alt Hacker NewsI have my own system of IP reputation whereby if an IP address hits one of my systems with some probe or scan that I didn't ask for, then it's blocked for 12 months.
https://github.com/UninvitedActivity/UninvitedActivity
P.S. just to add a note here that I have been blocked out of my own systems occasionally from mobile / remote IPs due to my paranoia-level setup. But I treat that as learning / refinement, but also can accept that as the cost of security sometimes.
Replies
> can accept that as the cost of security sometimes
And corporate IT wonders why employees are always circumventing "security policies"...
I perma-ban any /16 that hits fail2ban 100+ times. That cuts down dramatically on the attacks from the usual suspects.
Nice, thanks for the link. Good to be ruthless about those things when you can.
My first thought is that with CGNAT ever more present, this kind of approach seems like it'll have a lot of collateral damage.