• Resolved igarciaoliver

    (@igarciaoliver)


    Hi everyone

    last week I started having issues with my site and Wordfence.

    Seems like every time someone tries to use the “forgot password” feature, it triggers the firewall to block the request. But the block is not on the user’s IP but on 137.203.208.35.bc.googleusercontent.com so pretty much everybody gets locked.

    I have a complicated site but this is a new behaviour with no prior changes on my end.

    I am using Login security with google captcha and I tried chaning the FW to learning mode but it did not make a difference.
    What can I try/do to fix this? it is costing us conversions since the clients most likely cannot login either.

    Thanks in advance…


    The email I get as the admin:
    This email was sent from your website “xxxxxxxxxxx.com” by the Wordfence plugin at Monday 3rd of July 2023 at 03:15:34 PM
    The Wordfence administrative URL for this site is: https://xxxxxxxxxxxx.com/wp-admin/admin.php?page=Wordfence
    Someone tried to recover the password for user with email address: xxxxxxxxxx@gmail.com
    User IP: 35.208.203.137
    User hostname: 137.203.208.35.bc.googleusercontent.com
    User location: Council Bluffs, Iowa, United States

Viewing 8 replies - 1 through 8 (of 8 total)
  • Plugin Support wfscott

    (@wfscott)

    Hello, @igarciaoliver

    This looks to potentially be an IP detection issue.

    To check the IP detection, first, take note of your own IP address: https://www.whatsmyip.org

    Then, head over to your site and go to?Wordfence > All Options > General Wordfence Options > How does Wordfence get IPs, and reference the area under that section that says?Detected IPs?and?Your IP with this setting. Make sure both of those show the same IP as the site above does. If you’re seeing a different IP, such as one starting with 35.208 or similar, then you will need to try the other settings. If they are all incorrect, you’ll want to check with your host to see why the site is not processing the correct IPs for visitors. You may need to make changes at the hosting level.

    Thanks,
    Scott

    Thread Starter igarciaoliver

    (@igarciaoliver)

    hi @wfscott

    Thanks for the reply. the method you describe is showing the correct IP.

    The issue seems to be a bit more general. The ip blocked is always the same
    User IP: 35.208.203.137
    User hostname: 137.203.208.35.bc.googleusercontent.com

    And it affects (seemingly) everyone that tries to log in. I get blocked from Argentina, my client gets blocked in Oklahoma, my client’s clients get blocked all over the US.

    A google search tells me that 137.203.208.35.bc.googleusercontent.com is a domain used by Google to serve static content. Maybe it is the recaptcha code?
    Not sure how WF is coded but it seems that when I try to log in, my connection pulls some content from googleusercontent.com and that gets me blocked…

    does it make sense?

    thanks in advance.

    Plugin Support wfscott

    (@wfscott)

    Thanks for getting back, @igarciaoliver

    Could you please send over diagnostics from the Wordfence > Tools > Diagnostics > Send Report by email button to wftest @ wordfence dot com

    Please put your forum username in the second field there, and let me know here when those are sent and I’ll take a look.

    Thanks,
    Scott

    Thread Starter igarciaoliver

    (@igarciaoliver)

    Thanks @wfscott it is sent now

    Plugin Support wfscott

    (@wfscott)

    Hello, @igarciaoliver

    I didn’t see those make it over to wftest@wordfence.com — can you please try again and let me know here when you send them.

    If possible, please send an email as well with your username in the subject line and the diagnostics attached. You can use the Export button next to the Send Report by Mail button to export those and then attach them to your email.

    Thanks,
    Scott

    Thread Starter igarciaoliver

    (@igarciaoliver)

    hi @wfscott I have sent the report both from the diagnostics tab and as an email.

    Hope you get them. thanks in advance

    Plugin Support wfscott

    (@wfscott)

    Thanks for that, @igarciaoliver

    I was able to find the diagnostics. Can you confirm if you have the WooCommerce integration option enabled in Wordfence > Login Security > Settings?

    Overall, I’m not seeing anything stand out. Your IP detection looks good. That said, recently we noticed issues with your host due to sites being migrated and there being temporary issues with IP detection. Can you confirm after clearing cache that this is still occurring (with the WooCommerce integration enabled?)

    Thanks,
    Scott

    I’m having the same problem and it’s likely due to Siteground moving my sites to a different datacenter. I’ve just updated cloudflare IP’s and will check in a few days if the issue is resolved but my bet is it will be.

Viewing 8 replies - 1 through 8 (of 8 total)
  • The topic ‘bc.googleusercontent.com blocked, blocks everyone’ is closed to new replies.