Back to Details

detecting-port-scanning-with-fail2ban

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Detecting Port Scanning with Fail2ban

使用Fail2ban检测端口扫描

When to Use

适用场景

  • Automatically blocking IP addresses that perform port scans against internet-facing servers
  • Defending SSH, HTTP, FTP, and other services against brute force attacks with automated IP banning
  • Creating custom detection filters for organization-specific attack patterns in log files
  • Reducing noise from automated scanning bots before traffic reaches IDS/IPS for deeper analysis
  • Implementing defense-in-depth by adding host-based automated response to network monitoring
Do not use as the sole network security control, for protecting against distributed attacks from many source IPs, or as a replacement for proper firewall rules and network segmentation.
  • 自动封禁对面向互联网的服务器执行端口扫描的IP地址
  • 通过自动IP封禁保护SSH、HTTP、FTP及其他服务免受暴力破解攻击
  • 针对日志文件中特定于组织的攻击模式创建自定义检测过滤器
  • 在流量到达IDS/IPS进行深度分析前，减少自动扫描机器人带来的干扰
  • 通过为网络监控添加基于主机的自动响应，实现纵深防御
请勿将其用作唯一的网络安全控制措施，也不要用它防护来自大量源IP的分布式攻击，或替代合适的防火墙规则和网络分段。

Prerequisites

前提条件

  • Fail2ban 0.11+ installed (
    fail2ban-client --version
    )
  • Root/sudo access for iptables/nftables manipulation
  • Services logging connection attempts to parseable log files (syslog, auth.log, access.log)
  • iptables or nftables installed and operational as the host firewall
  • Optional: SMTP server for email notifications on ban events
  • 已安装Fail2ban 0.11+（可通过
    fail2ban-client --version
    查看版本）
  • 拥有操作iptables/nftables的Root/sudo权限
  • 服务会将连接尝试记录到可解析的日志文件中（如syslog、auth.log、access.log）
  • 已安装并运行iptables或nftables作为主机防火墙
  • 可选：用于在封禁事件发生时发送邮件通知的SMTP服务器

Workflow

操作流程

Step 1: Install and Configure Fail2ban

步骤1：安装并配置Fail2ban

bash
undefined
bash
undefined

Install Fail2ban

Install Fail2ban

sudo apt install -y fail2ban
sudo apt install -y fail2ban

Create local configuration (never edit jail.conf directly)

Create local configuration (never edit jail.conf directly)

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

Configure global defaults

Configure global defaults

sudo tee /etc/fail2ban/jail.local << 'EOF' [DEFAULT]
sudo tee /etc/fail2ban/jail.local << 'EOF' [DEFAULT]

Ban duration (1 hour default, escalates for repeat offenders)

Ban duration (1 hour default, escalates for repeat offenders)

bantime = 3600
bantime = 3600

Detection window

Detection window

findtime = 600
findtime = 600

Max failures before ban

Max failures before ban

maxretry = 5
maxretry = 5

Ban action using iptables

Ban action using iptables

banaction = iptables-multiport banaction_allports = iptables-allports
banaction = iptables-multiport banaction_allports = iptables-allports

Email notifications

Email notifications

destemail = security@example.com sender = fail2ban@example.com mta = sendmail action = %(action_mwl)s
destemail = security@example.com sender = fail2ban@example.com mta = sendmail action = %(action_mwl)s

Ignore internal networks

Ignore internal networks

ignoreip = 127.0.0.1/8 ::1 10.10.0.0/16
ignoreip = 127.0.0.1/8 ::1 10.10.0.0/16

Use systemd journal backend where available

Use systemd journal backend where available

backend = systemd
[sshd] enabled = true port = ssh filter = sshd logpath = /var/log/auth.log maxretry = 3 bantime = 7200 findtime = 300
[sshd-ddos] enabled = true port = ssh filter = sshd-ddos logpath = /var/log/auth.log maxretry = 6 bantime = 3600 EOF
undefined
backend = systemd
[sshd] enabled = true port = ssh filter = sshd logpath = /var/log/auth.log maxretry = 3 bantime = 7200 findtime = 300
[sshd-ddos] enabled = true port = ssh filter = sshd-ddos logpath = /var/log/auth.log maxretry = 6 bantime = 3600 EOF
undefined

Step 2: Create Custom Port Scan Detection Filter

步骤2：创建自定义端口扫描检测过滤器

bash
undefined
bash
undefined

Create iptables logging rule for dropped connections

Create iptables logging rule for dropped connections

sudo iptables -N PORTSCAN sudo iptables -A PORTSCAN -j LOG --log-prefix "PORTSCAN_DETECTED: " --log-level 4 sudo iptables -A PORTSCAN -j DROP
sudo iptables -N PORTSCAN sudo iptables -A PORTSCAN -j LOG --log-prefix "PORTSCAN_DETECTED: " --log-level 4 sudo iptables -A PORTSCAN -j DROP

Log SYN packets to closed ports (indicates scanning)

Log SYN packets to closed ports (indicates scanning)

sudo iptables -A INPUT -p tcp --tcp-flags SYN,ACK,FIN,RST SYN -m state --state NEW
-m recent --name portscan --set sudo iptables -A INPUT -p tcp --tcp-flags SYN,ACK,FIN,RST SYN -m state --state NEW
-m recent --name portscan --rcheck --seconds 10 --hitcount 20 -j PORTSCAN
sudo iptables -A INPUT -p tcp --tcp-flags SYN,ACK,FIN,RST SYN -m state --state NEW
-m recent --name portscan --set sudo iptables -A INPUT -p tcp --tcp-flags SYN,ACK,FIN,RST SYN -m state --state NEW
-m recent --name portscan --rcheck --seconds 10 --hitcount 20 -j PORTSCAN

Create Fail2ban filter for port scanning

Create Fail2ban filter for port scanning

sudo tee /etc/fail2ban/filter.d/portscan.conf << 'EOF' [Definition]
sudo tee /etc/fail2ban/filter.d/portscan.conf << 'EOF' [Definition]

Match iptables port scan log entries

Match iptables port scan log entries

failregex = PORTSCAN_DETECTED: .* SRC=<HOST> DST=\S+ .* DPT=\d+ ignoreregex = datepattern = {^LN-BEG} EOF
failregex = PORTSCAN_DETECTED: .* SRC=<HOST> DST=\S+ .* DPT=\d+ ignoreregex = datepattern = {^LN-BEG} EOF

Create Fail2ban filter for Nmap detection via kernel logs

Create Fail2ban filter for Nmap detection via kernel logs

sudo tee /etc/fail2ban/filter.d/nmap-scan.conf << 'EOF' [Definition]
sudo tee /etc/fail2ban/filter.d/nmap-scan.conf << 'EOF' [Definition]

Detect rapid connection attempts to multiple ports from same source

Detect rapid connection attempts to multiple ports from same source

failregex = kernel: [.] PORTSCAN_DETECTED: . SRC=<HOST> iptables: .* PORTSCAN .* SRC=<HOST> ignoreregex = datepattern = {^LN-BEG} EOF
failregex = kernel: [.] PORTSCAN_DETECTED: . SRC=<HOST> iptables: .* PORTSCAN .* SRC=<HOST> ignoreregex = datepattern = {^LN-BEG} EOF

Create filter for HTTP scanning/probing

Create filter for HTTP scanning/probing

sudo tee /etc/fail2ban/filter.d/http-scan.conf << 'EOF' [Definition]
sudo tee /etc/fail2ban/filter.d/http-scan.conf << 'EOF' [Definition]

Detect scanners probing for common vulnerabilities

Detect scanners probing for common vulnerabilities

failregex = ^<HOST> .* "(GET|POST|HEAD) /(wp-login|wp-admin|phpmyadmin|admin|.env|xmlrpc|wp-content/uploads)." (403|404|444) ^<HOST> . "(GET|POST) /..(php|asp|aspx|jsp|cgi)?." (403|404) ^<HOST> .* "() ." 400 ^<HOST> . "(GET|POST) /.*" 400 ignoreregex = datepattern = {^LN-BEG} EOF
undefined
failregex = ^<HOST> .* "(GET|POST|HEAD) /(wp-login|wp-admin|phpmyadmin|admin|.env|xmlrpc|wp-content/uploads)." (403|404|444) ^<HOST> . "(GET|POST) /..(php|asp|aspx|jsp|cgi)?." (403|404) ^<HOST> .* "() ." 400 ^<HOST> . "(GET|POST) /.*" 400 ignoreregex = datepattern = {^LN-BEG} EOF
undefined

Step 3: Configure Jail for Port Scanning

步骤3：配置端口扫描Jail

bash
undefined
bash
undefined

Add port scan jails to jail.local

Add port scan jails to jail.local

sudo tee -a /etc/fail2ban/jail.local << 'EOF'
[portscan] enabled = true filter = portscan logpath = /var/log/kern.log maxretry = 10 findtime = 60 bantime = 86400 banaction = iptables-allports action = %(action_mwl)s
[nmap-scan] enabled = true filter = nmap-scan logpath = /var/log/kern.log maxretry = 5 findtime = 30 bantime = 86400 banaction = iptables-allports action = %(action_mwl)s
[http-scan] enabled = true filter = http-scan logpath = /var/log/nginx/access.log maxretry = 10 findtime = 300 bantime = 3600 banaction = iptables-multiport port = http,https
[recidive] enabled = true filter = recidive logpath = /var/log/fail2ban.log bantime = 604800 findtime = 86400 maxretry = 3 banaction = iptables-allports action = %(action_mwl)s EOF
undefined
sudo tee -a /etc/fail2ban/jail.local << 'EOF'
[portscan] enabled = true filter = portscan logpath = /var/log/kern.log maxretry = 10 findtime = 60 bantime = 86400 banaction = iptables-allports action = %(action_mwl)s
[nmap-scan] enabled = true filter = nmap-scan logpath = /var/log/kern.log maxretry = 5 findtime = 30 bantime = 86400 banaction = iptables-allports action = %(action_mwl)s
[http-scan] enabled = true filter = http-scan logpath = /var/log/nginx/access.log maxretry = 10 findtime = 300 bantime = 3600 banaction = iptables-multiport port = http,https
[recidive] enabled = true filter = recidive logpath = /var/log/fail2ban.log bantime = 604800 findtime = 86400 maxretry = 3 banaction = iptables-allports action = %(action_mwl)s EOF
undefined

Step 4: Configure Advanced Ban Actions

步骤4：配置高级封禁操作

bash
undefined
bash
undefined

Create custom action that blocks and sends webhook notification

Create custom action that blocks and sends webhook notification

sudo tee /etc/fail2ban/action.d/iptables-webhook.conf << 'EOF' [Definition] actionstart = <iptables> -N f2b-<name> <iptables> -A f2b-<name> -j RETURN <iptables> -I <chain> -p <protocol> -j f2b-<name>
actionstop = <iptables> -D <chain> -p <protocol> -j f2b-<name> <iptables> -F f2b-<name> <iptables> -X f2b-<name>
actioncheck = <iptables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
actionban = <iptables> -I f2b-<name> 1 -s <ip> -j <blocktype> curl -s -X POST "<webhook_url>"
-H "Content-Type: application/json"
-d '{"text":"[Fail2ban] Banned <ip> from <name> jail (failures: <failures>)"}'
actionunban = <iptables> -D f2b-<name> -s <ip> -j <blocktype>
[Init] chain = INPUT blocktype = DROP webhook_url = https://hooks.slack.com/services/XXXX/YYYY/ZZZZ EOF
sudo tee /etc/fail2ban/action.d/iptables-webhook.conf << 'EOF' [Definition] actionstart = <iptables> -N f2b-<name> <iptables> -A f2b-<name> -j RETURN <iptables> -I <chain> -p <protocol> -j f2b-<name>
actionstop = <iptables> -D <chain> -p <protocol> -j f2b-<name> <iptables> -F f2b-<name> <iptables> -X f2b-<name>
actioncheck = <iptables> -n -L <chain> | grep -q 'f2b-<name>[ \t]'
actionban = <iptables> -I f2b-<name> 1 -s <ip> -j <blocktype> curl -s -X POST "<webhook_url>"
-H "Content-Type: application/json"
-d '{"text":"[Fail2ban] Banned <ip> from <name> jail (failures: <failures>)"}'
actionunban = <iptables> -D f2b-<name> -s <ip> -j <blocktype>
[Init] chain = INPUT blocktype = DROP webhook_url = https://hooks.slack.com/services/XXXX/YYYY/ZZZZ EOF

Create escalating ban action for repeat offenders

Create escalating ban action for repeat offenders

sudo tee /etc/fail2ban/action.d/escalating-ban.conf << 'EOF' [Definition] actionban = <iptables> -I f2b-<name> 1 -s <ip> -j DROP echo "$(date) BAN <ip> jail=<name> failures=<failures> bantime=<bantime>" >> /var/log/fail2ban-bans.log
actionunban = <iptables> -D f2b-<name> -s <ip> -j DROP echo "$(date) UNBAN <ip> jail=<name>" >> /var/log/fail2ban-bans.log EOF
undefined
sudo tee /etc/fail2ban/action.d/escalating-ban.conf << 'EOF' [Definition] actionban = <iptables> -I f2b-<name> 1 -s <ip> -j DROP echo "$(date) BAN <ip> jail=<name> failures=<failures> bantime=<bantime>" >> /var/log/fail2ban-bans.log
actionunban = <iptables> -D f2b-<name> -s <ip> -j DROP echo "$(date) UNBAN <ip> jail=<name>" >> /var/log/fail2ban-bans.log EOF
undefined

Step 5: Test and Validate Detection

步骤5：测试并验证检测效果

bash
undefined
bash
undefined

Restart Fail2ban

Restart Fail2ban

sudo systemctl restart fail2ban
sudo systemctl restart fail2ban

Verify jails are active

Verify jails are active

sudo fail2ban-client status sudo fail2ban-client status sshd sudo fail2ban-client status portscan
sudo fail2ban-client status sudo fail2ban-client status sshd sudo fail2ban-client status portscan

Test the port scan filter with a regex check

Test the port scan filter with a regex check

sudo fail2ban-regex /var/log/kern.log /etc/fail2ban/filter.d/portscan.conf
sudo fail2ban-regex /var/log/kern.log /etc/fail2ban/filter.d/portscan.conf

Test the HTTP scan filter

Test the HTTP scan filter

sudo fail2ban-regex /var/log/nginx/access.log /etc/fail2ban/filter.d/http-scan.conf
sudo fail2ban-regex /var/log/nginx/access.log /etc/fail2ban/filter.d/http-scan.conf

Simulate a port scan from a test machine (authorized)

Simulate a port scan from a test machine (authorized)

From the test machine:

From the test machine:

nmap -sS -p 1-1000 <target_ip>
nmap -sS -p 1-1000 <target_ip>

Verify the scanner gets banned

Verify the scanner gets banned

sudo fail2ban-client status portscan
sudo fail2ban-client status portscan

Should show the test IP in the banned list

Should show the test IP in the banned list

Check iptables for the ban rule

Check iptables for the ban rule

sudo iptables -L f2b-portscan -n
sudo iptables -L f2b-portscan -n

Unban the test IP

Unban the test IP

sudo fail2ban-client set portscan unbanip <test_ip>
undefined
sudo fail2ban-client set portscan unbanip <test_ip>
undefined

Step 6: Monitor and Maintain

步骤6：监控与维护

bash
undefined
bash
undefined

View real-time ban activity

View real-time ban activity

sudo tail -f /var/log/fail2ban.log | grep -E "Ban|Unban"
sudo tail -f /var/log/fail2ban.log | grep -E "Ban|Unban"

Generate daily summary report

Generate daily summary report

sudo tee /usr/local/bin/fail2ban-report.sh << 'SCRIPT' #!/bin/bash echo "=== Fail2ban Daily Report $(date) ===" echo "" echo "Active Jails:" sudo fail2ban-client status | grep "Jail list" echo "" echo "Currently Banned IPs:" for jail in $(sudo fail2ban-client status | grep "Jail list" | sed 's/.*://;s/,//g'); do count=$(sudo fail2ban-client status "$jail" | grep "Currently banned" | awk '{print $NF}') if [ "$count" -gt 0 ]; then echo " $jail: $count banned" sudo fail2ban-client status "$jail" | grep "Banned IP" fi done echo "" echo "Last 24 hours - Ban count by jail:" grep "Ban " /var/log/fail2ban.log | grep "$(date +%Y-%m-%d)" | awk '{print $NF}' | sort | uniq -c | sort -rn SCRIPT chmod +x /usr/local/bin/fail2ban-report.sh
sudo tee /usr/local/bin/fail2ban-report.sh << 'SCRIPT' #!/bin/bash echo "=== Fail2ban Daily Report $(date) ===" echo "" echo "Active Jails:" sudo fail2ban-client status | grep "Jail list" echo "" echo "Currently Banned IPs:" for jail in $(sudo fail2ban-client status | grep "Jail list" | sed 's/.*://;s/,//g'); do count=$(sudo fail2ban-client status "$jail" | grep "Currently banned" | awk '{print $NF}') if [ "$count" -gt 0 ]; then echo " $jail: $count banned" sudo fail2ban-client status "$jail" | grep "Banned IP" fi done echo "" echo "Last 24 hours - Ban count by jail:" grep "Ban " /var/log/fail2ban.log | grep "$(date +%Y-%m-%d)" | awk '{print $NF}' | sort | uniq -c | sort -rn SCRIPT chmod +x /usr/local/bin/fail2ban-report.sh

Schedule daily report

Schedule daily report

echo "0 8 * * * root /usr/local/bin/fail2ban-report.sh | mail -s 'Fail2ban Report' security@example.com" | sudo tee /etc/cron.d/fail2ban-report
echo "0 8 * * * root /usr/local/bin/fail2ban-report.sh | mail -s 'Fail2ban Report' security@example.com" | sudo tee /etc/cron.d/fail2ban-report

Persist iptables rules across reboots

Persist iptables rules across reboots

sudo apt install iptables-persistent sudo netfilter-persistent save
undefined
sudo apt install iptables-persistent sudo netfilter-persistent save
undefined

Key Concepts

核心概念

TermDefinition
JailFail2ban configuration unit that combines a filter (what to detect), an action (what to do), and parameters (thresholds, timing) for a specific service
FilterRegular expression patterns that Fail2ban applies to log files to identify failed authentication attempts, scanning, or other malicious activity
Recidive JailMeta-jail that monitors Fail2ban's own log for repeat offenders, applying escalating ban durations to IPs banned multiple times
Find TimeTime window in seconds during which Fail2ban counts matching log entries; maxretry failures within findtime triggers a ban
Ban ActionCommand or script executed when an IP is banned, typically adding firewall rules but extensible to webhooks, SIEM alerts, or blocklist updates
Ignore IPWhitelist of IP addresses or CIDR ranges that are never banned, preventing lockout of trusted networks and monitoring systems
术语定义
JailFail2ban的配置单元，针对特定服务整合了过滤器（检测内容）、操作（执行动作）和参数（阈值、时间设置）
FilterFail2ban应用于日志文件的正则表达式模式，用于识别失败的认证尝试、扫描或其他恶意活动
Recidive Jail元Jail，监控Fail2ban自身日志中的重复违规者，对多次被封禁的IP应用递增的封禁时长
Find TimeFail2ban统计匹配日志条目的时间窗口（秒）；在该窗口内达到maxretry次数的失败尝试会触发封禁
Ban ActionIP被封禁时执行的命令或脚本，通常用于添加防火墙规则，也可扩展为Webhook告警、SIEM告警或更新黑名单
Ignore IP永不被封禁的IP地址或CIDR范围白名单，防止可信网络和监控系统被误封

Tools & Systems

工具与系统

  • Fail2ban 0.11+: Log-parsing intrusion prevention framework that bans IP addresses based on pattern matching across any log file
  • iptables/nftables: Linux kernel firewall used by Fail2ban ban actions to block offending IP addresses at the network layer
  • fail2ban-regex: Testing utility for validating filter regular expressions against actual log files before deploying to production
  • fail2ban-client: Command-line management tool for querying jail status, manually banning/unbanning IPs, and reloading configuration
  • rsyslog/syslog-ng: System logging daemons that generate the log files Fail2ban monitors for attack detection
  • Fail2ban 0.11+: 日志解析型入侵防范框架，基于任意日志文件中的模式匹配封禁IP地址
  • iptables/nftables: Linux内核防火墙，被Fail2ban的封禁操作用于在网络层拦截违规IP地址
  • fail2ban-regex: 测试工具，用于在部署到生产环境前验证过滤器正则表达式与实际日志文件的匹配情况
  • fail2ban-client: 命令行管理工具，用于查询Jail状态、手动封禁/解封IP以及重新加载配置
  • rsyslog/syslog-ng: 系统日志守护进程，生成Fail2ban用于攻击检测的日志文件

Common Scenarios

常见场景

Scenario: Defending a Public-Facing Web Server Against Automated Scanning

场景：保护面向公网的Web服务器免受自动扫描

Context: A company runs a public web server that receives thousands of automated scan attempts daily from bots probing for vulnerable paths (/wp-admin, /phpmyadmin, /.env). The security team wants to automatically block scanners while allowing legitimate traffic. The server runs Nginx on Ubuntu 22.04.
Approach:
  1. Install Fail2ban and configure it to monitor Nginx access logs for scanning patterns (404/403 responses to known vulnerability paths)
  2. Create a custom 
    http-scan
    filter matching common scanner signatures and vulnerability probing URIs
  3. Set maxretry to 10 within a 5-minute findtime, with a 1-hour bantime for first offense
  4. Enable the recidive jail to escalate ban duration to 7 days for repeat offenders
  5. Configure webhook notifications to Slack for real-time visibility of banning activity
  6. Add iptables logging rules for SYN packets to closed ports to detect port scanning
  7. Create a daily report script showing banned IPs, attack patterns, and geographic distribution
Pitfalls:
  • Setting maxretry too low (e.g., 1-2), causing legitimate users who mistype URLs to get banned
  • Not whitelisting monitoring systems (Nagios, UptimeRobot) that may trigger filters with their health checks
  • Forgetting to persist iptables rules, losing all bans after a reboot
  • Not testing filters with fail2ban-regex before deploying, resulting in no matches or excessive false positives
背景: 某公司运行一台面向公网的Web服务器，每天收到数千次来自机器人的自动扫描尝试，这些机器人会探测易受攻击的路径（如/wp-admin、/phpmyadmin、/.env）。安全团队希望自动拦截扫描器，同时允许合法流量通过。该服务器在Ubuntu 22.04上运行Nginx。
实施方法:
  1. 安装Fail2ban并配置其监控Nginx访问日志中的扫描模式（针对已知漏洞路径的404/403响应）
  2. 创建自定义
    http-scan
    过滤器，匹配常见扫描器特征和漏洞探测URI
  3. 设置5分钟检测窗口内最多10次失败尝试，首次违规封禁1小时
  4. 启用recidive Jail，对重复违规者将封禁时长提升至7天
  5. 配置Slack Webhook通知，实现封禁活动的实时可见性
  6. 添加iptables日志规则，记录发送到关闭端口的SYN数据包以检测端口扫描
  7. 创建每日报告脚本，展示被封禁IP、攻击模式和地域分布
常见陷阱:
  • 将maxretry设置过低（如1-2次），导致输入错误URL的合法用户被误封
  • 未将监控系统（如Nagios、UptimeRobot）加入白名单，这些系统的健康检查可能触发过滤器
  • 忘记持久化iptables规则，重启后所有封禁规则丢失
  • 部署前未使用fail2ban-regex测试过滤器，导致无匹配或过多误报

Output Format

输出格式

undefined
undefined

Fail2ban Port Scan Defense Report

Fail2ban端口扫描防御报告

Server: web-prod-01 (203.0.113.50) Reporting Period: 2024-03-15 00:00 to 2024-03-16 00:00 UTC
服务器: web-prod-01 (203.0.113.50) 报告周期: 2024-03-15 00:00 至 2024-03-16 00:00 UTC

Active Jails

活跃Jail

JailFilterMax RetryBan TimeCurrently Banned
sshdsshd32 hours12 IPs
portscanportscan1024 hours47 IPs
http-scanhttp-scan101 hour89 IPs
recidiverecidive37 days8 IPs
JailFilter最大重试次数封禁时长当前封禁IP数
sshdsshd32小时12个IP
portscanportscan1024小时47个IP
http-scanhttp-scan101小时89个IP
recidiverecidive37天8个IP

24-Hour Summary

24小时汇总

  • Total ban events: 347
  • Unique IPs banned: 156
  • Top attacking country: CN (67 IPs), RU (34 IPs), US (21 IPs)
  • Most targeted service: HTTP scanning (214 bans)
  • Recidive escalations: 8 IPs banned for 7 days
  • 总封禁事件: 347次
  • 被封禁唯一IP数: 156个
  • 攻击来源Top国家: CN（67个IP）、RU（34个IP）、US（21个IP）
  • 最常被攻击的服务: HTTP扫描（214次封禁）
  • Recidive递增封禁: 8个IP被封禁7天

Top 5 Banned IPs

Top 5被封禁IP

IP AddressJailBan CountFirst SeenLast Seen
45.33.32.156portscan1200:1523:47
198.51.100.23http-scan802:3018:22
203.0.113.100sshd605:1221:33
undefined
IP地址Jail封禁次数首次出现时间末次出现时间
45.33.32.156portscan1200:1523:47
198.51.100.23http-scan802:3018:22
203.0.113.100sshd605:1221:33
undefined