[EvilDrPorkChop]

I have a website. I'm pretty good with IT stuff, but websites are a bit out of my comfort zone.

Have a small business Wordpress based website. Last night got an email from the hosting company saying bandwidth was up massively. OK.

Logged in this morning and sure enough looks like we've been hacked by some Japanese spam thing. They've managed to create a few 'posts' and put a link in on a few pages. Deleted those, checked all the files, proceeded to update Wordpress to the latest version, updated all plugins. Hey presto! Thought I'd sorted it.

However i'm still getting attacks on 404. A certain IP is trying to access thousands of pages that don't exist on the site, creating 404 errors. I've tried blocking the IP but it just changes the IP and carries on. I thought the server/hosting company would just automatically block the IP on so many 404 errors from a certain IP but doesn't seem to be the cast.

I've suspended the website for now. I've gone through the site with a fine tooth comb but can't find anything out of the norm. But is there anything else I can do? or is it just a simple cast of an external attack that I cannot stop and needs to be blocked at the hosting end.

Great way to ruin a Saturday!

[jimbobiggens]

Is this just one ip at a time?

[EvilDrPorkChop]

Originally Posted by jimbobiggens

Is this just one ip at a time?

It seems to be just a couple of IPs. I block them and then they change.

It's loads of requests a minute. I've used about 200mb bandwidth in an hour. We only usually use that in a month! On the logs they're all 404

[jimbobiggens]

pm'd you

[SteveChester]

Not sure who hosts if for you but would have thought any decent CDN/WAF would pick this up and block.

[EvilDrPorkChop]

So after a bit more head scratching and investigating it seems as that it's Google and Bing Bots trying to Crawl URLS that don't existing. This must have been down to the hack and them corrupting the Sitemap file.

The issue is I can't get them to stop. Robots file is on disallow, yet they still continue! You'd of thought the hosting would have just automatically blocked them when they are trying to access so many URLs that are returning a 404 error.

So i'm hoping they'll eventually stop! I've re uploaded a new sitemap to Google Analytics so i'm hoping that might ease the issue a bit.

[SteveChester]

Speak to your hosting company and see what they can activate WAF wise?

[EvilDrPorkChop]

Originally Posted by SteveChester

Speak to your hosting company and see what they can activate WAF wise?

I've raised a ticket, but you know what they're like. Feel like a sitting duck

[SteveChester]

Who's it with?

[EvilDrPorkChop]

Some cheap indy that i've been with for years. I don't really expect much of a quick response, but they're usually pretty helpful when they do respond.

[SteveChester]

We use DreamHost for our Wordpress sites - dirt cheap and very good.

[EvilDrPorkChop]

Originally Posted by SteveChester

We use DreamHost for our Wordpress sites - dirt cheap and very good.

I've just renewed for the year but might have to consider them next time. What panel are they using? I'm used to Cpanel.

[Cero ceto]

There is only one way to 100% deal with this and that’s to go back to a well known good state, this could possibly be a complete rebuild. You then need to check for vulnerabilities within the software version/code you are using before going live again. If you don’t you could find yourself back in the same state again.

[EvilDrPorkChop]

Originally Posted by SSIIJAR

There is only one way to 100% deal with this and that’s to go back to a well known good state, this could possibly be a complete rebuild. You then need to check for vulnerabilities within the software version/code you are using before going live again. If you don’t you could find yourself back in the same state again.

I've done this. Restored from a backup for last year, updated and updated plug ins. This bit seems ok. I've manage to re submit a new site map to google and get it to recrawl the main index page so it isn't showing Japanese text everywhere now.

My issue is google is just crawling random urls on my site that are just return 404 errors. Pages that don't exist but it's loading the 404 page. So it's just using shed loads of bandwidth. 0.5gb over night. I've also put in the robots file to disallow crawling yet it still continues