Support

 Hi
Just a quick question to clarify:
I have enabled HTTP:BL filtering with the threat level to block set really low at 8
Daily I see the blocked access to ip's above this threat level so all appears to be working well.
However, using Content Statistics I can see all visits to the site and the pages they are visiting.
I noticed a high level of traffic from Ukraine and investigated further.
In the past two days I have had 86 visits using 6 different IP addresses. The Ukrainian IP addresses are typically in the region of threat level 45, but none of them appear on the Admin Tools security exceptions log, whislt other ip's from elsewhere are being blocked with lower threat levels.
I know that I could block all access from Ukraine, but wanted to ask for some clarification as to why known spammer ip addresses are able to browse the site without an exception being created by Admin Tools.

Many thanks Graham

Yes I have suspicious IP's checked.
The answer is the maximum age of accepted HTTP:BL results, which I have set at 100 days.
If you were to check 91.207.8.46 you would see that although the threat rating is 50 the Spider Last Seen is 2014-12-04 and Project Honeypot comments: "This IP has not seen any suspicious activity within the last 3 months. This IP is most likely clean and trustworthy now." (Although we know that it isn't, and just hasn't been caught again yet.)
I am confident that Admin tools will quickly block the IP if there is any malicious attempt on the site.
I feel a Ukrainian Geo block coming on as it ruins the site stats with so many nefarious visits.

Great tools guys, would be in a World of pain without them.