403 GET|HEAD Request Log Entries

Home › Forums › BulletProof Security Pro › 403 GET|HEAD Request Log Entries

Tagged: , ,

Viewing 15 posts - 61 through 75 (of 96 total)
1 2 3 4 5 6 7
  • Author
    Posts
  • May 1, 2015 at 4:01 pm #22433
    jenni101
    Participant

    OK, thanks – all clear now!

    August 18, 2015 at 12:54 am #24504
    Krzysztof
    Participant

    Hello!

    Today in the morning I got a strange security log entry:

    [403 GET / HEAD Request: 18 sierpnia 2015 - 09:38]
Event Code: PFWR-PSBR-HPR
Solution: http://forum.ait-pro.com/forums/topic/security-log-event-codes/
REMOTE_ADDR: 162.158.93.54
Host Name: 162.158.93.54
SERVER_PROTOCOL: HTTP/1.1
HTTP_CLIENT_IP:
HTTP_FORWARDED:
HTTP_X_FORWARDED_FOR: 37.24.213.203
HTTP_X_CLUSTER_CLIENT_IP:
REQUEST_METHOD: GET
HTTP_REFERER: http://xxxxxxxxx/wp-admin/admin.php?page=bulletproof-security%2Fadmin%2Fphp%2Fphp-options.php
REQUEST_URI: /wp-content/plugins/bulletproof-security/admin/php/bps-phpinfo.php
QUERY_STRING:
HTTP_USER_AGENT: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.90 Safari/537.36
    August 18, 2015 at 1:23 am #24506
    AITpro Admin
    Keymaster

    When you click the View PHPINFO button on the PHP Info Viewer tab page in P-Security and your server blocks the PHP Info page then you will see a 403 error.  I have seen some web hosts block or disable the PHP phpinfo() function on the server.  Or the problem could be with the additional X-forwarded-for IP address indicating a Proxy.

    August 18, 2015 at 1:28 am #24508
    Krzysztof
    Participant

    Here is a new one:

    [403 GET / HEAD Request: 18 sierpnia 2015 - 10:27]
Event Code: PFWR-PSBR-HPR
Solution: http://forum.ait-pro.com/forums/topic/security-log-event-codes/
REMOTE_ADDR: 162.158.93.9
Host Name: 162.158.93.9
SERVER_PROTOCOL: HTTP/1.1
HTTP_CLIENT_IP:
HTTP_FORWARDED:
HTTP_X_FORWARDED_FOR: 37.24.213.203
HTTP_X_CLUSTER_CLIENT_IP:
REQUEST_METHOD: GET
HTTP_REFERER: xxxx/wp-admin/admin.php?page=bulletproof-security%2Fadmin%2Fsecurity-log%2Fsecurity-log.php&settings-updated=true
REQUEST_URI: /wp-content/plugins/bulletproof-security/admin/js/bps-ui-accordion.js?ver=4.2.4
QUERY_STRING:
HTTP_USER_AGENT: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.90 Safari/537.36
    August 18, 2015 at 1:32 am #24510
    AITpro Admin
    Keymaster

    Looks like your Proxy is not configured correctly:  HTTP_X_FORWARDED_FOR: 37.24.213.203
    The general format of the field is: X-Forwarded-For: client, proxy1, proxy2

    August 18, 2015 at 1:35 am #24511
    Krzysztof
    Participant

    Could this be cloudflare?

    August 18, 2015 at 1:47 am #24517
    AITpro Admin
    Keymaster

    Maybe, not really sure?  The IP address points to this host: http://whois.domaintools.com/37.24.213.203

    August 18, 2015 at 1:51 am #24518
    Krzysztof
    Participant

    I have turned on cloudflare yesterday and untill than all worked well. I have the same issues as described here: http://forum.ait-pro.com/forums/topic/security-errors-from-cloudflare-and-a-broken-bps-pro/ All menus are broken, and I et tons of security entries in my log as the one above. Any hints what to do excpet turning off cloudflare?

    August 18, 2015 at 1:54 am #24520
    AITpro Admin
    Keymaster

    Hint:  uninstall Cloudflare.  😉  Just kidding, but unfortunately the last time I tested Cloudflare was a couple of years ago so cannot offer any suggestions.  What I commonly hear is that Cloudflare Rocket breaks a lot of things.  Other than that I do not have any advice or suggestions and you will have to check with Cloudflare support.

    August 19, 2015 at 1:01 am #24580
    Krzysztof
    Participant

    Confirmed – CloudFlare off – everyone happy and everything working. I presuem that the system didn’t like the fact that probably some scripts were transfered via cloudflare and BPS didn’t like it.

    One way or the other – my second take on cloudflare ended faster than the first one.

    August 19, 2015 at 7:21 am #24585
    AITpro Admin
    Keymaster

    Yep, the HTTP_X_FORWARDED_FOR Header was not valid whatsoever so I imagine lots of things would be broken on this site.

    October 2, 2015 at 6:33 am #25427
    popljubo
    Participant

    Hi!
    I have received this kind of  error, but strange is that the line HTTP_X_FORWARDED_FOR have my own IP:

    [403 GET / HEAD Request: 02.10.2015 - 12:22]
Event Code: BFHS - Blocked/Forbidden Hacker or Spammer
Solution: N/A - Hacker/Spammer Blocked/Forbidden
REMOTE_ADDR: 66.249.93.233
Host Name: google-proxy-66-249-93-233.google.com
SERVER_PROTOCOL: HTTP/1.1
HTTP_CLIENT_IP:
HTTP_FORWARDED:
HTTP_X_FORWARDED_FOR: my IP
HTTP_X_CLUSTER_CLIENT_IP:
REQUEST_METHOD: GET
HTTP_REFERER:
REQUEST_URI: /wp-login.php
QUERY_STRING:
HTTP_USER_AGENT: Google favicon
    October 2, 2015 at 8:26 am #25429
    AITpro Admin
    Keymaster

    Google crawlers (bots, spiders): https://support.google.com/webmasters/answer/1061943?hl=en  I do not see “Google favicon” listed as a valid Google bot.  The IP address and hostname are valid.  What is unusual/suspicious is the bot crawled your Login page.  When your site is scraped or mirrored your website’s IP address will be listed in the log entry.  If your ISP IP address (Public IP address) was shown in HTTP_X_FORWARDED_FOR then that would probably mean you have something installed in your Browser (add-on, extension) or on your computer that is causing this security log entry.

    October 6, 2015 at 11:26 am #25601
    popljubo
    Participant

    Thank you. It was a browser extension: Chrome Logger

    December 5, 2015 at 5:10 am #26899
    MMBCB
    Participant

    Multiple 403 errors greeted me this morning.  They are all from the same IP which I cannot identify.  The plugins are indeed real plugins that I installed.  I recently updated the buddypress plugin, but the “/wp-content/plugins/js_composer/assets/js/js_composer_front.js?ver=4.8.1” has not been modified since website install, Nov.17th.

    This is my first post here and I may need just a little hand holding please as I wrap my head around WP security.

    [403 GET|HEAD Request: December 5, 2015 - 7:32 am]
Event Code: PFWR-PSBR-HPR
Solution: http://forum.ait-pro.com/forums/topic/security-log-event-codes/
REMOTE_ADDR: 98.15.139.186
Host Name: cpe-98-15-139-186.hvc.res.rr.com
SERVER_PROTOCOL: HTTP/1.0
HTTP_CLIENT_IP: 
HTTP_FORWARDED: 
HTTP_X_FORWARDED_FOR: 
HTTP_X_CLUSTER_CLIENT_IP: 
REQUEST_METHOD: GET
HTTP_REFERER: https://mainstreammediaboycott.com/
REQUEST_URI: /wp-content/plugins/buddypress/bp-groups/js/widget-groups.min.js?ver=2.4.2
QUERY_STRING: 
HTTP_USER_AGENT: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:42.0) Gecko/20100101 Firefox/42.0

[403 GET|HEAD Request: December 5, 2015 - 7:32 am]
Event Code: PFWR-PSBR-HPR
Solution: http://forum.ait-pro.com/forums/topic/security-log-event-codes/
REMOTE_ADDR: 98.15.139.186
Host Name: cpe-98-15-139-186.hvc.res.rr.com
SERVER_PROTOCOL: HTTP/1.0
HTTP_CLIENT_IP: 
HTTP_FORWARDED: 
HTTP_X_FORWARDED_FOR: 
HTTP_X_CLUSTER_CLIENT_IP: 
REQUEST_METHOD: GET
HTTP_REFERER: https://mainstreammediaboycott.com/
REQUEST_URI: /wp-content/plugins/buddypress/bp-activity/js/mentions.min.js?ver=2.4.2
QUERY_STRING: 
HTTP_USER_AGENT: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:42.0) Gecko/20100101 Firefox/42.0

[403 GET|HEAD Request: December 5, 2015 - 7:32 am]
Event Code: PFWR-PSBR-HPR
Solution: http://forum.ait-pro.com/forums/topic/security-log-event-codes/
REMOTE_ADDR: 98.15.139.186
Host Name: cpe-98-15-139-186.hvc.res.rr.com
SERVER_PROTOCOL: HTTP/1.0
HTTP_CLIENT_IP: 
HTTP_FORWARDED: 
HTTP_X_FORWARDED_FOR: 
HTTP_X_CLUSTER_CLIENT_IP: 
REQUEST_METHOD: GET
HTTP_REFERER: https://mainstreammediaboycott.com/
REQUEST_URI: /wp-content/plugins/buddypress/bp-core/js/jquery.caret.min.js?ver=2.4.2
QUERY_STRING: 
HTTP_USER_AGENT: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:42.0) Gecko/20100101 Firefox/42.0

[403 GET|HEAD Request: December 5, 2015 - 7:32 am]
Event Code: PFWR-PSBR-HPR
Solution: http://forum.ait-pro.com/forums/topic/security-log-event-codes/
REMOTE_ADDR: 98.15.139.186
Host Name: cpe-98-15-139-186.hvc.res.rr.com
SERVER_PROTOCOL: HTTP/1.0
HTTP_CLIENT_IP: 
HTTP_FORWARDED: 
HTTP_X_FORWARDED_FOR: 
HTTP_X_CLUSTER_CLIENT_IP: 
REQUEST_METHOD: GET
HTTP_REFERER: https://mainstreammediaboycott.com/
REQUEST_URI: /wp-content/plugins/js_composer/assets/js/js_composer_front.js?ver=4.8.1
QUERY_STRING: 
HTTP_USER_AGENT: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:42.0) Gecko/20100101 Firefox/42.0

[403 GET|HEAD Request: December 5, 2015 - 7:32 am]
Event Code: PFWR-PSBR-HPR
Solution: http://forum.ait-pro.com/forums/topic/security-log-event-codes/
REMOTE_ADDR: 98.15.139.186
Host Name: cpe-98-15-139-186.hvc.res.rr.com
SERVER_PROTOCOL: HTTP/1.0
HTTP_CLIENT_IP: 
HTTP_FORWARDED: 
HTTP_X_FORWARDED_FOR: 
HTTP_X_CLUSTER_CLIENT_IP: 
REQUEST_METHOD: GET
HTTP_REFERER: https://mainstreammediaboycott.com/
REQUEST_URI: /wp-content/plugins/buddypress/bp-core/js/jquery.atwho.min.js?ver=2.4.2
QUERY_STRING: 
HTTP_USER_AGENT: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:42.0) Gecko/20100101 Firefox/42.0
  • Author
    Posts
Viewing 15 posts - 61 through 75 (of 96 total)
1 2 3 4 5 6 7
  • You must be logged in to reply to this topic.