Getting over 500 emails from visitors of Cloudflare

[Jet]

I’ve been getting a tone (500 since yesterday) of email with this message (different IPs) :

———————-
Hi-
This is Hide My WP plugin. We guess someone is researching about your WordPress site.

Here is some more details:
Visitor: 108.162.210.135

URL: http://jetgraphique.com/wp-login.php
User Agent: –user-agent=Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:39.0) Gecko/20100101 Firefox/39.0

Best Regards,
Hide My WP
———————-

After researching the IPs on Google, I found out that it was coming from Cloudflare. I am using Cloudflare for my site…

Other notice, I’ve check the HMWP IDS Log I’m getting these :

———————
request-pwd
admin123#
/wp-login.php
3 / 6 108.162.250.92
Guest 02/09/2015 6:58 am
post-pwd
admin123#
/wp-login.php
3 / 6 108.162.250.92
Guest 02/09/2015 6:58 am
request-pwd
admin!@#
/wp-login.php
3 / 6 108.162.216.37
Guest 02/09/2015 6:46 am
post-pwd
admin!@#
/wp-login.php
3 / 6 108.162.216.37
Guest 02/09/2015 6:46 am
request-uploader_dir
./cntlEC
/wp-content/plugins/wp-symposium/server/php/index.php
5 / 10 141.101.97.215
Guest 01/09/2015 7:50 pm
post-uploader_dir
./cntlEC
/wp-content/plugins/wp-symposium/server/php/index.php
5 / 10 141.101.97.215
Guest 01/09/2015 7:50 pm
server
http://yandex.ru/clck/jsredir?… more
/desole-page-non-disponible/?by_user=162.158.90.68&ref_url=/marketing/
5 / 5 162.158.90.68
Guest 01/09/2015 11:19 am
server
Exclude | Delete
http://yandex.ru/clck/jsredir?… more
/desole-page-non-disponible/?by_user=162.158.88.215&ref_url=/enveloppe/
5 / 5 162.158.88.215
Guest 01/09/2015 11:19 am
—————————-

Not sure if it’s related…

Why am I getting these none-stop emails and is there something I can do so these email will stop coming in?

Thanks!

[Suman M.]

Hi, you’ll get email if someone visits /wp-admin or /wp-login.php page which are no more available (require HMWP security keyword).
And HMWP also detects malicious requests (possible hack attempts) and emails you regarding it. But you need not worry as HMWP IDS firewall will take care of this and will block such malicious requests if Impact level is more than 20 (default value specified in HMWP PHP IDS).

To stop receiving emails from HMWP, do these:
– uncheck “Send an email to site admin whenever someone visits 404 page” option in general settings tab
– set “notify threshold” to 0 in IDS firewall tab

[Author]

Posts