Wordpress WordFence wordfence_syncAttackData ?

anyone know about this bot

Code:

my own ip - - [20/Sep/2016:16:04:33 +0700] "POST /?wordfence_syncAttackData=1474362273.6271 HTTP/1.1" 444 0 "https://www.mydomain?wordfence_syncAttack
Data=1474362273.6271" "WordPress/4.6.1; https://www.mydomain" "-" rt=0.000 ua="-" us="-" ut="-" ul="-" cs=-

my own ip - - [20/Sep/2016:16:04:32 +0700] "POST /?wordfence_syncAttackData=1474362272.7793 HTTP/1.1" 444 0 "https://www.mydomain?wordfence_syncAttack
Data=1474362272.7793" "WordPress/4.6.1; https://www.mydomain" "-" rt=0.000 ua="-" us="-" ut="-" ul="-" cs=-

my own ip - - [20/Sep/2016:16:04:33 +0700] "POST /?wordfence_syncAttackData=1474362272.9984 HTTP/1.1" 444 0 "https://www.mydomain/?wordfence_syncAttac
kData=1474362272.9984" "WordPress/4.6.1; https://www.mydomain" "-" rt=0.000 ua="-" us="-" ut="-" ul="-" cs=-

my own ip - - [20/Sep/2016:16:05:20 +0700] "POST /?wordfence_syncAttackData=1474362320.5041 HTTP/1.1" 444 0 "https://www.mydomain/?wordfence_syncAttac
kData=1474362320.5041" "WordPress/4.6.1; https://www.mydomain" "-" rt=0.000 ua="-" us="-" ut="-" ul="-" cs=-

coming from my own ip and post in my own domain
delay last week about every hours and this day delay about a minute

---

 

yes i did place botlimit.conf in nginx.conf and blockbots.conf in vhost domain.conf , i did get more unknown ip in vhost access.log , cross check them with abuseipdb.com for suspicious visitor , then type csf -d ip block them , its painfull and no automatic way to cross check and block those suspicious visitor

 

this is suspicious visitor sample i get from access log, some of them get through status 200 and some of them get status 400 and 444

Code:

91.194.84.106 - - [20/Sep/2016:20:25:13 +0700] "GET /?longurlwascutoff_0&&&&&&&&&&&&& HTTP/1.0" 444 0 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.5; [URL='http://www.majestic12.co.uk/bot.php?+']Majestic-12 : DSearch : MJ12bot[/URL]" "-" rt=0.000 ua="-" us="-" ut="-" ul="-" cs=-

106.186.113.132 - - [20/Sep/2016:18:49:17 +0700] "\x00\x9C\x00\x01\x1A+<M\x00\x01\x00\x00\x01\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00" 400 166 "-" "-" "-" rt=0.100 ua="-" us="-" ut="-" ul="-" cs=-

106.186.113.132 - - [20/Sep/2016:18:49:19 +0700] "\x05\x02\x00\x02" 400 166 "-" "-" "-" rt=0.200 ua="-" us="-" ut="-" ul="-" cs=-

 

for today access.log

Code:

125.161.63.43 - - [21/Sep/2016:10:29:27 +0700] "GET / HTTP/2.0" 200 8400 "https://www.google.co.id/" "Mozilla/5.0 (Windows NT 6.1; rv:48.0) Gecko/20100101 Firefox/48.0" "-" rt=0.000 ua="-" us="-" ut="-" ul="-" cs=-

125.161.63.43 - - [21/Sep/2016:10:29:28 +0700] "GET /?wordfence_syncAttackData=1474410355.1746 HTTP/2.0" 200 182 "https://www.mydomain/" "Mozilla/5.0 (Windows NT 6.1; rv:48.0) Gecko/20100101 Firefox/48.0" "-" rt=0.800 ua="127.0.0.1:9000" us="200" ut="0.189" ul="16" cs=-

125.161.63.43 - - [21/Sep/2016:10:29:37 +0700] "GET /?wordfence_logHuman=1&hid=06649C9CEF9DDB2DBD595D34D0AB6652&r=0.9717685031846551 HTTP/2.0" 200 390 "https://mydomain/" "Mozilla/5.0 (Windows NT 6.1; rv:48.0) Gecko/20100101 Firefox/48.0" "-" rt=7.600 ua="127.0.0.1:9000" us="200" ut="0.100" ul="20" cs=-

66.249.65.155 - - [21/Sep/2016:10:31:08 +0700] "GET / HTTP/1.1" 200 8244 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.96 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" "-" rt=0.600 ua="127.0.0.1:9000" us="200" ut="0.600" ul="37894" cs=-

66.249.65.147 - - [21/Sep/2016:10:28:30 +0700] "GET /?wordfence_syncAttackData=1472256000.1746 HTTP/1.1" 200 5 "http://mydomain/" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" "-" rt=0.900 ua="127.0.0.1:9000" us="200" ut="0.900" ul="23" cs=-

my ip - - [21/Sep/2016:10:53:52 +0700] "POST /wp-cron.php?doing_wp_cron=1474430032.2843470573425292968750 HTTP/1.1" 200 31 "http://www.mydomain/wp-cron.php?doing_wp_cron=1474430032.2843470573425292968750" "WordPress/4.6.1; https://www.mydomain" "-" rt=0.100 ua="127.0.0.1:9000" us="200" ut="0.100" ul="20" cs=-

66.249.65.177 - - [21/Sep/2016:10:54:04 +0700] "GET /?wordfence_syncAttackData=1474410355.1746 HTTP/1.1" 200 5 "https://www.mydomain/" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" "-" rt=0.300 ua="127.0.0.1:9000" us="200" ut="0.300" ul="16" cs=-

125.161.63.43 suspicious visitor first using his or her own ip to testing attack my domain

66.249.65.177
then using google ip to attact my domain

how is this possible ?