Does not appear to be kept up to date
We recently subscribed to this rule to try and block carding botnets from hitting our website. We were attacked a few days after subscribing and applying the rule to our WAF - of the more than 250,000 requests this rule blocked 53. Of the 1400 distinct IPs hitting us, this rule blocked 1.
- Leave a Comment |
- Mark review as helpful
Its work
Best set of rules for AWS WAF. Works fine.
The main problem is the speed of updating the reputation lists. Several hours pass from the moment a bot appears until it is blacklisted
Too broad without granular controls
I really wanted to be able to use this but there doesn't appear to be any granular control, e.g the ability to include known attack IPs but exclude IPs on lists for not having reverse DNS on the IP they send mail from. In our brief examination of how the list would work (using it to count vs block) it would have been blocking clients we would have wanted to allow.
Having the ability to turn on/off specific inclusion criteria in the list, or the vendor providing various confidence level lists would allow me to possibly use this.