Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Wordfence reports the following visitor:

An unknown location at IP 0.0.0.0 visited
4 hours 45 mins ago   IP: 0.0.0.0
Browser: Baiduspider version 2.0
Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)

An unknown location at IP 0.0.0.0 visited
4 hours 45 mins ago   IP: 0.0.0.0 
Browser: Opera version 12.15 running on Win7
Opera/9.80 (Windows NT 6.1; WOW64) Presto/2.12.388 Version/12.15 

share|improve this question
36  
There's something wrong with your log parsing software, the address 0.0.0.0 wouldn't be routed over the Internet. –  m1ke Jun 2 at 5:52
1  
Generally yes @Mark, I've seen rare cases where it shows a system address. Not that it should be! –  GdD Jun 2 at 7:58
15  
Is wordfence IPv6-aware? If the site could handle IPv6 addresses, but this report can't, then it would have difficulties reporting a visitor on an address that was only valid in IPv6 –  Jon Hanna Jun 2 at 10:35
2  
Seems you are not alone - ditted24.rssing.com/browser.php?indx=12949233&item=666 –  zedman9991 Jun 2 at 14:47
15  
"The call is coming from INSIDE YOUR HOUSE!" –  Brian Kelly Jun 3 at 3:06

3 Answers 3

I suspect that your Wordfence plug-in is blindly trusting the X-Forwarded-For header. This header is used by proxies to indicate the IP address of the computers sending traffic trough them, but can easily be spoofed. It is also very well possible that some of the visits from “0.0.0.0” aren't malicious, but simply users behind a misconfigured proxy.

share|improve this answer
11  
I took a look at the source code: github.com/wp-plugins/wordfence/blob/… This function relies on the X-Forwarded-For header by default like you said. So this will be most likely the case. –  D. Schalla Jun 2 at 14:24
2  
You're welcome to configure your setup to block X-Forwarded-For with invalid IP addresses, but that will just cause people start using valid IP addresses in the X-Forwarded-For. –  Snowbody Jun 3 at 1:21
    
I have now chosen the following option in wordfence: "Set this option if you're seeing visitors from fake IP addresses or who appear to be from your internal network but aren't." I would like to block X-Forwarded-For with invalid IP addresses –  ovtorne Jun 3 at 10:45
7  
Actually Wordfence provides several options that lets the site admin choose how they want to get the visitor IP. We used to default to PHP's $_SERVER['REMOTE_ADDR'] but many customers are using nginx as a front-end and REMOTE_ADDR is often an internal address. So we provided several options including support for Cloudflare. The OP needs to probably set their site to use REMOTE_ADDR and the issue will be resolved. ~Mark Maunder - Wordfence Founder. –  Mark Maunder Jun 3 at 14:01

Since the address "0.0.0.0" is not valid, that's either a spoofed packet (unlikely) or a bug in Wordfence (likely).

On the unlikely chance that someone's doing a packet-spoofing attack, update your firewall to block incoming packets with invalid addresses (see, for example, this question and its answers for a list of ranges and reasons).

share|improve this answer
6  
I'm pretty sure it's not possible to complete a HTTP request using address spoofing on the IP level. –  Michael Borgwardt Jun 2 at 13:02
1  
@MichaelBorgwardt if you can somehow guess the TCP sequence number, you can –  Red Alert Jun 2 at 17:48
    
I added this to .htaccess, and I hope someone will tell me if this is correct and will work. # block IP addresses <limit GET POST PUT> ` Order Allow,Deny` ` Allow from all` ` # uncomment/edit/repeat to block IPs` ` deny from 0.0.0.0/8` ` deny from 10.0.0.0/8` ` deny from 10.1.3.0/24` ` deny from 127.0.0.0/8` ` deny from 172.16.0.0/12` ` deny from 192.168.0.0/16` ` deny from 224.0.0.0/3` </limit> –  ovtorne Jun 3 at 10:56

If the IP address cannot be resolved prperly, it come as 0.0.0.0.

Maybe, it's an distributed port scan attack. This uses multiple IP addresses to scan target device ports. Configure your infrastructure to prevent this.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.