Support

Hello Steve,

The "Admin Query String" means that someone tried to access your site's administrator area without providing the correct administrator secret URL parameter configure in Admin Tools.

The 192.168.*.* range belongs to the private IPv4 range. These are not public IPs. They can only be used by private (as opposed to Internet-facing) networks. If this is a live site and you see a lot of those IPs it means that you either have a misbehaving script inside your host's network or your server configuration is wrong and ends up reporting the wrong IP address to PHP. If you are on an intranet then the IP is most likely genuine and shows that the owner of this IP is trying to do something nasty.

I would recommend first asking your host if the IP that generates the security exception belongs to the same server as yours or a different one. Normally if a script attack is launched from the same server you should see 127.0.0.1 as the attacker's IP, barring a different Apache configuration (e.g. Apache listening only to the public and internal network IP and the attacker using the internal network hostname... but this is a far cry and would not work due to the name-based vhost configuration all cPanel-based hosts follow).

I am more willing to believe that the problem is a wrong IP forwarding from a transparent proxy sitting in front of your server. The easiest way to test the theory is launching an attack on yourself :) Try to do something which triggers Admin Tools and then take a look at the Security Exceptions Log. Which IP address do you see?

It's time to call your host and ask them where does that IP come from.