I administer a web server and recently we had our IP banned (!) from our host after they received a notification e-mail for abuse. In particular our server is allegedly involved in spam attacks over HTTP. The content of the abuse report email we received was not much informative - for example the IP addresses our server is supposed to have attacked against are not included - so I started a
wireshark session checking for suspicious traffic over TCP/HTTP while trying to locate possible security holes on the system. (Let me note that the machine runs a Debian OS).
Here is an example of such a request...
Source: 18.104.22.168 Destination: 22.214.171.124 // my ip Protocol: HTTP Info: GET 'http://www.media.apniworld.com/image.php?type=hv' HTTP/1.0
I manually blacklisted this host (as well as some other ones) blocking them with
iptables, but I can't keep on doing manually all day long... I'm looking for an automated way to block such IPs based on:
- Statistical analysis, pattern recognition or other AI-based analysis (Though, I'm reluctant to trust such a solution, if exists)
- Public blacklists
Using DNSBL I actually found out that
126.96.36.199 is blacklisted. However other IPs which are strongly suspicious like
http://www.pornstarnetwork.com/account/signin), unfortunately were not blacklisted! What I would like to do is to automatically connect my firewall with DNSBL (or some other blacklist database) and block all traffic towards blacklisted IPs or somehow have my local blacklist automatically updated.
Update 1: My main question here consists in configuring
iptables to automatically block all IPs that are blacklisted in a public database such as this one. I'm looking for a tool that will automatically update my local blacklist adding any blacklisted IPs and of course removing them once their issues have been resolved (Would not be nice to block forever an IP because it once happened to be blacklisted). I don't really understand the utility of a blacklist web service without the ability to be consumed by iptables.