Files
Linux-Server-Management-Too…/modules
cschantz 24363a1713 Add auto-blocking for distributed attacks
When 5+ IPs perform same attack type (RCE, SQL_INJECTION, XSS, PATH_TRAVERSAL, BRUTEFORCE) within 2 minutes:
- Block all individual attacking IPs immediately via IPset
- If 25+ IPs from same /24 subnet, block entire subnet

Uses batch_block_ips() for efficient IPset operations.
All blocking is kernel-level via IPset (no CSF commands).
2026-01-06 21:55:58 -05:00
..