Auto Ban & Honeypot

Auto Ban

Triggers when an IP hits 3+ suspicious signatures in a short window.

Signatures detected:
- sqlmap, nikto, nmap, masscan
- hydra, metasploit, dirb, gobuster
- Custom patterns you define

After 3 hits → IP auto-banned across all servers.

Auto Honeypot

Triggers when a request hits certain paths:

Default honeypots:
- /wp-admin (WordPress)
- /phpmyadmin (phpMyAdmin)
- /.git (git repository)
- /config.php
- /xmlrpc.php
- /.env (environment file)

Request hits trap → logged + IP blocked.

Why honeypots work

Attackers can't resist "finding" admin panels. They waste time on fake pages. You learn what they're looking for.

Configuring

Settings → Advanced Control. Or create custom rules in Firewall tab.