31

Wordfence reports the following visitor:

An unknown location at IP 0.0.0.0 visited
4 hours 45 mins ago   IP: 0.0.0.0
Browser: Baiduspider version 2.0
Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)

An unknown location at IP 0.0.0.0 visited
4 hours 45 mins ago   IP: 0.0.0.0 
Browser: Opera version 12.15 running on Win7
Opera/9.80 (Windows NT 6.1; WOW64) Presto/2.12.388 Version/12.15
Improve this question
12
  • 41
    There's something wrong with your log parsing software, the address 0.0.0.0 wouldn't be routed over the Internet.
    – ndrix
    Commented Jun 2, 2014 at 5:52
  • 1
    Generally yes @Mark, I've seen rare cases where it shows a system address. Not that it should be!
    – GdD
    Commented Jun 2, 2014 at 7:58
  • 18
    Is wordfence IPv6-aware? If the site could handle IPv6 addresses, but this report can't, then it would have difficulties reporting a visitor on an address that was only valid in IPv6
    – Jon Hanna
    Commented Jun 2, 2014 at 10:35
  • 2
    Seems you are not alone - ditted24.rssing.com/browser.php?indx=12949233&item=666
    – zedman9991
    Commented Jun 2, 2014 at 14:47
  • 22
    "The call is coming from INSIDE YOUR HOUSE!"
    – Brian Kelly
    Commented Jun 3, 2014 at 3:06

3 Answers 3

Reset to default
69

I suspect that your Wordfence plug-in is blindly trusting the X-Forwarded-For header. This header is used by proxies to indicate the IP address of the computers sending traffic trough them, but can easily be spoofed. It is also very well possible that some of the visits from “0.0.0.0” aren't malicious, but simply users behind a misconfigured proxy.

Edit: Wordfence is indeed doing this, but this is configurable and is meant to accommodate for reverse proxies such as CloudFlare. See the comment by Wordfence founder Mark Maunder below.

Improve this answer
4
  • 14
    I took a look at the source code: github.com/wp-plugins/wordfence/blob/… This function relies on the X-Forwarded-For header by default like you said. So this will be most likely the case.
    – D. Schalla
    Commented Jun 2, 2014 at 14:24
  • 2
    You're welcome to configure your setup to block X-Forwarded-For with invalid IP addresses, but that will just cause people start using valid IP addresses in the X-Forwarded-For.
    – Snowbody
    Commented Jun 3, 2014 at 1:21
  • I have now chosen the following option in wordfence: "Set this option if you're seeing visitors from fake IP addresses or who appear to be from your internal network but aren't." I would like to block X-Forwarded-For with invalid IP addresses
    – ovtorne
    Commented Jun 3, 2014 at 10:45
  • 10
    Actually Wordfence provides several options that lets the site admin choose how they want to get the visitor IP. We used to default to PHP's $_SERVER['REMOTE_ADDR'] but many customers are using nginx as a front-end and REMOTE_ADDR is often an internal address. So we provided several options including support for Cloudflare. The OP needs to probably set their site to use REMOTE_ADDR and the issue will be resolved. ~Mark Maunder - Wordfence Founder.
    – Mark Maunder
    Commented Jun 3, 2014 at 14:01
18

Since the address "0.0.0.0" is not valid, that's either a spoofed packet (unlikely) or a bug in Wordfence (likely).

On the unlikely chance that someone's doing a packet-spoofing attack, update your firewall to block incoming packets with invalid addresses (see, for example, this question and its answers for a list of ranges and reasons).

Improve this answer
3
  • 7
    I'm pretty sure it's not possible to complete a HTTP request using address spoofing on the IP level.
    – Michael Borgwardt
    Commented Jun 2, 2014 at 13:02
  • 1
    @MichaelBorgwardt if you can somehow guess the TCP sequence number, you can
    – Red Alert
    Commented Jun 2, 2014 at 17:48
  • I added this to .htaccess, and I hope someone will tell me if this is correct and will work. # block IP addresses <limit GET POST PUT> ` Order Allow,Deny` ` Allow from all` ` # uncomment/edit/repeat to block IPs` ` deny from 0.0.0.0/8` ` deny from 10.0.0.0/8` ` deny from 10.1.3.0/24` ` deny from 127.0.0.0/8` ` deny from 172.16.0.0/12` ` deny from 192.168.0.0/16` ` deny from 224.0.0.0/3` </limit>
    – ovtorne
    Commented Jun 3, 2014 at 10:56
0

If the IP address cannot be resolved prperly, it come as 0.0.0.0.

Maybe, it's an distributed port scan attack. This uses multiple IP addresses to scan target device ports. Configure your infrastructure to prevent this.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .