Title: wordfence_syncAttackData and wp-cron.php?doing_wp_cron Last modified: September 24, 2019 --- # wordfence_syncAttackData and wp-cron.php?doing_wp_cron * [0815noname](https://wordpress.org/support/users/0815noname/) * (@0815noname) * [6 years, 7 months ago](https://wordpress.org/support/topic/wordfence_syncattackdata-and-wp-cron-phpdoing_wp_cron/) * Hi, * Live traffic is showing endless entries of those two entry types: ‘Switzerland left [https://mydomain/?wordfence_syncAttackData=1569356277.9766](https://mydomain/?wordfence_syncAttackData=1569356277.9766) and was blocked for UA/Referrer/IP Range not allowed at [https://mydomain/?wordfence_syncAttackData=1569356277.9766](https://mydomain/?wordfence_syncAttackData=1569356277.9766) 24.9.2019 22:17:57 (37 minutes ago) IP: 2a00:d70:0:b:2002:0:d91a:3755 Human/Bot: Bot Browser: undefined’ * Switzerland left [https://mydomain/wp-cron.php?doing_wp_cron=1569356278.1035809516906738281250](https://mydomain/wp-cron.php?doing_wp_cron=1569356278.1035809516906738281250) and was blocked for UA/Referrer/IP Range not allowed at [https://mydomain/wp-cron.php?doing_wp_cron=1569356278.1035809516906738281250](https://mydomain/wp-cron.php?doing_wp_cron=1569356278.1035809516906738281250) 24.9.2019 22:17:58 (43 minutes ago) IP: 2a00:d70:0:b:2002:0:d91a:3755 Human/Bot: Bot Browser: undefined * I have contacted my hosting company and they explained, that the listed IP address is their own, but couldn’t help any further. I have also tried to access the URL shown in the syncAttack directly and it shows a blank page. * How can I solve this problem? * Thanks * The page I need help with: _[[log in](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fwordpress.org%2Fsupport%2Ftopic%2Fwordfence_syncattackdata-and-wp-cron-phpdoing_wp_cron%2F%3Foutput_format%3Dmd&locale=en_US) to see the link]_ Viewing 2 replies - 1 through 2 (of 2 total) * [wfdave](https://wordpress.org/support/users/wfdave/) * (@wfdave) * [6 years, 7 months ago](https://wordpress.org/support/topic/wordfence_syncattackdata-and-wp-cron-phpdoing_wp_cron/#post-11965542) * Hi [@0815noname](https://wordpress.org/support/users/0815noname/), * Your host is running cronjobs with the page `wp-cron.php`, and the `wordfence_syncAttackData` URL is used to update Live Traffic within Wordfence. * I’d recommend whitelisting `2a00:d70:0:b:2002:0:d91a:3755` within Wordfence - > All Options (under IP addresses that bypass all rules). * Dave * Thread Starter [0815noname](https://wordpress.org/support/users/0815noname/) * (@0815noname) * [6 years, 7 months ago](https://wordpress.org/support/topic/wordfence_syncattackdata-and-wp-cron-phpdoing_wp_cron/#post-11966536) * Hi Dave, * Thank you for your fast reply and your recommendation. * I was checking our weekly Wordfence report after I have posted that. I was looking for IP addresses from Switzerland (because it looks odd to me to have blocked IP addresses from Switzerland while other countries such China, India etc. are usual). And there were more such entries. Most block counts last week had the IP address from my host, but there were others: * #1 2a00:d70:0:b:2002:0:d91a:3755 // Switzerland // 979 #2 45.55.41.191 // United States // 60 #3 120.27.6.97 // China // 21 #4 2a02:1206:458a:3d40:106b:69f8:11d7: f21a // Switzerland // 11 #5 2a02:120b:7fc:ff50:56d:9d09:65d4:2de5 // Switzerland// 8 #6 2400:6180:0:d1::827:1001 // Singapore // 7 #7 2400:6180:100:d0::19f8:2001// India // 6 #8 2001:8d8:965:2be5:a330:d16d:4548:0 // Germany // 6 #9 2a02:120b: 2c69:aed0:5cf1:8abb:6513:d7be // Switzerland // 6 #10 2a03:b0c0:1:e0::4dc:a001// United Kingdom // 6 * Filtering the IP addresses in Live Traffic Advanced Filters, most wordfence_syncAttackData and wp-cron.php were from IP #1 (as in my preview post), #4 showed no result # 5 and #9 showed the following results: * Stans, Switzerland left [https://mydomain/kontakt/](https://mydomain/kontakt/) and was blocked for UA/Referrer/IP Range not allowed at [https://mydomain/?wordfence_syncAttackData=1568230128.9357](https://mydomain/?wordfence_syncAttackData=1568230128.9357) 23.9.2019 19:43:44 (1 day 13 hours ago) IP: 2a02:120b:2c69:aed0:5cf1:8abb:6513: d7be Human/Bot: Human Browser: Chrome version 0.0 running on Android Mozilla/ 5.0 (Linux; Android 9; SM-T830) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ 76.0.3809.132 Safari/537.36 * Lucerne, Switzerland left [https://mydomain/anmeldung/](https://mydomain/anmeldung/) and was blocked for UA/Referrer/IP Range not allowed at [https://mydomain/?wordfence_syncAttackData=1568236314.5902](https://mydomain/?wordfence_syncAttackData=1568236314.5902) 23.9.2019 11:30:23 (1 day 22 hours ago) IP: 2a02:120b:7fc:ff50:56d:9d09:65d4: 2de5 Human/Bot: Human Browser: Chrome version 0.0 running on Android Mozilla/ 5.0 (Linux; Android 7.1.1; SAMSUNG SM-T550) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/10.1 Chrome/71.0.3578.99 Safari/537.36 * At the moment, Live traffic is showing wordfence_syncAttackData and wp-cron.php every view seconds from IP #1, http response is 503. * I am not sure by whitelisting our host IP. Is there an attack ongoing or what do you think? * Thank you for coming back to me. Viewing 2 replies - 1 through 2 (of 2 total) The topic ‘wordfence_syncAttackData and wp-cron.php?doing_wp_cron’ is closed to new replies. * ![](https://ps.w.org/wordfence/assets/icon.svg?rev=2070865) * [Wordfence Security - Firewall, Malware Scan, and Login Security](https://wordpress.org/plugins/wordfence/) * [Frequently Asked Questions](https://wordpress.org/plugins/wordfence/#faq) * [Support Threads](https://wordpress.org/support/plugin/wordfence/) * [Active Topics](https://wordpress.org/support/plugin/wordfence/active/) * [Unresolved Topics](https://wordpress.org/support/plugin/wordfence/unresolved/) * [Reviews](https://wordpress.org/support/plugin/wordfence/reviews/) ## Tags * [live traffic](https://wordpress.org/support/topic-tag/live-traffic/) * [syncattackdata](https://wordpress.org/support/topic-tag/syncattackdata/) * 2 replies * 2 participants * Last reply from: [0815noname](https://wordpress.org/support/users/0815noname/) * Last activity: [6 years, 7 months ago](https://wordpress.org/support/topic/wordfence_syncattackdata-and-wp-cron-phpdoing_wp_cron/#post-11966536) * Status: not resolved