Tweet
On one of my client sites, wordfence have been reported manay attacks by one particular ip.
It is reporting the below message or similar for the same ip several days:
The Wordfence Web Application Firewall has blocked 248 attacks over the last 10 minutes. Below is a sample of these recent attacks: February 17, 2018 5:28pm 46.4.0.246 (Germany) Blocked because the IP is blacklisted February 17, 2018 5:28pm
So this ip is blacklisted by wordfence centrally detected by wordfence trying to access one of my client sites and blocked by wordfence.
It doesn’t appear to be detected by immunify360 as that io does not appear in the incident log, and does not appear in the grey list.
I have added it to the blacklist in immunify360 as a precaution.
Why is wordfence detecting and blocking a malicious ip when immunify360 is not?
Surely immunify360 shoulda at server level detect the io before wordfence. Or is it because wordfence blocks the io from attempting anything suspicious to trigger immunify in the first place?
Surely though if an ip is sufficiently dodgy for wordfence to blacklist it it would be picked up across immunify360 from other servers with immunify369 and herd protection aplied?
So I guess this is leading me to wonder if specifically WordPress is monitored and protected for bad actors by immunify360?
Kind Regards,
Chris
It is reporting the below message or similar for the same ip several days:
The Wordfence Web Application Firewall has blocked 248 attacks over the last 10 minutes. Below is a sample of these recent attacks: February 17, 2018 5:28pm 46.4.0.246 (Germany) Blocked because the IP is blacklisted February 17, 2018 5:28pm
So this ip is blacklisted by wordfence centrally detected by wordfence trying to access one of my client sites and blocked by wordfence.
It doesn’t appear to be detected by immunify360 as that io does not appear in the incident log, and does not appear in the grey list.
I have added it to the blacklist in immunify360 as a precaution.
Why is wordfence detecting and blocking a malicious ip when immunify360 is not?
Surely immunify360 shoulda at server level detect the io before wordfence. Or is it because wordfence blocks the io from attempting anything suspicious to trigger immunify in the first place?
Surely though if an ip is sufficiently dodgy for wordfence to blacklist it it would be picked up across immunify360 from other servers with immunify369 and herd protection aplied?
So I guess this is leading me to wonder if specifically WordPress is monitored and protected for bad actors by immunify360?
Kind Regards,
Chris
Comment