Why Am I Listed?

Gnoppix Services RBL Listing Policy & Criteria

Every day, system logs record massive volumes of bots, crackers, and hackers attempting to breach network defenses and crack access passwords. Active defense measures are now enforced against any IP address seeking to cause harm. Why else would external systems query SSL connection versions, attempt to bypass passwords, or scan web directories for credentials? Any such actions result in that specific IP address being immediately and permanently added to a real-time blocklist. The rule is simple: any attempt to cause harm results in an immediate block.

1. Core Listing Triggers

An IP address will be dynamically or manually listed in the RBL if it is detected performing any of the following activities against Gnoppix infrastructure.

🛡️

Brute-Force & Authentication Abuse

Definition: Automated attempts to gain unauthorized access to Gnoppix systems, user accounts, or administrative panels.

Triggers:

  • Exceeding a maximum threshold of failed SSH logins (e.g., 5 failures within 5 minutes).
  • Repetitive failed HTTP basic auth, API token authentication, or web portal login attempts.
  • SMTP/IMAP/POP3 authentication failures targeting Gnoppix mail relays.
🌐

Denial of Service (DoS) & Resource Exhaustion

Definition: Intentional degradation of Gnoppix service availability through excessive request volume.

Triggers:

  • Layer 4/7 DDoS: High-frequency, repetitive TCP connection flooding or HTTP/HTTPS request rates that bypass normal API rate limits.
  • Explosive Mirror Scraping: Maliciously opening massive concurrent connections to download ISOs or repository files with the clear intent to saturate mirror bandwidth.
🔍

Reconnaissance & Vulnerability Scanning

Definition: Unauthorized probing of Gnoppix infrastructure to map open ports or discover exploitable vulnerabilities.

Triggers:

  • Port Scanning: Sequential or aggressive random probing of TCP/UDP ports within a short time window.
  • Web Application Vulnerability Scanning: Automated scanning for common exploits (e.g., looking for .env, wp-login.php, config.php, or directory traversal paths) detected via Nginx/Apache logs.
🪲

Exploitation & Malicious Payloads

Definition: Active attempts to compromise Gnoppix services by injecting malicious data or bypassing security controls.

Triggers:

  • Submission of SQL Injection (SQLi), Cross-Site Scripting (XSS), or Remote Code Execution (RCE) vectors to Gnoppix APIs or web interfaces.
  • Attempts to upload unauthorized files, malware, or webshells to any service.
📧

Mail & Communication Abuse

Definition: Utilizing mail infrastructure to target Gnoppix users or system administrators with unsolicited or dangerous communications.

Triggers:

  • Spam distribution or attempting to use Gnoppix mail infrastructure as an open relay.
  • Harvesting email addresses or heavy dictionary attacks against local mailboxes.

2. Technical Detection & Automated Listing Rules

To maintain high accuracy and minimize false positives, the RBL utilizes a tiered system backed by log-parsing daemons (like Fail2Ban) and firewall integration.

Abuse Type Detection Vector Initial Ban Duration
Port Scanning / Probing Firewall drops / Conn limit traps 24 Hours
Auth Failure (SSH/API/Mail) Log parsing (auth.log, API gateway) 12 Hours
Layer 7 DoS / Scraping Nginx/Apache rate-limit breaches 12 Hours
Active Exploitation (RCE/SQLi) WAF / Web Server Error Triggers Permanent (Manual Review)
Known Botnets/Malicious Relays Threat intel sync Immediate Listing

3. Delisting & Expiration Policy

An RBL is only as good as its aging-out mechanism. To prevent stale listings and accommodate dynamic IP allocations, the following policy applies.

⏱️ Automated Expiration (Aging)

  • First-time offenders: The IP is automatically purged from the zone file after the initial ban duration expires (typically 12–24 hours).
  • Repeat offenders: If an IP breaks rules immediately after a previous expiration, the ban duration is multiplied (e.g., 7 days, then 30 days).

⚖️ Manual Removal Request (Delisting)

If a legitimate user or system administrator suffers collateral damage (e.g., behind a shared NAT or clean dynamic IP), a clear delisting path is provided:

  1. Self-Service Lookup: A public web lookup interface where users can query their IP.
  2. Delisting Criteria: If listed for minor infractions (like minor rate-limiting), a "Request Delisting" button clears the entry immediately after passing a basic CAPTCHA (to prevent bot automated delisting).
  3. Manual Appeal: For severe infractions (exploitation/DDoS), the operator must submit a request verifying that the source machine has been cleaned, secured, or the abusive user terminated.

DNS Return Codes

The RBL zone answers standard DNS queries with specific return codes so that integrated mail servers or API firewalls can choose how aggressively to drop traffic.

Return Code Meaning
127.0.0.2 Generic block
x.x.x.x Brute-force
x.x.x.x DDoS / resource exhaustion