公司密码泄露遭TOR IP登录，能否追踪溯源？内部泄露疑云咨询

Absolutely, you can track Tor IP login attempts on your WordPress site—though it’s critical to note Tor’s core purpose is to anonymize users, so you won’t get a precise, personal origin for the attacker. That said, you can identify Tor exit nodes, log their activity, and take steps to block or correlate this with your broader breach investigation. Here’s how to do it:

1. Leverage Your Existing WordPress Security Plugin #

Since you already have a plugin installed, most popular security tools (like Wordfence, Sucuri Security, or iThemes Security) include built-in Tor detection:

• Head to the plugin’s logs or live traffic dashboard (for Wordfence, this is under Tools > Live Traffic). Use the search or filter option to isolate entries tagged as Tor Network or Tor Exit Node.
• These plugins maintain updated lists of known Tor exit nodes, so they’ll automatically flag logins coming from these IPs. You can set up rules to auto-block Tor-based login attempts, or mark suspicious IPs to monitor repeat activity.

2. Manual Log Analysis (For Deeper Dives) #

If your plugin doesn’t cover everything, you can dig into raw logs:

• WordPress Debug Log: First, enable debug logging by adding these lines to your wp-config.php file (back up the file first!):

  define('WP_DEBUG', true);
  define('WP_DEBUG_LOG', true);
  define('WP_DEBUG_DISPLAY', false);
  

  The log will save to wp-content/debug.log, where you can search for login-related requests (look for references to wp-login.php).
• Server Access Logs: Check your web server’s logs (Apache uses access.log, Nginx uses access.log typically stored in /var/log/apache2/ or /var/log/nginx/). Look for POST requests to wp-login.php and note the associated IPs.
• Verify Tor Nodes: To confirm if an IP is a Tor exit node, you can use the tor-resolve command (install the Tor toolset on your server first) with:

  tor-resolve [IP_ADDRESS]
  

  This will tell you if the IP maps to a known Tor exit node.

3. Additional Steps to Strengthen Tracking & Security #

• Enable Two-Factor Authentication (2FA): Even if you can track Tor IPs, 2FA adds a critical layer to block unauthorized logins. Plugins like Google Authenticator for WordPress make this easy to set up for all user accounts.
• Monitor Post-Login Activity: Track what happens after a suspicious login—look for bulk content edits, data exports, or plugin/theme changes. Security plugins often include behavior analytics to flag these anomalies, even if the IP is anonymized via Tor.
• Correlate with Your Breach Context: Since you suspect a former employee with cloud access, cross-reference Tor login timestamps with cloud file access logs. If there’s an overlap between when the cloud file was accessed and Tor logins occurred, that’s a strong clue for your internal investigation.

A quick heads-up: Tor exit node IPs change frequently, so static blacklists will become outdated fast. Make sure your security plugin is set to auto-update its threat intelligence feeds to stay current.

内容的提问来源于stack exchange，提问作者Kristián Filo