Strange IP behaviour – IP changing after login

  • Resolved Daniram

    (@daniram)


    8 years, 10 months ago

    Hello, I hope someone can help me understand what’s going on here..

    My setup:

    1 site with .htaccess as follows:

    # BEGIN Restrict WordPress Login Pages to Your Own IPs
    <Files wp-login.php>
    order deny,allow
    deny from all
    allow from xxx.xxx.xxx.xxx
    </Files>
    <Files login>
    order deny,allow
    deny from all
    allow from xxx.xxx.xxx.xxx
    </Files>
    # END Restrict WordPress Login Pages to Your Own IPs

    Both Sucuri and Wordfence installed and both setup to alert admin login.
    Sucuri also setup to notify page changes/uploads ecc..

    This is what happened:

    At 9.40am both Wordfence and Sucuri notify me with an admin succesfull login.

    BUT: while the IP address from Wordfence is the whitelisted one in .htaccess (xxx.xxx.xxx.xxx), the IP address notified from Sucuri is completely different, say yyy.yyy.yyy.yyy.

    Then, after short time, I have 4 more alert from Sucuri which notify 4 pdf file upload.

    I instantly phoned to my client and he sayed that he was responsible for both the admin login and the pdf file upload. I also checked the upload stuff and everything was fine, so no worry I guess.

    Despite of this I would like to know how is it possible that Sucuri reported a wrong IP address? How could it even bypass the .htaccess directives?

    Thanks a lot in advance.

    https://www.ads-software.com/plugins/sucuri-scanner/

Viewing 2 replies - 1 through 2 (of 2 total)

  • It depends on which address was reported by both plugins, how do you know which plugin is reporting the correct IP address? Note that corporate support generally uses proxies to monitor the traffic of their employees, and to protect against unnecessary attacks to private networks. Considering this I am pretty sure that one of the plugin is reporting the real IP address while the other one is reporting the reversed IP address, which one is which is up to you.

    The Sucuri plugin allows you to configure which HTTP header will be used to retrieve the real IP address, go to the general settings page and configure the “IP Address Discoverer” option, choose the HTTP header from the dropdown that works better for your website’s setup.

    Thread Starter Daniram

    (@daniram)

    Thank you for your reply. This make sense to me. I verified at whatismyipaddress.com/proxy-check and ‘Header test’ resulted positive, so the client is using a proxy server.

    I know which is the real IP address as I whitelisted it in the .htaccess.
    Wordfence notifies the real IP, while Sucuri the fake one (proxy).

    One last question though. How is it possible that the fake IP address has access to the /wp-admin area which is protected by the .htaccess rule (see my previous post)?

    Thanks again for you help.

Viewing 2 replies - 1 through 2 (of 2 total)
  • The topic ‘Strange IP behaviour – IP changing after login’ is closed to new replies.