ALERT! Business Thread burte force attacks and deny from

Collapse
X
Collapse
 
  • Page of 1
  • Time
  • Show
Clear All
new posts
Previous template Next
  • mikesouth
    Confirmed User
    • Jun 2003
    • 6334
    #1

    ALERT! Business Thread burte force attacks and deny from

    Every so often I get brute force attacks, of course strongbox catches them and diables the IP at which point the cript uses another IP and strongbox disables it....and on and on

    My question is...

    Is there any value to adding these IPs to the .htaccess file in a deny from

    or is that just futility?
    Mike South

    It's No wonder I took up drugs and alcohol, it's the only way I could dumb myself down enough to cope with the morons in this biz.
    Tags: None
    • TheDoc
      Too lazy to set a custom title
      • Jul 2001
      • 13827
      #2
      It's not smart to auto deny IP's via .htaccess for members. As an example, Ripe is a huge ISP that you will have brute force attacks on but you also have lots of members using it. One wrong IP block and you could take out a small group of people.

      Now, part of the Asia Pac network, if you break the IP's down you can kill out entire countries/cities/regions that you know can't process so no reason to let them be a password leak or a possible attack.
      ~TheDoc - ICQ7765825
      It's all disambiguation

        Comment

        • mikesouth
          Confirmed User
          • Jun 2003
          • 6334
          #3
          so these password guessing scripts are forging random IPs

          not using a proxy server ?
          Mike South

          It's No wonder I took up drugs and alcohol, it's the only way I could dumb myself down enough to cope with the morons in this biz.

            Comment

            • Due
              Confirmed User
              • Mar 2001
              • 3620
              #4
              Originally posted by TheDoc
              Now, part of the Asia Pac network, if you break the IP's down you can kill out entire countries/cities/regions that you know can't process so no reason to let them be a password leak or a possible attack.
              There is no such things as countries you can't process from
              I buy plugs
              Skype: Due_Global
              /Due

                Comment

                • ladida
                  Confirmed User
                  • Nov 2005
                  • 2179
                  #5
                  Originally posted by mikesouth
                  so these password guessing scripts are forging random IPs

                  not using a proxy server ?
                  No, they're using proxies.
                  agentGFY *at* gmail.com

                    Comment

                    • mikesouth
                      Confirmed User
                      • Jun 2003
                      • 6334
                      #6
                      so I would assume the proxies have a finite list of IPs they can use so if I block individual IPs wouldnt it eventually run out. This appears to be the same script every time guess at the same list of usernames and passes
                      Mike South

                      It's No wonder I took up drugs and alcohol, it's the only way I could dumb myself down enough to cope with the morons in this biz.

                        Comment

                        • mikesouth
                          Confirmed User
                          • Jun 2003
                          • 6334
                          #7
                          itll go through about 100 guesses then stop
                          Mike South

                          It's No wonder I took up drugs and alcohol, it's the only way I could dumb myself down enough to cope with the morons in this biz.

                            Comment

                            • TheDoc
                              Too lazy to set a custom title
                              • Jul 2001
                              • 13827
                              #8
                              Originally posted by Due
                              There is no such things as countries you can't process from
                              Maybe so, but if you calculate net profit percentages on income earned vs damage produced in some regions, it just isn't worth it to allow the transactions. Which is why I recommend selling the traffic off totally, to someone like you that can process it and handle the members
                              ~TheDoc - ICQ7765825
                              It's all disambiguation

                                Comment

                                • TheDoc
                                  Too lazy to set a custom title
                                  • Jul 2001
                                  • 13827
                                  #9
                                  Mike, it's not normal proxies, as people think of proxies.

                                  If you start tracking your attacks, use geoip lookup on the ip's and reverse lookup, you will start to see many of the IP's are from hosting companies. The Webmaster has say 20 IP's, and he will rotate through them, like a proxy. You just have to be careful that it isn't also a dial up ISP.

                                  A quick lookup of the hosting company name + spam on google, will let ya know if it's legit or not. From here you can block the entire hosting company, which will lower your overall brute force attacks.

                                  Just make sure you put a notice up that actually tells the people they have been blocked, and if it's an error give them a clean way to contact you so you can unblock the ip.
                                  ~TheDoc - ICQ7765825
                                  It's all disambiguation

                                    Comment

                                    • mikesouth
                                      Confirmed User
                                      • Jun 2003
                                      • 6334
                                      #10
                                      Gotcha doc...thanks man that makes sense now
                                      Mike South

                                      It's No wonder I took up drugs and alcohol, it's the only way I could dumb myself down enough to cope with the morons in this biz.

                                        Comment

                                        Previous template Next
                                        Working...