Support

Hi,

Is it possible to determine more about the reasons a particular IP was blocked as "MUA Shield"? How is it determined the user-agent is malicious?

We're seeing many IPs being blocked based on what appears to be regular usage of our site. Here is an example where RSS feed aggregators were downloading our RSS feeds:

https://linuxsecurity.com/advisories/ubuntu?format=feed&type=rss

Here is the corresponding access_log entry:
173.212.222.47 - - [03/Apr/2019:20:50:22 -0400] "GET /advisories/ubuntu?format=feed&type=rss HTTP/1.1" 500 689 "http://www.linuxsecurity.com/static-content/ubuntu.rss" "FreshRSS/1.6.3 (Linux; http://freshrss.org) SimplePie/1.4-dev-FreshRSS" 0/299651 541/1215/689 linuxsecurity.com

Is the MUA Shield some type of regex or a list of known-malicious scripts? Does it depend on the number of times an attempt was made to download the page?

I have more than 9500 IPs blocked since just two months ago.

Where is the log of all IPs that have been blocked on the filesystem so I can go through it manually? Are there more specific details why a particular IP was blocked?

This ticket has been automatically closed. All tickets which have been inactive for a long time are automatically closed. If you believe that this ticket was closed in error, please contact us.