IP Monitoring & Reputation

Overview #

IP Monitoring provides real-time reputation checking and threat intelligence for IP addresses accessing your website.

Features #

Real-time IP Reputation Checking #

• VirusTotal Integration: Checks IPs against 70+ security vendors
• AbuseIPDB Integration: Community-driven IP reputation database
• DNS Blacklist Checking: Queries major spam and malware blacklists
• Geolocation Services: Identifies IP location and ISP information

Threat Intelligence Sources #

• Spamhaus: Leading anti-spam organization
• SpamCop: Community spam reporting service
• SURBL: URI reputation service
• Barracuda: Enterprise security reputation
• Composite Blocking List (CBL): Automated blacklist

Automated Response #

• Automatic Blocking: High-risk IPs blocked immediately
• Progressive Penalties: Increasing restrictions for suspicious IPs
• Whitelist Protection: Ensures legitimate IPs aren’t blocked
• Manual Override: Admin can manually block/unblock IPs

IP Monitoring Dashboard #

Server Reputation Status #

The dashboard shows your server’s reputation across multiple services:

🟢 VirusTotal: Clean (0/70 vendors flagged)

🟢 AbuseIPDB: Clean (0% abuse confidence)

🟢 Spamhaus: Not Listed

🟢 SpamCop: Not Listed

🟡 SURBL: Monitoring

Recent IP Activity #

• Blocked IPs: Recently blocked malicious IPs
• Suspicious Activity: IPs flagged for monitoring
• Geographic Distribution: Map of visitor locations
• Top Threats: Most common threat types blocked

Configuration #

API Setup #

1. VirusTotal API:

• Sign up at virustotal.com
• Get your free API key
• Enter in Zxeion Security → Plugin Security
• Save settings

2. AbuseIPDB API:

• Register at abuseipdb.com
• Generate API key
• Add to plugin settings
• Configure checking frequency

Monitoring Settings #

✅ Enable IP Reputation Monitoring

✅ Check New IPs Automatically

✅ Block High-Risk IPs

✅ Log All IP Checks

⚪ Monitor Server IP Reputation (optional)

✅ Email Alerts for Blacklisted Server

Blocking Thresholds #

• VirusTotal: Block if 3+ vendors flag as malicious
• AbuseIPDB: Block if abuse confidence > 75%
• DNS Blacklists: Block if listed on 2+ major blacklists
• Geographic: Optional country-based blocking

Understanding IP Reputation #

Risk Levels #

• 🟢 Clean: No reputation issues detected
• 🟡 Suspicious: Some indicators of potential issues
• 🟠 High Risk: Multiple reputation issues
• 🔴 Malicious: Confirmed malicious activity

Reputation Factors #

• Malware Hosting: IP hosts or distributes malware
• Spam Source: IP sends spam emails
• Botnet Member: IP is part of a botnet
• Scanning Activity: IP performs network scans

Brute Force: IP attempts password attacks