bonjon9

Hi Tim, thanks for responding.
I got a couple more of these overnight from different IPs. I’m wondering if I should add {login} to the list of usernames I block in addition to admin,manager,systemwpadmin, and wpsystemadmin. The use of “{” and “}” as a username seems so strange.

Here’s the info for the latest one:

A user with IP address 46.175.84.171 has been locked out from the signing in or using the password recovery form for the following reason: Used an invalid username ‘{login}’ to try to sign in.
User IP: 46.175.84.171
User hostname: res84-171.mediana.net.ua

Thanks for the updates. I’m not seeing any, but I still have most of them blocked.

NO hits from Italy for almost 5 days! Yea! Of course I blocked most of them, but maybe I’ll unblock in a week or two if no one sees them coming back.
Thanks 253David.

Jrivett: I hope it means they’re going to do something about this!

Just checked my site and there are lots more hits this morning from different IP ranges at fastwebnet plus interact.it, eutelia.it, and tiscali.it.

I’ve been blocking usernames of admin, manager, systemwpadmin, and wpsystemadmin for quite some time. Recently added blocks for names made up from my domain name – attempts using those types of names are coming from Hong Kong now.

I wish we could block based on Hostname.
If my non-profit could afford it, I’d buy the premium edition of Wordfence. Meanwhile, I REALLY appreciate the free edition!

Thanks. I meant 89.96.0.0 – 89.97.255.255 Does that include you? I definitely don’t want to block NC addresses!

The hits continue unabated. So, I just blocked whole ranges of addresses for fastwebnet.it and albacore.net.
89.96.0.0 – 98.97.255.255 (fastwebnet.it)
93.32.0.0 – 93.62.236.159 (fastwebnet.it)
78.4.0.0 – 78.7.255.255 (albacom.net)
I see a few hits now from tiscali.it and momax.it. Anyone else seeing them?
When I counted the hits before, I missed counting those that were trying again even but already blocked for 30 days based on my optional setting. (Not worth bothering to count now.) There may be 1 person in Italy legitimately trying to access our site. I’m sorry for them.

Any update from Italy’s fastweb or albacom? I’ve had attempts from over 1500 different IP’s in Italy on one small site in the past month. I’m also starting to see them from interact.it & eutelia.it.

Thank goodness for Wordfence and the ability to block based on usernames! Still, it worries me to see so many attempts.

Mine still works!
And thanks for your attention to this today.

My current scan finished.
[Sep 03 14:41:55] Scan Complete. Scanned 5763 files, 20 plugins, 2 themes, 55 pages, 0 comments and 78606 records in 216 seconds.

Just in case it helps, earlier today a scan did complete. And this earlier one would have been after the database server outage you mentioned.
[Sep 03 09:44:52] Scan Complete. Scanned 5762 files, 20 plugins, 2 themes, 55 pages, 0 comments and 78819 records in 173 seconds.

Noticed there’s now 1 more file with the current scan than before. Is that strange? The only thing done on this site today was to block 1 IP and to remove some issues I’d been ignoring from some read me files.

Actually, the time was 2:12:26 PM where I am on the east coast of NC. I happened to be on the site looking at locked IP addresses when the scans started.
BUT, I just started a new scan now (2:39 pm) and it appears to be running!

Same problem here:
[Sep 03 14:00:44] Call to Wordfence API to resolve IPs failed: We received an empty data response from the Wordfence scanning servers when calling the ‘resolve_ips’ function.
[Sep 03 14:06:49] Call to Wordfence API to resolve IPs failed: We received an empty data response from the Wordfence scanning servers when calling the ‘resolve_ips’ function.
[Sep 03 14:10:55] Call to Wordfence API to resolve IPs failed: We received an empty data response from the Wordfence scanning servers when calling the ‘resolve_ips’ function.
[Sep 03 14:12:26] Call to Wordfence API to resolve IPs failed: We received an empty data response from the Wordfence scanning servers when calling the ‘resolve_ips’ function.

Anyone else interested in this?

Looks like 2.8.5 version works and I didn’t lose any data.
Thanks!

Thanks, I’ll try that. PHP Version 5.2.17

I ftp’d to my site and renamed the plugin so I could get back into my site. (I know I could have just deleted it, but if there’s something needed there, I’ll still have the info.)