Automating blacklist of IP numbers in Sentinel?

Hangin' Around Joined: Feb 20, 2007 Posts: 32

Would it be an idea to start a general blacklist of IP's who tried to hack PHPnuke sites?

It's not that difficult for different people to export (sentinel) SQL tables with banned IP's, and merge the tables back into a new one. I know it can be a huge job, and it will probably take a lot of effort to maintain, but I am (more than!) tired of people trying to mess with my website.

Therefore I would like to gather as many IP's as possible. I prefer to unban lots of people over 1 person who attacks my site!

Off course I am willing to publish the SQL table for download on my website, or even start to write a script to automate it.

Or maybe even create a module for sharing your blacklist automatically with other TRUSTED Sentinel sites? It's a nice feature for Sentinel I think...Well... I keep on dreaming....

Greetings!

Martijn

Posted: Tue Mar 06, 2007 4:05 am

Nice idea but that doesn´t work and I wouldn´t use it because it´s from website to website different and many use just dynamic IPs or proxies. I prefer to have an individual .htaccess based on my experiences in the past 3 years.Furthermore NukeSentinel works very well there are so many options to block and hacker are usally banned when they try ...

Posted: Tue Mar 06, 2007 5:05 am

I have already passed the point of caring if an IP is dynamic or not. Messing equals banning. Period.

Posted: Tue Mar 06, 2007 6:34 am

Yes, but this may mean you ban someone who is innocent.

Posted: Wed Mar 07, 2007 12:14 am

Banning dynamic numbers is already a possibility for banning innocent people.

Anyway: I already started gathering IP numbers from sites displaying their sentinel banlist. I already noticed some similarities in IP numbers of people who are messing with NUKE sites.

I simply would like to have people already banned who have messed with other sites.

Posted: Wed Mar 07, 2007 1:49 am

...but how do you know these people have been banned for a legitimate reason, their IP might appear there by mistake. You only have to look through the forums here to see instances of people being banned by mistake.

Posted: Wed Mar 07, 2007 3:49 pm

I could see a dynamic banlist like used for spam emails. I've looked into developing a blackhole DNS system myself. But it would have to be tightly controlled, only the actual abusers should be blocked. Sadly the dynamic nature of web would make it impossible to block everything, there would have to be reports first in order to block the IP address