D
D
DayLike2016-08-22 20:24:29
brute force
DayLike, 2016-08-22 20:24:29

Is there a centralized blacklisting system against botnet and brute as well as doss attacks?

I recently installed fail2ban on the server and was surprised that it turns out that not only Wordpress sites are brute force, but also ssh and ftp and probably something else that I don’t even know, so when I started blocking requests in Wordpress, I did it through the Wordfence plugin, I still saw that requests continue, and constantly receiving requests to open the page strains the server all the same, I started blocking ip through isp manager, well, it’s easier and more visual there) as soon as I blocked a couple, similar requests from other ips and even countries immediately rained down, there was a riot of colors and a variety of flags states, of course, I was a little surprised, like a regular site, what do they need from me? but there are still sites on the server and there are quite a few of them. eventually logged into the control panel and closed access via .htaccess by writing there

<Files wp-login.php>
order allow,deny
deny from all
</Files>

Then requests for the xmlrpc.php file immediately began to pour in, and I had to cover it too
<Files xmlrpc.php>
order allow,deny
deny from all
</Files>

as a result, the load decreased, probably because php worked less) the page did not display
So why is there only 1 password? and how can people know that their equipment can do things that could be criminalized?
There is probably such a centralized system that if an ip address is blocked due to brute force on one server, it can send it to a server that accepts and compiles blacklists and generates a file for download at some interval so that the server does not freeze) then other web servers, for example, just from some periodically download this ip blacklist of attackers and apply the setting not to accept its packets, thus if the attack is just starting and this ip is already on the list of dangerous ones, then it will be known on other servers within an hour and will also be blocked.
Is there such a thing?

Answer the question

In order to leave comments, you need to log in

3 answer(s)
D
Dimonchik, 2016-08-22
@dimonchik2013

there is no
IP they are taken from normal cars
about sorting out the SSS - yes, it’s better to immediately block China preventively, and Indian comrades who are good at spitting in English, but not taking anything

A
Alexander, 2016-08-22
@NeiroNx

Here, most likely, a white list of IPs should be done - the target audience is from Russia, which means we add all blocks of addresses of Russian providers to the white list. Then only Russian botnets will attack you - there are much fewer of them.

P
Puma Thailand, 2016-08-23
@opium

I just scored let them pick it up, for 10 years I have not been hacked into any of the thousands of servers.

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question