I set a WordPress honeypot for brute force attacks – here’s what I learned

For the last month I set a honeypot to log unauthorised WordPress login attempts.

A “honeypot” is a security method which can be used to catch wrong-doers and learn more about their activities.

For each login attempt the honeypot recorded:

  1. the IP address
  2. the username
  3. the password
  4. the date and time.

This was done using an up-to-date WordPress install (WordPress 5.0.3) and the WP Login Attempt Log plugin.

To limit this to only the most persistent wrong doers – I used Limit Login Attempts Reloaded to automatically block the IP address after one attempt and had CloudFlare set to “I’m under attack mode”.

Here’s what I learned from the data.

Frequency

During this month I recorded 676 login attempts – that’s an average of 42 a day.

Some days saw only a handful of attempts and others were hammered – the biggest day was 190 unique attempts.

This irregular frequency leads me to think that it’s not just bots – but also real humans manually trying.

Country

With VPS and cloud computing being so prevalent – telling the country by the IP address needs to be taken with a grain of salt.

This might just come down to cheap cloud hosting or IP address allocations.

Matching the IP address with the country designation showed Ukraine was the most frequent country.

The top five were:

Country Count
Ukraine 41
United States 14
Vietnam 13
France 4
Germany 4

ISP or host

Again, using the IP address we can determine the ISP or host – being who has ownership of the IP address.

PE Tetyana Mysyk was the most frequent – which was associated with the Ukraine attempts.

But unsurprisingly, Digital Ocean and Amazon – which are popular cloud VPS hosts – also made a show.

The top five were:

ISP or host Count
PE Tetyana Mysyk 39
DigitalOcean, LLC 7
Viettel Group 5
Amazon.com, Inc. 4
CMC Telecom Infrastructure Company 3

Login method

WP Login was significantly the login method attempted.

With the data I have I can only assume this was by sending a post request to wp-login.php – rather than visiting the page using a browser.

Login method Percent
WP Login 94.24%
XMLRPC 5.76%

Usernames attempted

Majority of attempts used the author username, but there was also a lot of generic usernames used.

The top five were:

Username Count
hpotuser 184
[login] 161
admin 117
wpdevguides 40
test 36

* note:

  • hpotuser – was the author account used to create posts/pages
  • wpdevguides – was the top level domain for the WordPress install

The full list was:

  • hpotuser
  • [login]
  • admin
  • wpdevguides
  • test
  • testuser
  • 123
  • demo
  • teste
  • editor
  • dexter
  • 123456
  • testing
  • 111
  • 0x1999
  • admin2
  • asd
  • guest
  • jake
  • jsjobs_employer
  • patricia
  • prova
  • prueba
  • roottn
  • test123
  • user1
  • xrumertest
  • 1234
  • 123123
  • [login][login]2017
  • [login][login]2018
  • admin1
  • AnonymousFox
  • asdasd
  • badmin
  • kenneth
  • magico
  • manager
  • phukotler
  • schatzi
  • student
  • test1
  • user
  • useradmww2
  • wpupdateuser
  • 12345678
  • 123456789
  • [login]12345678
  • diysite
  • garak
  • indoxploit
  • local
  • localdev
  • preview
  • qwerty
  • testtest
  • wpmu

Passwords used

The passwords used were surprisingly simple. If someone has ownership of a website and uses passwords this simple … well they’re just asking to loose the website.

The top five were:

Password Coun
123456 36
admin 20
password 20
123456789 14
123 11

* note:

  • hpotuser – was the author account used to create posts/pages
  • wpdevguides – was the top level domain for the WordPress install

The full list was:

What did I learn?

The honeypot worked – I caught a decent sample of brute force login attempts.

I’ve learned:

  • the attacks are happening all the time – seemingly from several sources – don’t ever let your guard down and always keep a backup
  • never include your domain name in the username or password
  • the author username is a hot target – never give it full administrator access