Its impossible to spoof your ip address of a TCP connection due to the 3 way handshake....  Unless of course the application is vulnerable to CWE-291: Trusting a Self Reported IP address

Sure enough in ./wordfence/lib/wfUtils.php on line 77:

public static function getIP(){
    $IP = 0;
    if(isset($_SERVER['HTTP_X_FORWARDED_FOR'])){
        $IP = $_SERVER['HTTP_X_FORWARDED_FOR'];


So yes,  the reason why you are seeing brute force attempts from 8.8.8.8 is because WordFence is vulnerable to CWE-291.  I am reporting this vulnerability to WordFence,  but to be honest this vulnerability is so painfully obvious.  If the developer doesn't understand even the most basic flaws of trusting attacker input, then they have probably made other serious mistakes that impact security, I smell blood.

Its possible that a security system can make your system as a whole less secure.  This is nothing new, remote code execution vulnerabilities have been found in anti-virus software. Complexity is the worst enemy of security.

Brute force login attempt from spoofed IP's
I am trying to use NSDateFormatter to convert the following string to an NSDate: 2013-08-19 7:00 AM.

However, the following NSDate is created: 2013-08-19 04:00:00 +0000. The hour is wrong.

My code is below. I don't know what I am doing incorrectly.

NSDateFormatter *dateFormatter = [NSDateFormatter new];
[dateFormatter setTimeZone:[NSTimeZone systemTimeZone]];
[dateFormatter setDateFormat:@"yyyy-MM-dd HH:mm a"];
NSString *string = @"2013-08-19 7:00 AM";
NSDate *dateFromString = [dateFormatter dateFromString:string];

