0

So i was made aware that a site on my server was getting hundreds of thousands of requests per day, so i checked the access log out.

I found literally thousands of lines of the below:

103.67.235.89 - - [18/Oct/2017:06:27:26 +0100] "GET /plugin-notices.php HTTP/1.0" 301 576 "-" "-"
198.71.228.64 - - [18/Oct/2017:06:27:26 +0100] "GET /plugin-notices.php HTTP/1.0" 200 3964 "-" "-"
150.95.105.161 - - [18/Oct/2017:06:27:26 +0100] "GET /plugin-notices.php HTTP/1.0" 200 3964 "-" "-"
77.72.1.34 - - [18/Oct/2017:06:27:26 +0100] "GET /plugin-notices.php HTTP/1.0" 301 576 "-" "-"
93.174.127.11 - - [18/Oct/2017:06:27:26 +0100] "GET /plugin-notices.php HTTP/1.0" 301 576 "-" "-"
77.72.1.34 - - [18/Oct/2017:06:27:26 +0100] "GET /plugin-notices.php HTTP/1.0" 200 3964 "-" "-"
103.4.213.6 - - [18/Oct/2017:06:27:26 +0100] "GET /plugin-notices.php HTTP/1.0" 301 576 "-" "-"

Is this normal for a WordPress install? Or am i getting hacked?

Is there a way to prevent this. They all seem to be HTTP 1.0 requests which i have already blocked via .htaccess, so not quite sure what is going on?

sborsky
  • 305
  • 1
  • 6
danyo
  • 111
  • 3
  • You could block requests to that URL and turn logging off for that URL. I don't know if you should, but you could. – Tim Oct 18 '17 at 19:31
  • 1
    What is at /plugin-notices.php and is that a legitimate page? Those HTTP 200 response that your webserver is serving up content at that location. – Stefan Lasiewski Oct 19 '17 at 00:12

1 Answers1

1

Looking at your logs, I would say you've been already hacked.

All that IPs are looking for only one page, which is probably a malicious program, and probably all of them (I've tested 4) are other sites already hacked (see for yourself, ust copy/paste an IP in your browser, they are all websites).

Now, I would stop apache, search for that file and check what is it.
Be aware, sometimes you see a perfectly clean file, but scrolling on the right like 200 characters, you find the malicious code. This happened to me years ago, at the beginning was a mystery..

Once confirmed that's a trojan (or whatever), delete the plugin, check all the other plugins, and maybe check your apache configuration, maybe there's some hole that allowed that code to get into your server.

nnsense
  • 132
  • 5
  • The server is being DDoS'd, but simply responding to "GET /plugin-notices.php" requests doesn't necessarily mean the server has been hacked. That would be the normal response of an normal server which is receiving many requests. – Stefan Lasiewski Oct 19 '17 at 00:14
  • That's true, but it's still suspect that thousands of other hacked servers are all looking for the same page on his server. – nnsense Oct 19 '17 at 23:22