Failed Login Attempts and IP Black Listing

Portal Home > Knowledgebase > Articles Database > Failed Login Attempts and IP Black Listing

Posted by kandyjet, 09-15-2013, 12:53 AM
Hello, i am getting "Large Number of Failed Login Attempts from IP 27.153 xxx xxx". a sample report Now the ip origin shows it is from china. i am seeing many other reports too from this ip range. so in this case, black listing ip block 27.153.205.0/24 in cphulk is appropriate you think ?
Posted by FLDataTeK, 09-15-2013, 01:34 AM
I'd suggest installing CSF Firewall. Bruteforce and port scanning are just everyday life as a server operator. I'd just block the IP and not the whole /24 as you might block potential visitors. With CSF you can auto block or even temp block people who scan or bruteforce. Here is the link: http://configserver.com/cp/csf.html
Posted by kandyjet, 09-15-2013, 01:52 AM
Hai jeremy oh yes, we have csf installed by our provider and i see all the ips blacklisted in cphulk is alsoadded in csf black list automatically So may i tell the provider to disable cphulk as there is no need of two addons with does the same
Posted by BestServerSupport, 09-15-2013, 01:53 AM
If you just wish to block IP address OR IP range then you can also do it from cPHulk, there is no need to install CSF, However, to get an advantage of better features of CSF, you can also go for it.
Posted by kandyjet, 09-15-2013, 02:12 AM
yes undestood BSS
Posted by FLDataTeK, 09-15-2013, 02:48 AM
Typically you disable cPHulk when you install CSF otherwise you have two different pieces of software trying to do the same function. CSF is way more advanced than cPHulk.
Posted by kandyjet, 09-15-2013, 02:51 AM
Me also think so coz every time when a client is complain that he could not login to cpanel, i have check both places for possible black list of his ip
Posted by kandyjet, 09-15-2013, 07:26 AM
one last question folks, what will happen if the hackers use fake ips by using programs like 'hide my ip'. then we will ended up blocking legitimate ip's right?
Posted by Mad_matt, 09-15-2013, 08:39 AM
I am mainly using cphulk to ban them, additionally, I have set it so that it bans them after 1 failed attempt, with my normal IP's whitelisted. If CSF is more advanced though, I might look into switching over. I have a question though, is there anywhere we can find a reliable list of recommended IP's and IP blocks that should be banned? Like I would love to pre-ban everyone BEFORE they find me.
Posted by BMathews, 09-16-2013, 01:35 AM
You can Install CSF Firewall and also the cPHulk Brute Force Monitor.
Posted by nrion, 09-16-2013, 05:28 AM
Hi, what about badips.com, they seem to have an easy API for reporting and IP Blacklist generation... -- nrion