Login attempt from blocked IP address

  • Resolved Kermit524

    (@kermit524)


    9 years, 1 month ago

    There is an attack on my login screen. I can see the list of logins on my Wordfence dashboard => live traffice => logins and logouts tab. However, the link for blocking the IP address for this attack reads “unblock”. That means I already blocked this address. How come these attempts can happen after having blocked their ip address? What did I miss?
    Thank for your advice.

    https://www.ads-software.com/plugins/wordfence/

Viewing 6 replies - 1 through 6 (of 6 total)
  • Plugin Author WFMattR

    (@wfmattr)

    Is it possible that you blocked them after the last time they had attempted to log in, and that was an older login shown on the “Logins and Logouts” list — or was it a new login attempt that happened since they were blocked?

    If you look at the Blocked IPs page and find that IP, can you see what the “Reason” field says?

    If you have entered usernames in “Immediately block the IP of users who try to sign in as these usernames”, they may have blocked themselves by trying to guess usernames, too. (That option does a true “block” and not just a lockout.)

    -Matt R

    Thread Starter Kermit524

    (@kermit524)

    Thank! I looked at the new login attempts just now (The list keeps updating), and on this list nothing is blocked.
    But instead of going over everything and blocking the addresses one by one, I went ahead and set it with the options section – blocking any invalid username login and preventing login by “admin”. I really hope that fixes it. Thanks again for your help! ??

    @kermit524
    I must have read your opening post 10 times or more trying to make sure I understood it correctly.

    Are you saying, that WF is telling you that the offending IP is blocked, yet you keeping seeing more hits logged? If that’s what you meant, there is a simple answer….

    WF does not and cannot stop the attacking IP from TRYING over and over…but it DOES stop the attack from penetrating or being successful.

    Thread Starter Kermit524

    (@kermit524)

    Ok, just to make sure that login would not be opssible when the IP is blocked.
    Thanks again! ??

    No problem, your welcomed.
    Just click the RESOLVED box at the bottom of the thread.
    Cheers

    Thread Starter Kermit524

    (@kermit524)

    Sure! ??

Viewing 6 replies - 1 through 6 (of 6 total)
  • The topic ‘Login attempt from blocked IP address’ is closed to new replies.