I'm handling a hosting services for website via WHM. Few months ago, I've been experiencing some automated attacks on the websites that I'm handling. See screenshots below:

Are there any remedy for issue, for them to stop? This is the first time that I'm experiencing this, I now have [2801] permanent IP ban address in just a few days. I even edited my csf configuration, being insane that I permanently blocked IP address if they have wronged 1-2 times (from 10 as default). When I did that, I'm surprised that It's even more alot of IP blocks.

Any help would be appreciated.

Edit csf.deny, the IP address deny file (Currently: 2801 permanent IP bans)

enter image description here

enter image description here


Considering you are already running modsecurity you can consider integrating it with a HIDS like OSSEC. It will automatically ban IP addresses that are detected as attempting injection attacks.

  • Thanks, I will research on this and will get back to you! Nov 29 '17 at 18:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.