Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I currently have a site that is armored by ELMAH as its reporting mechanism. Each time someone hits a URL that is incorrect it notifies me or logs to the system. This is annoying for someone fat-fingering the URL with a misspelling but great when a hacker is trying to crack a site of mine. Has anyone ever written a script for IIS 7 on Win 2K8 that blocks an IP based on repeated attempts to hit a website? I've looked at Snort and other IDS systems but if I could get a script that could be linked to my ELMAH system it might be the perfect thing.

PowerScript, etc. is what I was thinking. Hints and recommendations are wonderful and if you think a true intrusion detection system is recommended give me your ideas.

Thanks in advance.

share|improve this question
up vote 0 down vote accepted

Tried Dynamic IP Restrictions?

share|improve this answer
this looks like the ticket....will try it – dodegaard Jun 21 '11 at 21:14

Wouldn't you be better served by an IDS, thereby stopping the activity at the perimeter of your network rather than trying to stop the activity once it's already entered your network and gotten to your web server?

share|improve this answer
do you have any IDS in mind as a recommendation on Windows? – dodegaard Dec 27 '10 at 19:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.