Unknown whitelisted urls

  • Resolved frestro79

    (@frestro79)


    7 years, 4 months ago

    I have Wordfence running on several sites.
    The latest one is still in learning mode, and there i have gotten a whitelist under the firewall i have not seen before –> request.fileNames[yiw_contact][0] 12.12.2016, 09.22.17 Whitelisted while in Learning Mode. – 195.154.2**.***
    What is that, and is it safe?

Viewing 2 replies - 1 through 2 (of 2 total)
  • wfalaa

    (@wfalaa)

    7 years, 4 months ago

    Hi,
    This is most probably was whitelisted while you were submitting a form on your website, please let me know the name and version of the current theme activated on your website to make sure it’s not vulnerable for this one.

    Thanks.

    Thread Starter frestro79

    (@frestro79)

    7 years, 4 months ago

    Avada 5.0.5. (Updated to 5.0.6 now though) with CF7.
    I checked the ip, and it is affiliated to rev.poneytelecom.eu which i have seen and blocked from other pages, due to they are trying to access misc non existent .php.
    So i deleted it from the whitelist.

    I have recently installed Wordfence on two pages i have Avada on, and the link you posted is just what took one of them (that was before i installed Wordfence). They managed to get into my upload folder, uploaded a couple of .php files and also a .x1-unix folder. Spammed the blog and my sitemap with a lot crap.
    So thank god for your amazing plugin, it saved me alot of hassle. I found the files hidden several places in my upload dir and deleted them, and also removed the spam from Google.

Viewing 2 replies - 1 through 2 (of 2 total)
  • The topic ‘Unknown whitelisted urls’ is closed to new replies.