Is my Ban Host working?

  • Resolved HKP

    (@hiskingdomprophecy)


    4 years, 10 months ago

    Hi Folks,

    I have some bad actors in Bulgaria who have been overloading my site many time per day for a couple of weeks.

    I am a user, not developer, so I hope you understand what I write here.

    They mainly use IP 87.246.7.212, so I first blocked it on Ban Hosts as 87.246.7.*

    However that did no good, and 1 week later I added 87.246.7.212 as well.

    On the plugin user interface it now shows:

    Ban Hosts:
87.246.7.0/24
87.246.7.212

    This is confirmed on my .htaccess as it includes:

    # Ban Hosts - Security > Settings > Banned Users
	SetEnvIF REMOTE_ADDR "^87\.246\.7\.212$" DenyAccess
	SetEnvIF X-FORWARDED-FOR "^87\.246\.7\.212$" DenyAccess
	SetEnvIF X-CLUSTER-CLIENT-IP "^87\.246\.7\.212$" DenyAccess

	SetEnvIF REMOTE_ADDR "^87\.246\.7\.[0-9]{1,3}$" DenyAccess
	SetEnvIF X-FORWARDED-FOR "^87\.246\.7\.[0-9]{1,3}$" DenyAccess
	SetEnvIF X-CLUSTER-CLIENT-IP "^87\.246\.7\.[0-9]{1,3}$" DenyAccess

	<IfModule mod_authz_core.c>
		<RequireAll>
			Require all granted
			Require not env DenyAccess
			Require not ip 87.246.7.212
			Require not ip 87.246.7.0/24
		</RequireAll>
	</IfModule>
	<IfModule !mod_authz_core.c>
		Order allow,deny
		Allow from all
		Deny from env=DenyAccess
		Deny from 87.246.7.212
		Deny from 87.246.7.0/24
	</IfModule>

    However again just now, my site db was unavailable due to overload and again I find 7 connections from 87.246.7.212.

    This is happening several times per day that I get overload and the site is inaccessible.
    On each occasion 87.246.7.212 or 87.246.7.* from Bulgaria are there as the last entry with the most connections on the DirectAdmin server load average warning message. Sometimes >50 from that IP alone – and they are always the last entry.

    I though Ban Hosts was meant to stop 87.246.7.212 from being able to even see our site, never mind interact with it. Is that correct?

    Is there any help or advice you can offer on this? I am really getting tired of them.

    Regards and thanks,
    Angus

Viewing 2 replies - 1 through 2 (of 2 total)
  • jetxpert

    (@jetxpert)

    4 years, 10 months ago

    @hiskingdomprophecy,

    Yes, the IP you provided is nasty (details). What you did is correct. However, we have learned that iThemes Security is not an iron-clad solution for blocking malicious IPs. They admit it themselves (Read FAQ No. 3).

    Here’s what we recommend:

    (1) Verify you’re using the latest version of iThemes Security. Also, clear your cache (server level and from cache plugins you may be using).

    (2) Perform a malware scan of your website using Sucuri SiteCheck.

    (3) Perform a malware scan of your website using SiteGuarding (it detects Base64 malicious code).

    (4) Contact your host and ask them to perform a malware scan of your website (including your database). Also, ask them to clear all cache (e.g., varnish). It wouldn’t hurt to ask them to help with your specific issue as well.

    (5) If using a CDN (e.g., Cloudflare), go to: Dashboard > Firewall > Tools and block the following ASNs: 12615 and 208410 and the following IP (range): 87.246.7.0/24

    Note: If you start having issues after blocking the above ASNs, simply remove them. Keep blocking the IP (range) provided.

    Hope this helps.

    Cheers!

    Thread Starter HKP

    (@hiskingdomprophecy)

    4 years, 10 months ago

    @jetxpert

    Thanks for your reply.

    I shall do that.

    So far I have done 1, 2 and 3 and all is well.

    Regards and thanks,
    Angus

Viewing 2 replies - 1 through 2 (of 2 total)

The topic ‘Is my Ban Host working?’ is closed to new replies.