|
Posted by Roger Abell [MVP] on July 2, 2006, 11:16 am
Please log in for more thread options That is a tough one, and is example of why IPS (intrusion prevention
systems) were developed, to monitor and react to types of unwanted
network activity.
>I don't quite sure how to stop it. The bot starts its run 1 or twice a
>week. Everytime it comes with different IP addresses.
>
>
>> It is possibly using tcp 80 to a page that requires authentication.
>> If so, find the IP from the IIS logs, or from the security event log,
>> and define a rule to block all traffic from that IP (and then later
>> remember to remove after they have given up and the IP has
>> possibly been released to someone else)
>>
>> --
>> Roger Abell
>> Microsoft MVP (Windows Server : Security)
>>
>>> Hi,
>>>
>>> Would you teach me how to prevent a bot that is trying to login as Admin
>>> to IIS every second for couple hours please?
>>> Thanks!
>>>
>>>
>>> The firewall doesn't seem to do anything.
>>> Am I missing something?
>>>
>>>
>>>
>>
>>
>
>
| 
XML Sitemap