I’m getting EXACTLY the same, also from Bulgaria.
Although looking at the logs, it shows EVERY login coming from my servers own address, not from my actual address.
I’ve tried ALL the options under the
How does Wordfence get IPs
section but it doesn’t have any effect.
Hi @willevanstyxan and @mashedupmatt,
If all the available options still show the wrong IP address, then you will need to contact your hosting provider for more assistance. Wordfence uses the information that your host provides, and if all the IP addresses that it receives is wrong, there is nothing more Wordfence or any WordPress plugin can do to retrieve the correct IP address.
This is usually caused by incorrect routing by the hosting provider, and your best bet is to open a ticket up with them so they can correct the issue on their end.
Dave
Hi,
I’ve edited my response seeing that Dave has already responded.
Thanks,
Gerroald
-
This reply was modified 5 years, 11 months ago by
WFGerroald.
Hi Dave
I do not believe this is correct as I’m with 123 reg who are a massive hosting company meaning you would have more than just me and one other with this issue, also seems very coincidental that it’s the same as the attacking IP address as the login attempts were not me. So this would suggest this is a problem with your plugin.
Thanks
Matt
This is the IP 77.104.175.114
@willevanstyxan who is your hosting provider?
Mine is Siteground but also a massive hosting provider.
hello, is there any update here?
just an update from me but my problem did turn out to be an issue with my host. They had changed the ip of the server and were forwarding the old IP to the new IP. Once I updated the A record for the domain to the new IP, the issues resolved themselves
thanks for letting me know, im still waiting for hosting provider to come back to me. When you say new IP is that just a brand new one?
yes. Effectively, my host was moving my site to a server to a new one but instead of telling me the ip for the new server, they just forwarded the old one to the new one.
Hey All,
This is definitely going to be a hosting configuration issue, as most of you has discovered. I understand how frustrating things like this can be, especially when you’re not sure what is exactly causing it. But I am happy to hear it’s been tracked down.
Please do let us know if anything else comes up.
Thanks,
Gerroald