I need more distributed attacks detection software or services such as https://www.abuseipdb.com/ or https://www.blocklist.de.

Right now I'm using those to add IPs that are near-guaranteed to be abusive, malicious or botnets to "long-term" fail2ban jail (set to 2 days for now). This works great: most of the attacks are blocked while I have not experienced any false positives so far.

However, I still find some attack activity in the logs. I wonder if there are more of services or software that can do such a job out there? Requirements:

  • few false positives
  • preferably free
  • detects attacks such as brute-forcing SSHD, SMTP, IMAP, POP3, botnets, slow attacks (brute-forcing with slow back-off with simultaneous attacks from multiple IPS to get around fail2ban - I've had some such attacks)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.