splittingred/Rampart — pull request #3 by Mark-H (2012-01-17 05:04:49+00:00)
Title: Ability to monitor incoming requests against the ban list.

Update plugin to monitor requests against the ban list, allowing to deny access to the site entirely at a certain threshold of ban matches. Threshold defaults to 5, so it needs 5 ban matches before blocking access to the site.

A ban match is anything from a spam comment to an StopForumSpam or HoneyPot match (if enabled), and I've expanded Notify404 to add a ban match when it finds a known hack attempt / sniffing - specifically the Evo reflect_base exploit and various synonyms of phpmyadmin. Valid phpmyadmin requests (just in case) wouldn't be picked up by MODX, so Notify404 wouldn't add a ban match for that.

*note* I've only tested this locally (so far so good!) on a 2.2 install from Git. Will be deploying & further testing this (specifically with Notify404) on a 2.1 install (my own site) and an older 2.2 (client) later this/next week. Both are being troubled by scriptkiddies sniffing for phpmyadmin, so should be a good test case.