Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm getting a ton of bruteforce attacks today from a domain rather then an IP. I tracked down the websites IP address and blocked it but I am still getting the bruteforce warnings. Can I some how use iptables to block a domain name?
share|improve this question
brute force against what? HTTP? SSH? FTP? – SpacemanSpiff Nov 12 '12 at 22:09
@SpacemanSpiff I would guess SSH, but i'm not sure. This is the message I get. 5 failed login attempts to account root (system) -- Large number of attempts from this IP: – Michael Howey Nov 12 '12 at 22:13
I've been getting them every 5 minutes for the last 10 hours. Normally I block the IP and I'm good to go. @SpacemanSpiff – Michael Howey Nov 12 '12 at 22:14
up vote 1 down vote accepted

You may want to consider doing a reverse DNS query, then a whois query do determine the network block and finally just drop the whole network block.


host has address

inetnum: -
netname:        XJTU-CN
descr:          Xian Jiaotong University
descr:          Xian
descr:          Shanxi Province

iptables -A INPUT -p tcp --source -j DROP

No more TCP connections from the whole university.

share|improve this answer
So basically run this line in putty? iptables -A INPUT -p tcp --source -j DROP – Michael Howey Nov 12 '12 at 23:06

Use a tool like fail2ban to automatically detect and ban these brute-force login attempts.

share|improve this answer

Ban This IP has a PTR record (reverse dns) and it resolves to Reverse DNS

share|improve this answer
Tried that, didn't work – Michael Howey Nov 12 '12 at 22:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.