• Resolved mcohenimpact

    (@mcohenimpact)


    I received an email notification of an increased attack rate from Wordfence in two places:

    1) Notification email address for the targeted website (sent from my server)

    2) Notification email address for Wordfence Central

    Email #1 was formatted properly and looks like this:

    November 7, 2020 2:36pm  xx.xx.xx.xx (France)     Blocked for Directory Traversal - wp-config.php in query string: file=../wp-config.php
    November 7, 2020 2:36pm  xx.xx.xx.xx (France)     Blocked for Directory Traversal - wp-config.php in query string: wpabspath=../../../../../wp-config.php
    November 7, 2020 2:36pm  xx.xx.xx.xx (France)     Blocked for Directory Traversal - wp-config.php in query string: language=../../../../wp-config.php
    November 7, 2020 2:36pm  xx.xx.xx.xx (France)     Blocked for Directory Traversal - wp-config.php in query string: url=../../../../wp-config.php
    November 7, 2020 2:36pm  xx.xx.xx.xx (France)     Blocked for Directory Traversal - wp-config.php in query string: homep=../../../wp-config.php
    November 7, 2020 2:36pm  xx.xx.xx.xx (France)     Blocked for Directory Traversal - wp-config.php in query string: url=../../../wp-config.php
    

    Email #2 (from Wordfence Central) was missing all line breaks, so it came out like this:

    ncreased Attack Rate: The Wordfence Web Application Firewall has blocked 101 attacks over the last 10 minutes. Below is a sample of these recent attacks: November 7, 2020 2:36pm - xx.xx.xx.xx (France) - Blocked for Directory Traversal - wp-config.php in query string: file=../wp-config.php November 7, 2020 2:36pm - xx.xx.xx.xx (France) - Blocked for Directory Traversal - wp-config.php in query string: wpabspath=../../../../../wp-config.php November 7, 2020 2:36pm - xx.xx.xx.xx (France) - Blocked for Directory Traversal - wp-config.php in query string: language=../../../../wp-config.php November 7, 2020 2:36pm - xx.xx.xx.xx (France) - Blocked for Directory Traversal - wp-config.php in query string: url=../../../../wp-config.php November 7, 2020 2:36pm - xx.xx.xx.xx (France) - Blocked for Directory Traversal - wp-config.php in query string: homep=../../../wp-config.php November 7, 2020 2:36pm - xx.xx.xx.xx (France) - Blocked for Directory Traversal - wp-config.php in query string: url=../../../wp-config.php November 7, 2020 2:36pm - xx.xx.xx.xx (France) - Blocked for Directory Traversal - wp-config.php in query string: wpPATH=../../../../wp-config.php November 7, 2020 2:36pm - xx.xx.xx.xx (France) - Blocked for Directory Traversal - wp-config.php in query string: file=../../../../../wp-config.php November 7, 2020 2:36pm - xx.xx.xx.xx (France) - Blocked for Directory Traversal - wp-config.php in query string: path=../../../../wp-config.php November 7, 2020 2:36pm - xx.xx.xx.xx (France) - Blocked for Directory Traversal - wp-config.php in query string: file=../../../../wp-config.php
    

    Both are processed by an exchange server. Any thoughts? Obviously the formatting on #2 is less helpful than #1.

Viewing 1 replies (of 1 total)
  • Plugin Support wfpeter

    (@wfpeter)

    Hi @mcohenimpact, thank you for dropping this message our way.

    This seems, especially as the first mail formatted correctly, like an anomaly as we are not seeing further reports of this nature elsewhere. I could however get the developers to give the message a check-over to see if there are any bugs in the email send code we should be aware of.

    It could help us to forward us the email with full headers to wftest @ wordfence . com. Please add your forum username to the subject and respond here after you have sent it.

    Thanks,

    Peter.

Viewing 1 replies (of 1 total)
  • The topic ‘Line breaks missing from Wordfence Central email’ is closed to new replies.