user_fullaccess, is this an attack?

Resolved alfab
(@alfab)

8 years, 4 months ago

Hi guys, Wordfence shows me a multiple attempts to log into my site, from a “user_fullaccess”

user_fullaccess 104.237.139.4 1 hour 10 mins ago
user_fullaccess 93.89.225.175 7 hours 53 mins ago
user_fullaccess 45.76.182.228 9 hours 43 mins ago
user_fullaccess 185.111.233.21 12 hours 4 mins ago
user_fullaccess 176.31.151.157 March 25, 2018 4:54 pm
user_fullaccess 184.168.46.127 March 25, 2018 12:09 pm
user_fullaccess 107.180.112.240 March 25, 2018 9:53 am
user_fullaccess 97.74.24.194 March 25, 2018 5:00 am
user_fullaccess 103.18.45.23 March 25, 2018 2:36 am
user_fullaccess 46.28.105.94 March 24, 2018 1:35 pm

and many more….is there something I can or I need to do?
thank you very much

Viewing 8 replies - 1 through 8 (of 8 total)

wfalaa
(@wfalaa)

8 years, 4 months ago

Hi @alfab
Could you please share a screenshot showing these attempts warnings in Wordfence?

Thanks.

Thread Starter alfab
(@alfab)

8 years, 4 months ago

Hi,
how can I add a screenshot? there’s no upload button here….
thanks

wfalaa
(@wfalaa)

8 years, 4 months ago

Hi,
You can upload the image to imgur website then share the link here in the forums.

Thanks.

Thread Starter alfab
(@alfab)

8 years, 4 months ago

Hi,
here’s the link to the img https://imgur.com/a/YY0w0
thank you

fabio

wfalaa
(@wfalaa)

8 years, 4 months ago

Hi fabio,
Just to confirm you don’t have a user with this “user_fullaccess” as the username on your website, right?

Did you try deactivating all other installed plugins -temporarily- then recheck this issue? specially if you have any plugin related to users/members management.

Thanks.

Thread Starter alfab
(@alfab)

8 years, 4 months ago

Hi,
I have no “user_fullaccess” user on the website and no users/members management plugin installed. What do you suggest?

thanks

wfalaa
(@wfalaa)

8 years, 4 months ago

Hi @alfab
Since all of these are failed login attempts, then most probably one of the attackers is using this username for some reason (perhaps other websites were hacked once and this was one of the usernames there). You could add this username to the list of “Immediately block the IP of users who try to sign in as these usernames” option.

Also, you can enable “Immediately lock out invalid usernames” option.

Thanks.

Thread Starter alfab
(@alfab)

8 years, 4 months ago

Hi @wfalaa
I’ll follow your indications. Let’s see….
Thank you very much for your help.

Viewing 8 replies - 1 through 8 (of 8 total)

The topic ‘user_fullaccess, is this an attack?’ is closed to new replies.