[infinity]

I write all (futile) login attempts on my site to a log file. I can confirm this rise in password bruteforcing attempts during the last days.

This is what the bruteforce passwords look like, these tried to login as "admin":

  [Sat Apr 13 05:30:31 2013]   nevalidniipass 
  [Sat Apr 13 05:30:34 2013]   gfhjkm 
  [Sat Apr 13 05:30:37 2013]   gggggggg 
  [Sat Apr 13 05:30:39 2013]   ghbdtn 
  [Sat Apr 13 05:30:41 2013]   ghgftmn6 
  [Sat Apr 13 05:30:43 2013]   ghghgh 
  [Sat Apr 13 05:30:44 2013]   ghjkju 
  [Sat Apr 13 05:30:46 2013]   ghjrdjcn 
  [Sat Apr 13 05:30:48 2013]   gjkzyjxr 
  [Sat Apr 13 05:30:50 2013]   globax123 
  [Sat Apr 13 05:30:52 2013]   go0gle 
  [Sat Apr 13 05:30:54 2013]   go2fuck 
  [Sat Apr 13 05:30:55 2013]   gogogo 
  [Sat Apr 13 05:30:57 2013]   goldz 
  [Sat Apr 13 05:30:59 2013]   gthtw112 
  [Sat Apr 13 05:31:02 2013]   guest 
  [Sat Apr 13 05:31:05 2013]   h69s9t 
  [Sat Apr 13 05:31:07 2013]   hackett 
  [Sat Apr 13 05:31:08 2013]   hal9000 
  [Sat Apr 13 05:31:10 2013]   hazem200 
  [Sat Apr 13 05:31:12 2013]   heccrbqh 
  [Sat Apr 13 05:31:14 2013]   herbie 
  [Sat Apr 13 05:31:16 2013]   hghgh 
  [Sat Apr 13 05:31:18 2013]   hhhh1 
  [Sat Apr 13 05:31:20 2013]   hhhhhaaaaa 
  [Sat Apr 13 05:31:21 2013]   hockey 
  [Sat Apr 13 05:31:23 2013]   home555 
  [Sat Apr 13 05:31:25 2013]   honda 
  [Sat Apr 13 05:31:27 2013]   htrdbtv 
  [Sat Apr 13 05:31:29 2013]   http 
  [Sat Apr 13 05:31:31 2013]   hycvibck 
  [Sat Apr 13 05:31:33 2013]   i_am 
  [Sat Apr 13 05:31:35 2013]   ib6ub9 
  [Sat Apr 13 05:31:37 2013]   icing 
  [Sat Apr 13 05:31:38 2013]   icq123 
  [Sat Apr 13 05:31:40 2013]   icqpass 
  [Sat Apr 13 05:31:42 2013]   if6was9 
  [Sat Apr 13 05:31:44 2013]   ifhgtq79 
  [Sat Apr 13 05:31:46 2013]   ifyfif 
  [Sat Apr 13 05:31:48 2013]   iiiiiiii 
  [Sat Apr 13 05:31:50 2013]   ikaihsot 
  [Sat Apr 13 05:31:52 2013]   il0vey0u 
  [Sat Apr 13 05:31:54 2013]   iloveaol 
  [Sat Apr 13 05:31:56 2013]   iloveu 
  [Sat Apr 13 05:31:57 2013]   iloveyou 
  [Sat Apr 13 05:31:59 2013]   inferno 
  [Sat Apr 13 05:32:01 2013]   infinity 
  [Sat Apr 13 05:32:05 2013]   infree 
  [Sat Apr 13 05:32:08 2013]   iof314 
  [Sat Apr 13 05:32:11 2013]   jake4440 
  [Sat Apr 13 05:32:13 2013]   jamie1 
  [Sat Apr 13 05:32:15 2013]   janice 
  [Sat Apr 13 05:32:16 2013]   jay18birdman 
  [Sat Apr 13 05:32:18 2013]   jc5000 
  [Sat Apr 13 05:32:20 2013]   jeffery 
  [Sat Apr 13 05:32:22 2013]   john1 
  [Sat Apr 13 05:32:24 2013]   joomla 
  [Sat Apr 13 05:32:26 2013]   joshua 
  [Sat Apr 13 05:32:27 2013]   keys 
  [Sat Apr 13 05:32:29 2013]   kholmsk3 
  [Sat Apr 13 05:32:31 2013]   kir11421 
  [Sat Apr 13 05:32:33 2013]   kkkkkk 
  [Sat Apr 13 05:32:35 2013]   kngvhpg 
  [Sat Apr 13 05:32:37 2013]   ko#]|7sz 
  [Sat Apr 13 05:32:39 2013]   kxvq4k2d 
  [Sat Apr 13 05:32:41 2013]   laksmi 
  [Sat Apr 13 05:32:42 2013]   lefty 
  [Sat Apr 13 05:32:44 2013]   lex1977 
  [Sat Apr 13 05:32:46 2013]   linux 
  [Sat Apr 13 05:32:48 2013]   lol 
  [Sat Apr 13 05:32:50 2013]   lol777 
  [Sat Apr 13 05:32:52 2013]   lollol 
  [Sat Apr 13 05:32:54 2013]   lovelove 
  [Sat Apr 13 05:32:55 2013]   lucille2000 
  [Sat Apr 13 05:32:57 2013]   lyxasgje 
  [Sat Apr 13 05:32:59 2013]   m@$ter 
  [Sat Apr 13 05:33:02 2013]   m@ster 
  [Sat Apr 13 05:33:07 2013]   m1911a1 
  [Sat Apr 13 05:33:11 2013]   google 
  [Sat Apr 13 05:33:13 2013]   facebook 
  [Sat Apr 13 05:33:15 2013]   microsoft 
  [Sat Apr 13 05:33:17 2013]   obama 
  [Sat Apr 13 05:33:18 2013]   twitter 
  [Sat Apr 13 05:33:20 2013]   wp 
  [Sat Apr 13 05:33:22 2013]   wordpress 
  [Sat Apr 13 05:33:24 2013]   060890 
  [Sat Apr 13 05:33:26 2013]   060891 
  [Sat Apr 13 05:33:28 2013]   060893 
  [Sat Apr 13 05:33:30 2013]   060988 
  [Sat Apr 13 05:33:32 2013]   060989

They also try to get access as "administrator".

[OGC]

nitpick: that's a dictionary attack, not brute-force

[infinity]

Yes, of course you're right, my mistake. Mainly I wanted to share some information and give examples of passwords.

Here are some more observations which I made during the last months:

Most of the time it seems that the attackers are using a list of popular passwords, the same passwords appear over and over again: 12345, qwerty, 1q2w3e4r, and so on.

Most of the time they try to login as "admin", "Admin", "administrator", "root" or the name of the domain or blog or a part of that name, for example omitting a ".com".

In the HTTP requests, the parameters "log" (for the user name) and "pwd" (for the password) are always transmitted, but the parameters "wp-submit=Log In" and "testcookie=1" are not always transmitted.

Many of these attacks do not transmit a user-agent field in the HTTP headers. Blocking the empty user-agent seems like a good idea to me.

These attacks look simple, but I guess that they are successful on a big number of sites.