Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!

cpHulk & Firewall not blocking IP

Discussion in 'Security' started by Dan70, Mar 20, 2019.

  1. Dan70

    Dan70 Active Member

    Joined:
    May 18, 2016
    Messages:
    26
    Likes Received:
    3
    Trophy Points:
    3
    Location:
    Hamburg
    cPanel Access Level:
    Root Administrator
    HI, am very frustrated... have a bot scavenging my site, always same IP...I several times input the IP and then it is blocked for a few hours, only to get back on my site shortly after, still blacklisted... seems cpHulk is not working
    grrr....
    Thx
    Dan
     
  2. Infopro

    Infopro cPanel Sr. Product Evangelist Staff Member

    Joined:
    May 20, 2003
    Messages:
    16,826
    Likes Received:
    476
    Trophy Points:
    583
    Location:
    Pennsylvania
    cPanel Access Level:
    Root Administrator
    Twitter:
    Are you adding the IP address to CSF? (Assuming you are using CSF that is.)
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  3. Dan70

    Dan70 Active Member

    Joined:
    May 18, 2016
    Messages:
    26
    Likes Received:
    3
    Trophy Points:
    3
    Location:
    Hamburg
    cPanel Access Level:
    Root Administrator
    HI info, am blacklisting it in cpHulk and had 2 or 3 times added it to deny access in csf ... same thing...works foir a few hours... the bot does not even change its IP
    thx
     
  4. Infopro

    Infopro cPanel Sr. Product Evangelist Staff Member

    Joined:
    May 20, 2003
    Messages:
    16,826
    Likes Received:
    476
    Trophy Points:
    583
    Location:
    Pennsylvania
    cPanel Access Level:
    Root Administrator
    Twitter:
    Adding the IP to CSF should stop it from accessing anything on the server.

    Silly question time I guess, are you sure CSF is enabled and operating as expected?
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  5. Dan70

    Dan70 Active Member

    Joined:
    May 18, 2016
    Messages:
    26
    Likes Received:
    3
    Trophy Points:
    3
    Location:
    Hamburg
    cPanel Access Level:
    Root Administrator
    Hi info, thx... guess question is not so silly I guess :)
    but it says: "
    Firewall Status: Enabled and Running"
    and shouldnT at least cpHulk stop it ... for longer than a few hours?
    Thx
     
  6. Dan70

    Dan70 Active Member

    Joined:
    May 18, 2016
    Messages:
    26
    Likes Received:
    3
    Trophy Points:
    3
    Location:
    Hamburg
    cPanel Access Level:
    Root Administrator
    find this in my csf
    Edit /etc/csf/csf.deny

    180.250.162.9 # lfd: (sshd) Failed SSH login from 180.250.162.9 (23.100.232.233ID/Indonesia/-): 5 in the last 3600 secs - Tue Mar 19 04:05:26 2019
    the 23.100.232.233 is the IP I desperately try to block and cpanel has a love affair with it
    I had also added this IP in this table 2 days ago...to no avail
    thx
    Dan
     
  7. Dan70

    Dan70 Active Member

    Joined:
    May 18, 2016
    Messages:
    26
    Likes Received:
    3
    Trophy Points:
    3
    Location:
    Hamburg
    cPanel Access Level:
    Root Administrator
    so it also seems to try to login to root?
    what does this notation 180.250.162.9 (23.100.232.233ID/Indonesia/-) mean?

    rerouted IP?
    thx
    Dan
     
  8. Infopro

    Infopro cPanel Sr. Product Evangelist Staff Member

    Joined:
    May 20, 2003
    Messages:
    16,826
    Likes Received:
    476
    Trophy Points:
    583
    Location:
    Pennsylvania
    cPanel Access Level:
    Root Administrator
    Twitter:
    I'm not sure. Surely you're getting emails from the server to let you know about the block, right? Do those emails say temp block or Permanent Block?
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  9. Dan70

    Dan70 Active Member

    Joined:
    May 18, 2016
    Messages:
    26
    Likes Received:
    3
    Trophy Points:
    3
    Location:
    Hamburg
    cPanel Access Level:
    Root Administrator
    Hi info, thx...no, dont get these blocked emails, would drown
    sorry for the deviation...
    still I wonder why cphulk cannot keep one IP off my server?
    thx
    Dan
     
  10. Infopro

    Infopro cPanel Sr. Product Evangelist Staff Member

    Joined:
    May 20, 2003
    Messages:
    16,826
    Likes Received:
    476
    Trophy Points:
    583
    Location:
    Pennsylvania
    cPanel Access Level:
    Root Administrator
    Twitter:
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  11. Dan70

    Dan70 Active Member

    Joined:
    May 18, 2016
    Messages:
    26
    Likes Received:
    3
    Trophy Points:
    3
    Location:
    Hamburg
    cPanel Access Level:
    Root Administrator
    HI info, thx a million!
    D
     
    Infopro likes this.
Loading...

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice