0

I am managing a WordPress website.

I have installed the plugin "Limit Login Attempts Reloaded".

This plugin sent me an email saying that A.B.C.D has tried to login with the non-existent username "admin" 9 times and has been blocked.

Googling the IP address, it has been reported as being abusive (it tried to login to other WP websites before).

But I went to https://www.ipqualityscore.com/ and this website doesn't report the IP as a VPN exit node nor a Tor exit node (although classifying it as abusive with 89% probability).

How is it possible?

Is that the real IP address of the person that tried to login?

Improve this question
2
  • 1
    I'm not sure what you are asking. You are assuming that all attacks are from VPNs or Tor? And that people don't attack from home, their company, or from compromised hosts? Why is your question "how is that possible?"
    – schroeder ♦
    Mar 10, 2021 at 10:35
  • @schroeder I thought that somebody attacking the site would want to hide his real IP address .. and VPN and Tor were a way of doing it ... that was what my monkey brain was thinking. But of course there is also VPS or the McDonald's wi-fi
    – robertspierre
    Mar 10, 2021 at 23:33

1 Answer 1

Reset to default
2

Not all sources of spam are proxies, VPNs, or Tor. Many are either hacked computers, or servers on networks that really don't care about abuse complaints. It's unlikely to be their personal home IP though, if that's what you mean, in the same way that a web server's IP is unlikely to be the home IP of the person who owns the website.

Improve this answer
2
  • 1
    Or the IP belongs to a high school, college, mall, or anything that offers internet connectivity.
    – ThoriumBR
    Mar 10, 2021 at 10:51
  • @ThoriumBR Yup, it could be really anything.
    – forest
    Mar 10, 2021 at 10:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .