Question Best Practices: Blocking A Large Number of IP Addresses

[tetrahall]

Server operating system version

Centos 7.7

Plesk version and microupdate number

Plesk OBSIDIAN 18.0.44

Hello,

I'm getting very suspicious visits from a large number of IP addresses - something like 3000 - 4000 on a daily basis. I've considered the following options:

.htaccess is an option, but I am advised against it because it slows the website due to processing overhead

Plesk Firewall Blocking Countries: It doesn't always work. For example, I had some suspicious IP addresses from Lithuania and Italy. I added LT and IT but it didn't work for me - still getting visitors from both countries.

IP Tables: It involved adding many "rules" and to be honest I'm not familiar with this method

I was just wondering if there is something more straightforwards, like a BLACK LIST, where I can copy and paste the list of IP address in some form field.

Please advise

 

[scsa20]

GeoIP blocking relies on a database to be up to date so some IPs assigned to a country could still slip by. Default database is by DB-IP but you can change it to Maxmind by following the instructions at https://support.plesk.com/hc/en-us/...urce-for-blocking-countries-in-Plesk-Firewall

As for IPTables, Plesk firewall basically uses IPTables anyways so you could technically block IP addresses by utilizing the Plesk firewall itself.

The other method is utilizing ModSecurity, you can refer to https://support.plesk.com/hc/en-us/...or-whitelist-specific-countries-through-Plesk for how to set it up.