gagomap

If you use VPS, you can block these attacks with fail2ban. Very easy.

I’m using IPv4 and PHP 5.6.14. I have restored original file.

Thank you.

If it’s a local attack, i think NF can’t stop it.

It’s shared hosting’s problem.

No, i just have deactivated redirection plugin and the problem gone.NF must be conflict with it.

https://www.ads-software.com/plugins/redirection/

I have tested 5 times, and all the results are the same conclusion.

After i restored my VPS, replaced your code, changed email again.
And this is a error message:

NinjaFirewall fatal error: unknown error #MySQL server has gone away. Review your installation, your site is not protected

.

I do as you say, but there is no error message, and there is no notice appear.

I will restore my VPS then i can test more.

It is: Cannot retrieve user rules from database (#2)

As i remember it. ??

I’m installing all site on Ubuntu. I had install suhoshin on my VPS.

There is no error message in log file.
I have checked /var/log/mysql and all log files in /var/log

Where i can find MySQL log file ?

I’m using MariaDB on EasyEngine.

No, there is no backup running or my DB is too slow.
I run 2 site on a VPS 2GB ram. Everthing are very fast.

I have tried to change email 3 times. This notice always display.

it’s in admin profile.

I just have deactivated NF and changed admin email. Then i have reactivated NF again and didn’t see any noctice.

NF iss very strange.

Your security rules update have fixed it.
Now, NF can stop these hacker before fail2ban.
Thank you ??

Thanks,

I clear nginx cache and everything work fine ??

Newer Log:

80.86.100.130 0.114 BYPASS [02/Dec/2015:20:47:02 +0700] dautu365.com "HEAD /?author=1&#034 HTTP/1.0" 500 0 "-" "WordPress/4.3.1; https://wordpressthemes.review"
185.20.4.220 0.294 BYPASS [02/Dec/2015:20:47:21 +0700] dautu365.com "GET /?author=1 HTTP/1.1" 500 2985 "-" "Mozilla/5.0 (TweetmemeBot/4.0; +https://datasift.com/bot.html) Gecko/20100101 Firefox/31.0"
54.151.42.39 0.179 BYPASS [02/Dec/2015:20:47:23 +0700] dautu365.com "HEAD /?author=1 HTTP/1.1" 500 0 "-" "Google-HTTP-Java-Client/1.17.0-rc (gzip)"
54.151.42.39 0.238 BYPASS [02/Dec/2015:20:47:23 +0700] dautu365.com "HEAD /?author=1 HTTP/1.1" 500 0 "-" "Google-HTTP-Java-Client/1.17.0-rc (gzip)"

NF did not catch them.