Support

This excerpt from the log proves that Admin Tools protects you against the zero-day attack which was fixed in Joomla! 3.4.6. However, you should go to Admin Tools, Web Application Firewall, Configure WAF, Basic Protection Features and set Enable IP Workarounds to No. Please note that IP workarounds are only necessary when you have a reverse proxy or CDN in front of your site and your web server is not configured to accept the forwarded end user's IP address.

Background information: Joomla! 1.0.0 to 3.4.5 (inclusive) was susceptible to a PHP session handling security hole which allowed a malicious user to run arbitrary PHP code with Super User privileges on your site. The attack vector in Joomla!'s case was a specially crafted User Agent string or X-Forwarded-For HTTP header. The latter is used instead of the IP of the attacker. Admin Tools is aware of these attack vectors and stops them. That's why you see these messages. If you disable the IP workarounds which are not necessary on your site the attacks will still be stopped but the real IP of the attacker will be displayed in the message.