Okay, so just to clarify, am I actually breaking this news? No. Definitely not. But my automated log scanner picked up a jump in malicious activity yesterday on my network, so it’s worth taking a closer look. First, we see the jump in numbers:

Note that addresses have been lazily obfuscated but do not actually belong to the same class C, though some do share common ASNs (and some do indeed share a common class C). Wonderful, so let’s take a look at the log itself (a small sample is presented below for brevity):

This pattern of 5 IPs making quick attacks and rotating out repeats throughout the set of the botnet, possibly as an attempt to avoid brute force mitigation. Also, notice the user agent string?  Yeah, hooray for modern web infrastructure relying on arbitrary data on which non-repudiation cannot be established.

Looking at the timeline of the attacks, we see it lasted about an hour and a half:

Wait, that’s interesting. What’s that first hit doing? A GET is sent to wp-login.php with no referer. Let’s look at all of that IP’s traffic:

This pattern indicates that X.X.X.141 functions as a crawler, searching for targets. Once the bot’s victim is identified, the labor of distributed brute force is assigned to other members of the attacking group, with each attacking host working in serial, again, likely as an attempt to avoid detection.

So what’s a sysadmin to do? Most people will resort to plugins for this sort of defense, but most brute force detection plugins come packaged as an all-in-one framework. I’m partial to a WAF approach with mod_security: