Support

Ip is not listed on a few mew security exceptions Instead I see the attached.

This is an attack on Joomla! versions 3.4.5 and prior. Your up to date version of Joomla! is not vulnerable and Admin Tools is stopping it anyway. The attack works by putting executable code in the from IP field and tricking the old version of Joomla! into executing it. We've seen a rash of these attacks over the past two weeks.

Should I click the red flag on these to turn them green or just leave them?

This particular attack is no threat to your site. Permanently blocking IP addresses is ineffective. Hackers don't use their own IP addresses. They use a dynamic IP, proxy server or a compromised computer. In almost all cases, you're just blocking an IP address that may be used by a legitimate visitor at some point in the future.

Temporary blocks are a different matter. It will stop a bot simply going through a list of IP addresses from attacking you. An IP blacklist is trivial for a human attacker to bypass, they just use another IP in their collection. The temporary ban stops the hacker from using that IP for the duration of the ban without blocking future legitimate users.