Support » Plugin: Shield Security: Protection with Smarter Automation » getting firewall block alerts from ip address 127.0.0.1

  • Resolved Groovyx9

    (@groovyx9)


    “Log details for this visitor are below :
    – IP Address : 127.0.01”

    How is it even possible ? Started yesterday on 2 web sites… Never seen before…

    • This topic was modified 2 years, 9 months ago by Groovyx9.
    • This topic was modified 2 years, 9 months ago by Groovyx9.
    • This topic was modified 2 years, 9 months ago by Groovyx9.
Viewing 6 replies - 1 through 6 (of 6 total)
  • Plugin Author Paul

    (@paultgoodchild)

    Never seen it either… what does the log pertain to?

    The usual :

    Page parameter failed firewall check. The offending parameter was “file” with a value of “../wp-config.php”. Firewall Trigger: Directory Traversal. Firewall Block Response: Visitor connection was killed with wp_die() and a message. Successfully sent Firewall Block email alert to:
    xxxx

    ***

    Page parameter failed firewall check. The offending parameter was “file” with a value of “/etc/passwd”. Firewall Trigger: Directory Traversal. Firewall Block Response: Visitor connection was killed with wp_die() and a message. Successfully sent Firewall Block email alert to:
    xxxx

    and the same 2 alerts on a multisite (same dedicated server)

    Plugin Author Paul

    (@paultgoodchild)

    They could be spoofed IP addresses somehow… frankly all you need to know is that they’re being blocked. The reported IP addresses doesn’t need to be the real one – it doesn’t matter as long as the request itself was blocked.

    Thanks Paul…

    Plugin Author Paul

    (@paultgoodchild)

    No problem! 🙂

Viewing 6 replies - 1 through 6 (of 6 total)
  • The topic ‘getting firewall block alerts from ip address 127.0.0.1’ is closed to new replies.