• Resolved Ray Gulick

    (@raygulick)


    A high percentage of attackers on several of the websites I manage use their IP address as their webhost name, or as part of the webhost name:

    IP: 123.45.678.99 ????Webhost: 123.45.678.99
    or
    IP: 123.45.678.99 ????Webhost: 123.45.678.99.sub.domain.tld

    Is it possible to create a blocking rule that blocks this pattern?

    • This topic was modified 1 year, 5 months ago by Ray Gulick.
Viewing 5 replies - 1 through 5 (of 5 total)
  • Plugin Support wfpeter

    (@wfpeter)

    Hi @raygulick, thanks for your question.

    You can currently add this type of pattern manually to the “Hostname” input box on Wordfence > Blocking > Custom Pattern. Don’t forget to add a reason, otherwise the form won’t submit.

    You can directly target 123.45.678.99.sub.domain.tld or set *.sub.domain.tld if you notice the number changing frequently but the access attempts coming from the same domain. Likewise you could try 123.45.678.99.* if the subdomain changes more often than the IP.

    Generally, we consider a manual blocking regime unnecessary as it can be time consuming to keep up with current URLs and IP ranges etc. Wordfence should protect you from known “bad” IPs, but I can understand if you’re experiencing an extremely high volume of visits that are slowing your site, you’d want to stem the flow.

    Thanks,
    Peter.

    Thread Starter Ray Gulick

    (@raygulick)

    Yes, I know it’s possible to block specific IPs and specific hosts. Neither of these suggestions satisfies the requirement to block the pattern of IP being used as hostname or as part of hostname.

    I’m a little confused. How would adding 123.45.678.99.* as a hostname block not satisfy the requirements?

    Mia

    Thread Starter Ray Gulick

    (@raygulick)

    You might be less confused if you read the original request. I want to block a pattern where the IP == the hostname, not a single instance.

    Thanks for clearing that up. Asking questions is how we make sure we understand exactly what a user is asking about so that if we have to go back to the Dev or QA teams with questions or feature requests we can explain exactly what you are trying to do. Per www.remarpro.com forum guidelines, participation in the forums here is voluntary, for users and for plugin authors/staff. We’d ask you kindly keep your answers civil.

    At the present the block functionality you want isn’t something Wordfence supports. Those blocks would be overly vague and have the potential to cause problems for users that didn’t understand exactly what they were doing if they implemented it. As such we aren’t going to implement it at this time. I have made sure the Dev and QA team knows that this functionality is something you would like to see in a future release. While I cannot promise that every suggestion we get makes it into a release, or when that might be I can tell you that every suggestion we get is evaluated carefully and considered seriously. We value the input we get from our customers.

    Thanks!
    Mia

Viewing 5 replies - 1 through 5 (of 5 total)
  • The topic ‘A new blocking rule’ is closed to new replies.