Hi @tbrock47
Sorry to hear you are having this issue.
Our servers are located in the US region, you can find the IPs at:
https://premium.wpmudev.org/docs/getting-started/wpmu-dev-ip-addresses/
It should only connect to the server using the API when the SEO checkup runs.
Let me ask, can you let us know how did you found the traffic is from the plugin and we can try to replicate?
Could you also reinstall the plugin and run a malware scan on your website just to make sure it is not infected?
https://wordpress.org/plugins/defender-security/
Best Regards
Patrick Freitas
Basically, I firewalled off the entire world with the exception of USA IP ranges and I was still finding egress traffic to Japan, Asia, Russia, Singapore, etc when analyzing network logs. So that meant all the traffic had to be originating from the server itself. So I started shutting off plugins to find the culprit. This turned out to be it.
GCP charges you for egress traffic which price varies depending on the region.
My machine is located in one of Google’s Salt Lake City datacenters, so I was seeing daily charges for “Network Internet Egress from Salt Lake City to APAC”.
I will schedule a plugin reinstall but I am not really sure how that would solve the problem unless a version of your plugin was compromised at one time.
Some of the IPs I found in my flow logs.
94.182.181.178
216.10.251.112
111.221.44.122
82.102.173.71
113.90.176.51
119.45.195.247
45.151.249.80
Again, all this traffic stopped as soon as I disabled the plugin.
-
This reply was modified 5 years, 2 months ago by
tbrock47.
Hello there @tbrock47
So I started shutting off plugins to find the culprit. This turned out to be it.
Did you confirm that it was just due to SmartCrawl and not any other plugin you deactivated at that time?
Also, please let me know if you run any malware scanning to the website’s files, just in case this is happening due to some vulnerability, even though we are not aware of any known issue with SmartCrawl, but the source can always be something else.
Finally, can you share the logs of these calls to the reported IPs? This might also help us narrow this down.
Thank you,
Dimitris
Hello @tbrock47 ,
We haven’t heard from you for several days now, so it looks like you no longer need our assistance.
Please feel free to re-open this ticket if needed.
kind regards,
Kasia