Being attacked from CloudFlare whitelisted IP Range

Website, Application, Performance Security
1

I am getting brute force attacks but Config Server Security and Firewall cannot permanently block because the IP is part of the Cloudflare whitelisted IP Ranges.

162.158.0.0/15

[Sat Jul 06 09:08:38.729155 2019] [:error] [pid 32363:tid 47513237976832] [client 162.158.103.146:18616] [client 162.158.103.146] ModSecurity: Access denied with code 406 (phase 2). Operator GE matched 1 at TX:brute. [file “/etc/apache2/conf.d/imh-modsec/40_wordpress.conf”] [line “27”] [id “13052”] [msg “POST to wp-login.php without redirect_to”] [severity “WARNING”] [tag “WEB_ATTACK/SHELL ACCESS”] [hostname “www.snaggolf.com”] [uri “/wp-login.php”] [unique_id “XSCdVkHC7f8Cn@l6NjIVawAAAQI”]
Blocked: Permanent Block [LF_MODSEC] (IP match in csf.allow, block may not work)

2

You are not being attacked by that IP address but by somebody else. That other IP address does not show up because you do not seem to be rewriting IP addresses

https://support.cloudflare.com/hc/en-us/sections/200805497-Restoring-Visitor-IPs

2 Likes
3

Okay I will work on updating stack with mod_Cloudflare. Thanks

4

Better mod_remoteip.

1 Like
5

Great. Thank you for your help.

6

This topic was automatically closed after 30 days. New replies are no longer allowed.