[CPANEL-27445] cPHulk Countries blacklist not working?

apaulo

• May 14, 2019 02:23

Hi, I have cPHulk Brute Force Protection On and an extensive list of blacklisted countries. When I wake up this morning I have over 6000 "? Excessive Number of Failed Login Attempts from 103.231.xxx.xxx (Iran, Islamic Republic of:IR)" warnings - not only from Iran, but also from several other countries included in the blacklist - most (if not all) from countries included on my blacklist for months. Also over 27000 one-day-blocks have been created by CPanel for the suspicious IPs. Is there a known issue with cPHulk? Thanks. Alexandre

• 

  cPanelLauren

  • June 03, 2019 19:48

  Hi @tommyxv Can you please open a ticket using the link in my signature? Once open please reply with the Ticket ID here so that we can update this thread with the resolution once the ticket is resolved. Thanks!

  0
• 

  ycki

  • June 04, 2019 00:58

  Update made, error apparently fixed. Thank you staff!

  0
• 

  blallard

  • June 10, 2019 15:46

  I have been experiencing this same issue for the past week (only checked this forum today) ... multiple one day blocks being created (often for the same IP address) for countries that have been blacklisted. There are currently over 46,000 entries in the one day blocks list and I have received several thousand notification emails in the past 24 hours alone. I have version 80.0.13 right now. Is there actually any fix for this issue?

  0
• 

  cPanelLauren

  • June 10, 2019 16:21

  Hello @blallard This should have been resolved in v80.0.12 if it is still occurring I'd suggest opening a ticket so we can look into the issue further.

  0
• 

  DallasClarke

  • December 10, 2020 20:12

  Blocking countries and domains is a useless feature in cpanel, I dont understand why it is still there. It doesn't do what it says.

  0
• 

  cPRex Jurassic Moderator

  • December 14, 2020 20:00

  @DallasClarke - can you let me know what specific issues you're seeing that tool so I can do some testing?

  0
• 

  compufixpro

  • May 27, 2021 21:43

  I don't know if I have to open a new thread, but here I am in May of 2021 ((CENTOS 7.9 kvm [platinum]

  0
• 

  cPRex Jurassic Moderator

  • May 28, 2021 13:06

  Hey there, @compufixpro ! The short answer is that no country-code system is perfect - there just aren't master lists of IPs and what country they originate from, so there is a little bit of guesswork involved from the GEO location tools. If you're seeing enough false positives or false negatives to cause concern, it might be better to disable that function.

  0

Please sign in to leave a comment.