Re: [mod-security-users] Can we consume Third Part IP reputation list?

[Blason R <bla...@gm...>]

Well since we are gathering the events through specific high interaction
Honeypots wanted to specifically rely on our IP list. Please suggest the
changes that I need to make to achieve this?

On Mon, Apr 13, 2020 at 4:44 PM Reindl Harald <h.r...@th...>
wrote:

>
>
> Am 13.04.20 um 13:04 schrieb Blason R:
> > Wondering if we can consume any third party IP reputation list through
> > modsec?
> > Just like we internally generate our own IP reputation list through
> > honeypot and wanted to know if I can use that?
>
> you can but besides performance consideration you won#t find any RBL you
> can trust enough
>
> why do you think modsec, postfix or any other software distincts between
> your RBL or a external RBL? same techniqe and same syntax
>
> was cool last year as spamhaus XBL started at friday evening with
> positive responses for every IP and we had used it only for form-submits
> (because of performance consideration)
>
>
>
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>