Invalid IP Address: 1.1 localhost

  • Resolved swissspaceboy

    (@swissspaceboy)


    5 years, 9 months ago

    Hello,

    I have these strange error messages in my PHP error log file. I have no access activity at those timestamps, except that one admin was doing some stuff in Wordfence around that time (adding blocking rules or monitoring the Live Activity).

    Any idea where they could be coming from?

    No cache plugin, except OPCache.

    [22-Sep-2020 06:38:05 UTC] Invalid IP Address: 1.1 localhost (Apache-HttpClient/4.5.2 (cache))
[22-Sep-2020 06:43:20 UTC] Invalid IP Address: 1.1 localhost (Apache-HttpClient/4.5.2 (cache))
[22-Sep-2020 06:48:27 UTC] Invalid IP Address: 1.1 localhost (Apache-HttpClient/4.5.2 (cache))
[22-Sep-2020 06:53:41 UTC] Invalid IP Address: 1.1 localhost (Apache-HttpClient/4.5.2 (cache))
[22-Sep-2020 11:21:53 UTC] Invalid IP Address: 1.1 localhost (Apache-HttpClient/4.5.2 (cache))
[22-Sep-2020 11:27:06 UTC] Invalid IP Address: 1.1 localhost (Apache-HttpClient/4.5.2 (cache))
[22-Sep-2020 11:32:17 UTC] Invalid IP Address: 1.1 localhost (Apache-HttpClient/4.5.2 (cache))
[22-Sep-2020 11:37:18 UTC] Invalid IP Address: 1.1 localhost (Apache-HttpClient/4.5.2 (cache))
[22-Sep-2020 12:31:05 UTC] Invalid IP Address: 1.1 localhost (Apache-HttpClient/4.5.2 (cache))
[22-Sep-2020 12:36:30 UTC] Invalid IP Address: 1.1 localhost (Apache-HttpClient/4.5.2 (cache))
[22-Sep-2020 12:41:53 UTC] Invalid IP Address: 1.1 localhost (Apache-HttpClient/4.5.2 (cache))
[22-Sep-2020 12:47:11 UTC] Invalid IP Address: 1.1 localhost (Apache-HttpClient/4.5.2 (cache))
[23-Sep-2020 11:23:17 UTC] Invalid IP Address: 1.1 localhost (Apache-HttpClient/4.5.2 (cache))
[23-Sep-2020 11:28:22 UTC] Invalid IP Address: 1.1 localhost (Apache-HttpClient/4.5.2 (cache))
[23-Sep-2020 11:33:51 UTC] Invalid IP Address: 1.1 localhost (Apache-HttpClient/4.5.2 (cache))
[23-Sep-2020 11:39:01 UTC] Invalid IP Address: 1.1 localhost (Apache-HttpClient/4.5.2 (cache))
[23-Sep-2020 13:30:59 UTC] Invalid IP Address: 1.1 localhost (Apache-HttpClient/4.5.2 (cache))
[23-Sep-2020 13:37:43 UTC] Invalid IP Address: 1.1 localhost (Apache-HttpClient/4.5.2 (cache))
[23-Sep-2020 13:44:19 UTC] Invalid IP Address: 1.1 localhost (Apache-HttpClient/4.5.2 (cache))
[23-Sep-2020 13:50:59 UTC] Invalid IP Address: 1.1 localhost (Apache-HttpClient/4.5.2 (cache))
Viewing 10 replies - 1 through 10 (of 10 total)
  • Niall Madhoo

    (@nm1com)

    5 years, 9 months ago

    Hello @swissspaceboy,

    I recommend contacting your web host to help with this issue.

    Thread Starter swissspaceboy

    (@swissspaceboy)

    5 years, 9 months ago

    Hi Niall,

    Already done. They have no idea. I also contacted plugins Autoptimize, WordFence.

    The Apache version 4.5.2 is a bit out-dated. I will ask them if they can update.

    Really strange.

    Thanks,

    Didier.

    Niall Madhoo

    (@nm1com)

    5 years, 9 months ago

    You’re welcome, Didier.

    Thread Starter swissspaceboy

    (@swissspaceboy)

    5 years, 9 months ago

    Hi Niall,

    Well, my web hoster is NOT using Apache, but Litespeed. So it can only be from a PHP WordPress plugin.

    Between the 2-3 occurrences per day, there are 5-6-7 minutes. I am wondering what that could be.

    To see if I can get more information in the PHP error log like the stacktrace.

    If you have any other ideas, always welcome!

    Many thanks,

    Didier.

    Optimizing Matters

    (@optimizingmatters)

    5 years, 9 months ago

    but Apache-HttpClient/4.5.2 (cache) is the useragent of a (Java-based) HTTP client, not the HTTP server.

    Thread Starter swissspaceboy

    (@swissspaceboy)

    5 years, 9 months ago

    yeah ! good remark. So it is a Java client doing HTTP request to my website.

    What Java client could it be? And is it coming from the server or from outside? There is nothing in the HTTP access log.

    I have some crons running but not at that time.

    I was able to enable some php stacktraces if the error is coming from WordPress. Let’s see the next time when the error comes up. Almost once every day/every 2 days.

    aahh…the happiness of computers…

    Didier.

    Optimizing Matters

    (@optimizingmatters)

    5 years, 9 months ago

    As this is from the php-error-logfile, look for a PHP-file with the exact string “Invalid IP Address” in it?

    Thread Starter swissspaceboy

    (@swissspaceboy)

    5 years, 9 months ago

    ha got it..I searched already for that string, but my files were not the refreshed, so it was from an old backup.

    I scanned again on a fresh set, and bingo, plugin “blackhole for bad bots”:

    if ($ip) {
			
			$log = apply_filters('blackhole_validate_ip_log', 'Invalid IP Address: '. $ip, $ip);
			
			error_log($log);
			
		}

    I will write to the author.

    Many thanks Frank for your push/hint. It really made me curious so I tried it out on this Sunday evening.

    Have a good week ahead !

    Didier.

    Optimizing Matters

    (@optimizingmatters)

    5 years, 9 months ago

    well, the explanation might be simple in that case; “blackhole for bad bots” simply caught a bad bot? 🙂

    Thread Starter swissspaceboy

    (@swissspaceboy)

    5 years, 9 months ago

    I have a log of the caught bad bots, but nothing in there. Also, this is not a Java client right? Don’t know where this Apache http client is coming from.

    Anyway, as we know now the plugin, we can do further troubleshooting and debugging 🙂

    I wrote to the plugin author Jeff. He replied normally quite fast.

    Bye,

    Didier.

Viewing 10 replies - 1 through 10 (of 10 total)

The topic ‘Invalid IP Address: 1.1 localhost’ is closed to new replies.