Attack Events From IP

  • Updated


Why are my protect events coming in from


Protect shows an IP of for attacks that are triggered by one of Protect's "semantic" rules. These rules do not require input from a specific request but can be triggered by things we see happening within the code or if a file in the local file system is read. If that is the case, there will be no URL associated with the attack event.

Some rules that may show attacks from IP are:

  • Path Traversal: A file such as /etc/hosts is accessed
  • Untrusted Deserialization: A file object is being deserialized from an input file, such as an XML source.
  • SQL Injection
  • Command Injection  

To evaluate specific examples, please submit a ticket to our online support portal with details or a screenshot of the event details.

Was this article helpful?

0 out of 0 found this helpful

Have more questions? Submit a request