Question

Possible vulnerability scan spotted in web analytics

Posted August 6, 2016 1.9k views
PHP CMS

We have noticed over the last few days what seems to be a vulnerability scan coming from a private network on our server. 10.16.0.5

We do not have Private Networking enabled.

Fortunately, the vulnerability seems to be for Wordpress Revoslider, which we do not use on this server.

They also seem to have found our admin folder which we have renamed to something obscure.

If someone could advise how they have (a) managed to find our admin folder name and (b) how they can be accessing our site from a DO Private Network IP

Thanks in anticipation.

Add a comment
uksbrara
By:
uksbrara
Add a comment

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

2 answers
H4DES August 7, 2016

Hi,
first of all i would check if its your private ip. (they were assigned automatically, whether private networking is enabled or disabled)

ip a

If it´s not YOUR private IP address i would suggest you to block this IP via iptables and contact digitalocean via Support-System.

iptables -i eth0 -A INPUT -s 10.16.0.5/32 -j DROP

Regards,

Reply Report
uksbrara August 7, 2016

Many thanks for your answer. It does appear to be our IP address.

This leads me to ask, how then could it appear in the web logs of our software, appearing to request a vulnerability ?

Reply Report
Submit an Answer

Related

Looking for something else?

Ask a new question Search for more help