• Resolved craigola

    (@craigola)


    Hi, I have one user who seems to repeatedly get login blocked. I was looking at the logs and it doesn’t look like they are trying to login over and over? It almost looks like this is happening after they are already logged in.

    The last item in the logs before it looks like they were locked out was:

    wc_ajax=get_refreshed_fragments

    Could that have anything to do with it?

    If not, is there a way I can track down what is happening? I did get an email that someone got locked out for password reset attempts around the same time, but it isn’t the same user or IP.

    – Craig

Viewing 3 replies - 1 through 3 (of 3 total)
  • Thread Starter craigola

    (@craigola)

    Follow up on this.
    So both times this has happened I have received this an email that someone from the UK tried to login 20 times and got blocked.

    User IP: 81.132.153.227
    User hostname: host81-132-153-227.range81-132.btcentralplus.com
    User location: Alton, United Kingdom`

    However, when I look in the table in Wordfence, I see multiple login attempts under this IP: 81.132.153.227

    And then a single login attempt under my customers actual IP.

    My guess is, that someone is using BTcentralplus to try to login nefariously, but then my customer comes along and tries and since he is also using British Telecom DSL, he somehow gets blocked?

    Any ideas on this?

    Craig

    Hi Craig

    Did the user send a screenshot of what they see when they are blocked? If you could post a screenshot of that it would be helpful so we could narrow down the reason they see. Make sure and include the timestamp on the bottom of the screenshot so we can rule out a caching issue. Also having their public facing IP address might be helpful. You can send that (or both) to feedback [at] wordfence [dot] com. Include your forum username in the subject line (@craigola) and a link to this post in the message body. Then respond here so I don’t miss it. I’ll take a look and see if there is anything I can tell from those and let you know.

    Tim

    Due to some of the information needed to assist this user possibly being considered sensitive, we worked this privately. It was decided that likely database caching was erroneously caching the blocked attempts.

    Tim

Viewing 3 replies - 1 through 3 (of 3 total)
  • The topic ‘User Keeps Getting Locked Out’ is closed to new replies.