Getting a lot of bot connections

Hi @gtsitsis, thanks for getting in touch.

After a few cases where customers seem to be seeing attacks or connections from 127.0.0.1, we are currently seeking a bit more information to look into these closely. As not all customers are seeing this and the ones who are haven’t made any changes to their Wordfence configuration, there may be a server, host, server-based software, or other plugin causing it.

I must mention that if IP detection is wrong, a legitimately triggered block for somebody else may affect all visitors including yourself. Take note of your own IP on your main device: https://www.whatsmyip.org.

Head over to Wordfence > All Options > General Wordfence Options > How does Wordfence get IPs and reference the area under that section that says Detected IPs and Your IP with this setting. See if any of the options there when picked accurately reflect your IP. If one does, don’t forget to hit the SAVE CHANGES button in the top-right after you’re done. I expect this may be correct already in your case though.

It would assist us to see access logs and diganostics from around the time some more of these 127.0.0.1 entries are next seen. You can send any access log exports and a downloaded diagnostic TXT from Wordfence > Tools > Diagnostics to wftest @ wordfence . com. Just make sure to put your forum username in the subject line and let us know here when you’ve sent them so we can take a look.

Thanks,
Peter.

Hello again sir,

we suffer from massive connections and the thing is that those connections are listed in Google Analytics 4, we have in one day 100 connections to our website thats not even possible and i see that there are cities listed in GA4 that is should’nt be there for sure.

I send you the report with my name so you can look into it.

Thanks

I just noticed that everyone who access the website, lets say the main homepage, if it is from a FB ad or DIRECT from the brower, even if it is from WIFI or data, on wordfence live traffic, every user, mentions that he / she tried to access a?non-existent page and bellow it mentions the URL of it, always is a 404 page because doesnt exist at all if i browse it check it through pages.

for example the most common non-existent page every 1-2 mins i get is https://domain.gr/wp-content/themes/hestiajs/app.js?ver=40e8ffe453aae4a492507ac0d70cddda.

Please keep in mind, my website doesnt not have any of these files, i triple check it through DATABASE, file manager, filezilla FTP protocol and pages, also i downloaded the whole domain’s directory to my PC and through Virtual studio code i search for the file, and the hestiajs, and the app.js no one of are existed or are relevant.

Thanks

Hi @gtsitsis, thanks for the extra information.

The fact that you have Hestia theme installed is interesting as I can’t see much reference (if any) to that specific /hestiajs folder, so if you can’t find a reference to that path in your site code or database, it would seem more likely to be an attempt to probe a random URL. However, as you seem to be getting clicks attempting the 404 URL and not just direct hits, it seems to go against that too.

I would certainly try to upgrade outdated plugins or replace abandoned ones as shown in your recent scan to resolve all other issues first. If you’re still getting these Live Traffic hits afterwards, it’d be great if you could expand a couple by clicking them (or using the “eye” icon), taking a screenshot, and using a service like Imgur or Snipboard to show us here.

Thanks,
Peter.