Hacker immediately found nicename

  • LearningWP123

    (@learningwp123)


    5 years, 1 month ago

    My site is the subject of a brute force attack (between 400,000 and 700,000 attempts per day).

    I changed my nicename via my phpmyadmin and within days I started getting notifications that my hacker was now targeting my nicename.

    For example, before I knew to change my nice name, my WP login was ABC123 (let’s say), and I would get messages from my security plugin…

    2 failed login attempts (2 lockout(s)) from IP 103.249.77.2
    Last user attempted: ABC123
    IP was blocked for 72 hours

    So I changed the nicename to XYZ321 and immediately started getting messages…

    Hello,

    2 failed login attempts (2 lockout(s)) from IP 199.102.105.241
    Last user attempted: XYZ321
    IP was blocked for 72 hours

    I woke up this morning with 11 of these messages noting attacks from 11 different IPs.

    How did the hacker find my nicename, and so quickly?

    Thanks in advance for any help.

    The page I need help with: [log in to see the link]

Viewing 7 replies - 1 through 7 (of 7 total)
  • Anonymous User 17160716

    (@anonymized-17160716)

    5 years, 1 month ago

    LearningWP123, hi.

    There are many ways to find out this info, especially if you have not tried to somehow hide it, for example, like this:

    {"id":4,"name":"Steve Milano","url":"http:\/\/ushsta.org","description":"","link":"http:\/\/ushsta.org\/author\/NC44 8p\/","slug":"NC44 8p","avatar_urls":{"24":"http:\/\/0.gravatar.com\/avatar\/6c5cb0ebd3011837ca486b591aed2daa?s=24&d=mm&r=g","48":"http:\/\/0.gravatar.com\/avatar\/6c5cb0ebd3011837ca486b591aed2daa?s=48&d=mm&r=g","96":"http:\/\/0.gravatar.com\/avatar\/6c5cb0ebd3011837ca486b591aed2daa?s=96&d=mm&r=g"},"meta":[],"_links":{"self":[{"href":"http:\/\/ushsta.org\/wp-json\/wp\/v2\/users\/4"}],"collection":[{"href":"http:\/\/ushsta.org\/wp-json\/wp\/v2\/users"}]}}

    And this is not quite the correct approach to the issue – to change the login/name/etc. Better to focus on cutting off that malicious requests and reducing server load.

    Thread Starter LearningWP123

    (@learningwp123)

    5 years, 1 month ago

    Thanks for the quick reply.

    I found many articles recommending the way to respond was to hide the nicename, but apparently, hackers are able to find it.

    Anonymous User 17160716

    (@anonymized-17160716)

    5 years, 1 month ago

    LearningWP123, yeah, true. If you want to trick the attacker, then create an unprivileged fake account, change the author of all pages/posts etc. to him and hide REST API v2 endpoints from public viewing. If you do everything correctly, you will see how the brute-force attack unfolds and it will be aimed at a fake user.

    But still, it’s better to decrease this amount of requests and don’t play hide-n-seek with a bot – you’ll lose this game, sooner or later.

    Thread Starter LearningWP123

    (@learningwp123)

    5 years, 1 month ago

    Is there a tutorial you can point me to for learning how to decrease requests (I’m figuring this out myself)?

    Thanks.

    Anonymous User 17160716

    (@anonymized-17160716)

    5 years, 1 month ago

    LearningWP123, solution depends on the technical side of the issue. For example, if your website is located on a VPS/DS that you manage yourself, then you can install software like firewall + fail2ban or any WAF you want. If it’s too complicated for you and/or your website is running on any shared hosting, then you can try so-called “security plugins” with the brute-force attacks block as an option.

    Thread Starter LearningWP123

    (@learningwp123)

    5 years, 1 month ago

    Got it, thanks.

    Anonymous User 17160716

    (@anonymized-17160716)

    5 years, 1 month ago

    LearningWP123, you’re welcome 🙂

Viewing 7 replies - 1 through 7 (of 7 total)

The topic ‘Hacker immediately found nicename’ is closed to new replies.