Support

There are two possible explanations:

1. Another site on the same server is compromised and it's trying to brute force the administrator password on your site. The idea is that attackers believe that localhost (127.0.0.1) is unlikely to be blocked and won't raise any red flags. Please note that 127.0.0.1 in the log means that the attack is coming from the server itself, NOT your computer. In any case, we anticipate their expectation and do treat localhost just like any other IP address: if it causes a security exception, we block it.

2. Something installed on your site, be it a module, plugin, component, template or a CRON job, is trying to access a URL in the administrator section of the site. This is a bad practice, discouraged by Joomla!'s best practices, nevertheless some inexperienced developers still use it. If this is the case then the Target URL would be telling. Unfortunately, since you didn't provide us with the Target URL of the suspected attack coming from 127.0.0.1 we can't tell you if this is the case.

A ha! Then case #1 is the most likely culprit. I have seen it before.

Before we found your software hackers had achieved access to our site, including the JomSocial area and the AVChat chat rooms without ever creating registered log-ins. Admin Tools is now blocking them but perhaps that is how they have something inside the server and use 127.0.0.1?

It is a plausible explanation. The attacker could harvest the username of your administrator from your JomSocial installation. Then they could simply put their hacking bot to brute force your administrator password. Once they found it it was game over for your site. Incidentally, this kind of another hacked site on the same server hacking your site is one of the most common reasons sites (Joomla!, WordPress, Drupal, or just about anything) get hacked the past few years. That's why it always pays off to be paranoid with security and backups ;)

Blacklisting localhost (127.0.0.1) is generally a bad idea which will come to bite you. It always comes back to bite you when you least expect it, e.g. trying to run a backup with the alt-backup.php script. I'd say don't blacklist it, it will be a bad idea.