hello all,
i have a website where AVAST’s servers keep scanning for wordpress so much it is causing the site to slow down a bit, and fill up the error/access logs.
i do not have wordpress installed at all since it is bad (vulnerable and CPU intensive)
how can i tell the AVAST servers to scan less?
i dont even have avast installed in any of my devices so i have no idea how avast found my site (i use ESET)
How do you know this ?
Avast doesn’t go looking for your site/s, it is a client based scanned that scans web sites (using the Web Shield) when visited by an avast user/s.
i ran a IP lookup on the IP on the website’s logs and it said it belonged to “AVAST Software s.r.o.”
Given what you see under Services: Network sharing device or proxy server. I just wonder if it isn’t related to avasts SecureLine VPN product.
So it could be a user (of that SecureLine VPN product) rather than Avast in itself. However as an Avast User and non user of the SecureLine VPN product I can’t say that with certainty. But if that is the case I can’t see how that would differ from a regular visitor.
how would i block/detect if they are using the Avast VPN?
i do not want the site to be flooded with wordpress requests (i dont even have wordpress so it just 404’s)
EDIT: that message means it could be a proxy or a shared connection (ie a business/location having tons of computers connected to 1 IP address.)
EDIT 2: also they were making a crap-ton of requests to various directories looking for a XML file in wordpress related folders.
As I said, I’m an avast user so can’t offer any advice in that regard.
I have reported this topic in the hope of drawing some avast input.
thanks
You’re welcome, lets hope it brings some clarification.
bump, same IP is still doing requests for wordpress related things…
Hi,
Can you please provide me with the IP address?
[quote author=r@vast link=topic=262599.msg1605574#msg1605574 date=1619604437]
here is the ip: 159.242.234.127
there were 2 other IP’s but i did not save those and the logs were auto-cleared when i checked today.
This IP is one of the top ten blocked yesterday,
according to this list here: https://8thdomaintechnology.com/abusive-ips-february-28-2021/
-159.242.234.127 Germany block count: 17 suspected of spamming…
So wait for a final verdict from an avast team member, as they are the only ones eventually to come and unblock.
Decimal: 2683497087
Hostname: 159.242.234.127
ASN: 198605
ISP: AVAST Software s.r.o.
Organization: AVAST Software s.r.o.
Services: Network sharing device or proxy server
Recently reported forum spam source. (8)
Type: Corporate
Assignment: Likely Static IP
Continent: Europe
Country: Germany
State/Region: Hesse
City: Frankfurt am Main
polonus
[quote author=thexkey link=topic=262599.msg1605783#msg1605783 date=1619656219]
Hi,
The IP 159.242.234.127 belongs to our VPN service.
This means that someone used our VPN service to access your website.
[quote author=r@vast link=topic=262599.msg1606450#msg1606450 date=1619704055]
how do i block all of the VPN IP addresses?
Hi,
This is, unfortunately, not something we can assist you with.
Please consider contacting your hosting provider for advice.