Admin Tools

#20178 DFI Shield IP is Webhost

Posted in ‘Admin Tools for Joomla! 4 & 5’

This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version

n/a

PHP version

n/a

Admin Tools version

n/a

Latest post by on Friday, 04 July 2014 18:00 CDT

Tuesday, 03 June 2014 12:02 CDT

montano

My security logs show multiple DFI Shield attacks from an IP address belonging to a well-known Joomla only web host, not an ISP.

If you rule out an employee of this company attempting to hack my website, what are the other alternatives? Is it a site on that server that is infected and running a script? Is the server itself infected? Hypothetically, what could be the cause?

My most common WAF exception is the JCE DFI. It makes me wonder if another popular, free, extension, is malware.

Wednesday, 04 June 2014 03:33 CDT

nicholas

Hi Cindy,

Assuming that it is not your own server (if it is, let me know, it's a different issue) then the most reasonable explanation is that a site hosted on that hosting service is hacked and abused as part of a botnet attacking other sites. This seems even more plausible since you are telling me that you see a JCE DFI attack. That was a notorious vulnerability from 2-3 years ago that Ryan fixed hours after it was brought to his attention. Basically, the hacked site is trying to find other severely out of date sites and hack them. You don't have to worry about it, as long as you have updated JCE and using Admin Tools :)

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Friday, 04 July 2014 18:00 CDT

System Task

system

This ticket has been automatically closed. All tickets which have been inactive for a long time are automatically closed. If you believe that this ticket was closed in error, please contact us.

Support