I am currently running a wordpress site with the plugin "Wassup" installed. In the last time I have registered around 30 users per day that call /wp-login.php on my webpage. And all of them always use Chrome 31 and even worse everyone uses a different IP, no IP occurs twice (at least not within a day)

The plugin "Better WP security" does not block them.

So I am wondering if Chrome 31 may have a plugin or something, that is used for hacking purposes without the knowledge of the people using it?

Has any one seen the same?

  • There are RSS readers, but those don't hit the login. My first thought is spam bots. – Wayne Dec 5 '13 at 17:57

It is likely that this is a case of user agent spoofing. If a hacker has written a bot try try to exploit WordPress by testing the /wp-login.php script, they are likely to make it appear as if the requests came from some legitimate browser. Requests that look like they are from bots are often blocked by things like your security plugin.

  • Thanks. However the fact that they use a different IP adress every time tells me that they have backdoors installed on other pc's or are using something like the tor network. I'll try to install a plugin that blocks all tor exits nodes – RononDex Dec 6 '13 at 6:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.