I have a wordpress site (fully patched) that used to receive many attempts to log in based on dictionary attacks. I changed my admin user to something uncommon and use a really strong password.
Apart of that I changed my login page using rename wp-login.php plugin. I changed my login url to something like http://foo.com/blog/?pencil. For years the bots failed to guess my login page (still having many 404s).
For the second time in a month. First time I had a failed attempt and changed url to http://foo.com/blog/?paper and didn't think much about it. Second time happened today. Exact events:
19th April
Successful login from my employer office (via proxy) to http://foo.com/blog/?pencil at 18:00 from my company laptop.
2 failed attempts from 70.32.73.128 (report about the IP ), a IP from California, at 02:54am GMT (The server seems to be reported as hacked) using admin username (that btw doesn't exist in my wordpress)
I changed password and url to http://foo.com/blog/?paper
I enabled capturing of incoming passwords in log.
Now
Yesterday (11:10 am) I accessed to blog to correct an entry from my employer network (same proxy).
Today at 11:55 1 failed attempt from 213.248.63.27 (Virus Total report about the IP), a russian IP with suspicious sites like vrn.sauna.ru (probably NSFW url). It used oscarfoley as username with no password (my username is not oscarfoley or similar)
I feel pretty secure as the bot has to guess the login page, the admin user and the pass. However, by reading this site I am a little bit paranoid.
So my main question is:
How the bot has "guessed" the paper or pencil login page?
Could be my employer proxy/network be compromised? (Like a hacker having access to proxy logs...)
Could it be a broad dictionary attack (something like a boot scanning all wordpress servers in the internet to see if the login page is pencil)?.. or a exploit in wordpress?
Is there anything more I should do to protect myself?
Could it be a personal attack using public information on internet? Or a bot that uses public information for broad attacks?
Why the empty password?
How can I be sure I am not hacked? (Forget about this as it is pretty good answered in this question)
Could be my laptop or my pc at home be hacked and got the url from it? My guess is no because otherwise they would have my password...
EDIT: To be more clear, attacker hit the login url directly with NO failed attempts on other similar urls. Check here last 404 errors: 