Blocking hackers

[Angus Robertson 586]

ICS has a component TIcsBlackList that can be used by servers to count access attempts by IP address, and block after a specified number of attempts until after several hours of inactivity.  It's use is illustrated in the OverbyteIcsSslMultiWebServ sample.

 

Just noticed these lines in the log for one of my web servers, someone using Alibaba Cloud in Hong Kong has made almost three million access attempts to my web site over several weeks, trying to read access data that is limited to 50 accesses per day.  And still trying despite those requests being rejected. 

 

47.76.209.138 attempts 1,481,269, first at 12:18:52, last at 20:00:17 BLOCKED

47.76.99.127 attempts 1,478,638, first at 12:04:36, last at 19:58:57 BLOCKED

 

Should really be reporting the date of first access, but don't normally see hackers continuing this long.

 

The sample shows various ways to detect hackers, such as web site access by IP address instead of host name, that stops hundreds daily on my sites (no HTTP allowed).  

 

Angus

 

[Attila Kovacs 634]

nice 😉

Edited Friday at 10:14 PM by Attila Kovacs