RBL based reputation database prevents website hacking, DDOS and brute force attacks.
RBL Check
Usage
RBL Database server: rbl.malware.expert
RBL Database to ModSecurity
Add below text to ex. /etc/modsecurity.d/rbl.conf
SecRule REQUEST_METHOD "POST" "id:'400010',phase:1,chain,drop,log,msg:'Malware host detected by rbl.malware.expert'" SecRule REMOTE_ADDR "@rbl rbl.malware.expert"
Optimize / tuning
If you want to minimize dns response times, you can use local DNS resolver.
RBL Database with IPSET
- Subscription customers can download IP’s list for custom usage using this guide.
- Custom ipset.sh script to use database and block request in IPTABLES firewall.
- Howto Integrating RBL Database to CSF Firewall