BulletProof Security Forum

[Topic was manually moved/merged into this Topic]
Hi. New here. Please be gentle!  I just got my first BPS log. I’m getting lots of 403s from seemingly innocent requests referred by Google. They are all requests for JPEGs.  Can anyone explain why I’m getting these, and if it’s a good thing / by design?  I am using an edited copy of the BPS hotlinking blocker, but I’m not sure if this is the cause.

[403 GET / HEAD Request: 25th April, 2014 - 1.08am]
Event Code: BFHS - Blocked/Forbidden Hacker or Spammer
Solution: N/A - Hacker/Spammer Blocked/Forbidden
REMOTE_ADDR: 211.253.60.18
Host Name: mail3.seoul.go.kr
SERVER_PROTOCOL: HTTP/1.1
HTTP_CLIENT_IP: 
HTTP_FORWARDED: 
HTTP_X_FORWARDED_FOR: 
HTTP_X_CLUSTER_CLIENT_IP: 
REQUEST_METHOD: GET
HTTP_REFERER: https://www.google.com/
REQUEST_URI: /wp-content/uploads/2011/09/f-stops2.gif
QUERY_STRING: 
HTTP_USER_AGENT: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.116 Safari/537.36

I also just noticed that some of the errors are from the web server itself...

[403 GET / HEAD Request: 25th April, 2014 - 8.12am]
Event Code: BFHS - Blocked/Forbidden Hacker or Spammer
Solution: N/A - Hacker/Spammer Blocked/Forbidden
REMOTE_ADDR: A.B.C.D
Host Name: server.domain.com
SERVER_PROTOCOL: HTTP/1.0
HTTP_CLIENT_IP: 
HTTP_FORWARDED: 
HTTP_X_FORWARDED_FOR: 
HTTP_X_CLUSTER_CLIENT_IP: 
REQUEST_METHOD: GET
HTTP_REFERER: 
REQUEST_URI: /wp-content/uploads/2010/12/tree-explanada-alicante.jpg
QUERY_STRING: 
HTTP_USER_AGENT: WordPress/3.9; http://mydomain.co.uk

Before you ask, here's my hotlinking blocking code...("mydomain" used as placeholder for real name)

# CUSTOM CODE BOTTOM HOTLINKING/FORBID COMMENT SPAMMERS/BLOCK BOTS/BLOCK IP/REDIRECT CODE
# BLOCK HOTLINKING TO IMAGES
RewriteCond %{HTTP_REFERER} !^https?://(www\.)?mydomain\.co\.uk [NC]
RewriteCond %{HTTP_REFERER} !^$
RewriteRule .*\.(jpeg|jpg|gif|bmp|png)$ - [F]

The solution is here:  http://forum.ait-pro.com/forums/topic/bbpress-sending-a-topic-to-trash-gives-403/#post-6442 You need to add a wp-admin skip/bypass rule for the post.php file.

When I use the shortlink I am redirected to your /forums/forum/general/ page without seeing any errors.

/?p=1799 is the shortlink for your /forums/forum/general/ page

The Security Log is a plain text file that requires an insignificant amount of website/server resources to log attacks.  Blocking and logging attacks does not slow down your website since your WordPress database is not involved and database Queries are not being used.  WordPress database queries are expensive and will slow down a website if excessive queries are being made.  50-60 attacks per minute is a bit high, but is nowhere near a DoS/DDoS attack so you should not be seeing any slowness whatsoever due to these attacks.

BPS is doing its job so you do not need to do anything else.  FYI – by denying/blocking IP addresses you will see those blocked IP addresses in your BPS Security Log.  The thing to remember is the Security Log is just a plain text log file just like your Host Server’s log file that logs activity.  The log is just logging things.

I see that the Server Protocol is HTTP/1.0 which is normally used by hackers and spammers since it allows them to do things that they cannot do with the new Server Protocol HTTP/1.1 which was started back in 1999 – 15 years ago.  So I think that should be looked at first.  If your server is using outdated Proxy software then that may be where the old Server Protocol is coming from or this may just me a typical blocked hacker, spammer, scraper, miner, bad bot, etc etc etc.  We get around 500,000 blocked hackers/spammers logged in our Security Log file per month and this is just what is nowadays on the Internet.  I see that IP Address 198.101.10.154 is in the CIDR block for CLOUD-SOUTH – Cloud South,US:  http://whois.domaintools.com/198.101.10.154  Is this your server’s IP address?

It may be that there is not really any sort of problem going on and just the normal stuff is being blocked.  I don’t have enough information to make that kind of assessment.  If you do not want to post your domain name in the forum then send it to info at ait-pro dot com and we will check your website to see if there are any problems.