Blocking policies
This page describes the blocking policies behind the observations and explains how they are evaluated.
Active configuration
This page summarizes the active configuration as of November 1, 2026, for public reference. The collection source labels are freebsd and oci. Each uses 15 jails: 6 for traditional services and 9 for scanner mitigation.
Two evaluation methods
| Method | Scope | Blocking criterion |
|---|---|---|
| Repeated detection | SSH, mail authentication, HTTP, repeat offenders | Number of matches within a configured detection window |
| Single detection | Configured HTTP scanner signatures | Permanent ban on one match |
A “match” here means that a log line matches a jail filter. Aggregation and exclusion settings can make this differ from a simple request count.
Shared scanner settings
maxretry = 1
findtime = 10m
bantime = -1
bantime.increment = falseThe nine configured jails ban permanently on a single match. bantime = -1 means no automatic expiry. The 10-minute detection window does not represent how long the ban lasts.
The blocking scope covers HTTP/HTTPS over TCP and UDP on ports 80 and 443. freebsd applies it with PF and oci with nftables. Detection and firewall enforcement run in each source’s Fail2ban; this public API does not distribute blocking instructions.
Environment-dependent judgment
On services that legitimately use administration screens, WebDAV, WordPress, PHP, or extended HTTP methods, the same request can be normal. The conditions listed here are the operating standards of the collection sources, not recommended settings that can be applied unchanged to any site.
Administrative exclusion networks, endpoints, credentials, and internal log contents are not published. The public description and the complete configuration managed on each server are kept separate.