Herd immunity / adding to greylist

Forum

Sign In Here

Sign in to your account

If you are new here please register for an account

Username:

Password:

Remember Me

Forgot Password?

Resolved Herd immunity / adding to greylist

Ray Baron
Sunday, June 25, 2017
Subscribe via email

Another forum thread included this response from Cloudlinux:

"As of the current version, we do not let users adding graylist entries manually (only removing is possible)."

Two questions:

Where do you get the IPs in the greylist? Herd immunity implies there is a master source of abuse IPs. I use a couple of the lists in csf.blocklists and do not want to duplicate.

Is there a place I can submit abuse IPs (something like abuseip.com) where they will get picked up by the Imunify360 greylist?

Rate this post:

Responses (4)

26.06.2017 13:06:05
# 1

Alexandre Accepted Answer

Posts: 19
Joined: 31.01.2017

Votes

We collect information about attackers on Imunify360 correlation server. Sophisticated machine learning techniques are used to add entries to the global graylist - parts of this list are sent to Imunify360 agents on customers' servers to stop attackers before they've started their activity with them. Populating global graylist is an automatic process - we actually designed it to work without human intervention.

26.06.2017 14:06:41
# 2

Ray Baron Accepted Answer

Posts: 29
Joined: 01.04.2013

Votes

OK, thanks for that.

Might be nice to have a place to submit IPs since the correlation server (honeypot?) won't see every miscreant IP. This can also be automated, e.g., X number of reports gets an IP added to the greylist.

26.06.2017 14:06:03
# 3

Alexandre Accepted Answer

Posts: 19
Joined: 31.01.2017

Votes

This information is actually collected form customers' servers (not only from honeypots). So that, decisions are made based on number of incidents caused by the IP address, number of servers which were attacked, country of origin etc.

26.06.2017 14:06:25
# 4