I have recently migrated several sites to a new server using easyengine, which created a separate set of docker images for each WP website. Internally on my server, each of these sites gets a private IP (172.x.x.x) and externally of course domains are routed via dns to the external server named and served up normally. I noticed that a couple of my migrated sites are experiencing failed logins (shown in the activity log plugin) that have no referrer and seem to come from the private IP of the server itself. When I examine the logs I see entries like this at the exact time of failure:
172.19.0.1 - - [29/Oct/2021:10:20:27 +0000] "POST /wp-cron.php?doing_wp_cron=1635502827.4259769916534423828125 HTTP/1.1" 200 31 "https://mysitename.com/wp-cron.php?doing_wp_cron=1635502827.4259769916534423828125" "WordPress/5.8.1; https://mysitename.com"
Sometimes the logs show the same internal IP trying to POST to xmlrpc and a couple of other files.
Even though I have wordfence set up and it should block failed login attempts, it ignores these (I assume because they are local, private IPs) so they never get blocked. It does not yet appear that someone has been able to login, but this is very concerning and I can't track it down yet. Here are the things I notice and the questions I have about this activity:
- Could someone possibly spoof an internal IP from an outside request? This seems unlikely as it is only happening on the two sites that came from the same old server, the other sites still seem unaffected.
- I have combed through all of the files and can't find any malicious code. And I have completely reinstalled WP on one of them and exported and reimported using the WP importer (instead of directly copying the db), but still have these attempts
- I can't find any reference to a hack like this, does anyone have any idea how it could be tracked down?
- So far, none of these attempts has guessed an existing username, and they have all failed to login