login.php HTTP/1.1" 200 2344 "http://example2.com/wp-login.php" "Mozilla/5.0 (Windows NT 6.2; WOW64; rv:25.0) Gecko/20100101 Firefox/25.0"
14242591210002    *.*.*.*        1    wordpress1    *.*.*.* - - [18/Feb/2015:15:01:10 +0330] "POST /wp-login.php HTTP/1.1" 200 2346 "http://example2.com/wp-login.php" "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML like Gecko) Chrome/34.0.1847.131 Safari/537.36"
14242591210001    *.*.*.*        1    wordpress1    *.*.*.* - - [18/Feb/2015:15:01:07 +0330] "POST /wp-login.php HTTP/1.1" 200 2348 "http://example2.com/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.11 (KHTML like Gecko) Chrome/17.0.963.56 Safari/535.11"
14242591210000    *.*.*.*        1    wordpress1    *.*.*.* - - [18/Feb/2015:15:01:05 +0330] "POST /wp-login.php HTTP/1.1" 200 2348 "http://example2.com/wp-login.php" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)"
14242588210000    80.82.64.27    info@example3.com    1    dovecot1    Feb 18 14:57:00 da dovecot[2991]: pop3-login: Aborted login (auth failed, 1 attempts in 2 secs): user=<info@example3.com>, method=PLAIN, rip=80.82.64.27, lip=*.*.*.*, session=<IMT0GFsPVABQUkAb>
14242578610004    *.*.*.*        1    wordpress1    *.*.*.* - - [18/Feb/2015:14:40:27 +0330] "POST /wp-login.php HTTP/1.1" 200 1885 "http://www.example.com/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.17 (KHTML like Gecko) Chrome/24.0.1312.52 Safari/537.17"
14242578610003    *.*.*.*        1    wordpress1    *.*.*.* - - [18/Feb/2015:14:40:26 +0330] "POST /wp-login.php HTTP/1.1" 200 1885 "http://www.example.com/wp-login.php" "Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML like Gecko) Chrome/32.0.1700.76 Safari/537.36"
14242578610002    *.*.*.*        1    wordpress1    *.*.*.* - - [18/Feb/2015:14:40:23 +0330] "POST /wp-login.php HTTP/1.1" 200 1885 "http://www.example.com/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML like Gecko) Chrome/35.0.1916.114 Safari/537.36"
14242578610001    *.*.*.*        1    wordpress1    *.*.*.* - - [18/Feb/2015:14:40:21 +0330] "POST /wp-login.php HTTP/1.1" 200 1885 "http://www.example.com/wp-login.php" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.11 (KHTML like Gecko) Chrome/23.0.1271.91 Safari/537.11"
14242578610000    *.*.*.*        1    wordpress1    *.*.*.* - - [18/Feb/2015:14:40:21 +0330] "POST /wp-login.php HTTP/1.1" 200 1885 "http://www.example.com/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML like Gecko) Chrome/35.0.1916.114 Safari/537.36"
14242574410000    *.*.*.*        1    wordpress1    *.*.*.* - - [18/Feb/2015:14:33:42 +0330] "POST /wp-login.php HTTP/1.1" 302 1314 "http://www.example.com/login" "Mozilla/5.0 (Windows NT 6.1; rv:35.0) Gecko/20100101 Firefox/35.0"
14242573210000    *.*.*.*        1    wordpress1    *.*.*.* - - [18/Feb/2015:14:31:35 +0330] "POST /wp-login.php?action=register HTTP/1.1" 302 471 "http://www.example.com/register" "Mozilla/5.0 (Windows NT 6.1; rv:35.0) Gecko/20100101 Firefox/35.0"
14242571410000    *.*.*.*        1    wordpress1    *.*.*.* - - [18/Feb/2015:14:28:15 +0330] "POST /wp-login.php HTTP/1.1" 302 1308 "http://www.example.com/login" "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.111 Safari/537.36"
14242570210000    *.*.*.*        1    wordpress1    *.*.*.* - - [18/Feb/2015:14:26:45 +0330] "POST /wp-login.php?action=register HTTP/1.1" 302 471 "http://www.example.com/register" "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.111 Safari/537.36"
14242563010004    *.*.*.*        1    wordpress1    *.*.*.* - - [18/Feb/2015:14:14:42 +0330] "POST /wp-login.php HTTP/1.1" 200 3862 "http://example.com/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0.1) Gecko/20100101 Firefox/8.0.1"
14242563010003    *.*.*.*        1    wordpress1    *.*.*.* - - [18/Feb/2015:14:14:41 +0330] "POST /wp-login.php HTTP/1.1" 200 3862 "http://example.com/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0.1) Gecko/20100101 Firefox/8.0.1"
14242563010002    *.*.*.*        1    wordpress1    *.*.*.* - - [18/Feb/2015:14:14:41 +0330] "POST /wp-login.php HTTP/1.1" 200 3862 "http://example.com/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0.1) Gecko/20100101 Firefox/8.0.1"
14242563010001    *.*.*.*        1    wordpress1    *.*.*.* - - [18/Feb/2015:14:14:40 +0330] "POST /wp-login.php HTTP/1.1" 200 3862 "http://example.com/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0.1) Gecko/20100101 Firefox/8.0.1"
14242563010000    *.*.*.*        1    wordpress1    *.*.*.* - - [18/Feb/2015:14:14:40 +0330] "POST /wp-login.php HTTP/1.1" 200 3862 "http://example.com/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0.1) Gecko/20100101 Firefox/8.0.1"
14242561210004    *.*.*.*        1    wordpress1    *.*.*.* - - [18/Feb/2015:14:11:31 +0330] "POST /wp-login.php HTTP/1.1" 200 3862 "http://example.com/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0.1) Gecko/20100101 Firefox/8.0.1"
14242561210003    *.*.*.*        1    wordpress1    *.*.*.* - - [18/Feb/2015:14:11:31 +0330] "POST /wp-login.php HTTP/1.1" 200 3862 "http://example.com/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0.1) Gecko/20100101 Firefox/8.0.1"
14242561210002    *.*.*.*        1    wordpress1    *.*.*.* - - [18/Feb/2015:14:11:30 +0330] "POST /wp-login.php HTTP/1.1" 200 3862 "http://example.com/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0.1) Gecko/20100101 Firefox/8.0.1"
14242561210001    *.*.*.*        1    wordpress1    *.*.*.* - - [18/Feb/2015:14:11:30 +0330] "POST /wp-login.php HTTP/1.1" 200 3862 "http://example.com/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0.1) Gecko/20100101 Firefox/8.0.1"

در ضمن این متن پیامی هست که برام هر بار ایمیل میشه ! دقیقا همینه


Subject: Brute-Force Attack detected in service log from IP(s) *.*.*.* Today at 19:19
A brute force attack has been detected in one of your service logs.

IP *.*.*.* has 2652 failed login attempts: phpmyadmin1=5 & phpmyadmin2=2 & wordpress1=2627 & wordpress2=18

Check 'Admin Level -> Brute Force Monitor' for more information
Detecting and preventing brute force login attacks

فقط به جای این ستاره ها آی پی سرور هست دیگه ! که من ننوشتم به خاطر امنیت بیشتر با تشکر


ارادتمند : مسلم فلاح نیت

[jahromweb]

سلام
درمورد وردپرس : پیشنهاد میدم که نگاهی به تاپیک من در این مورد بکنید :
http://www.webhostingtalk.ir/f91/133657/
زیاد داخل سایت لاگین نمیکنید؟ مطلب را بخوانید متوجه میشوید
موفق باشید

[p30pdf]

با تشکر از شما