Hello,

I very much appreciate the work going into IPBan.

I noticed with the latest version, it removed a feature of the older IPBan.

I don't see a banlog.txt file that I used to use with my scripts for other tasks (updating .htaccess files).

What does IPBan now use to store banned IPs and can I reference this storage method with other scripts?

HI Jeff, when I start the app, it errors in the console and says it can't create event viewer because, I'm pretty sure, it is looking for "C:/Users/Jeff\Documents" folder.

Any way the CS is erroring on line 194 of IPBanWindowsEventViewer class.

for me anyway.

I found that I also had to set "Network Security: LAN Manager authentication level" to "Send NTLMv2 response only. Refuse LM & NTLM". The initial setting was "Not Defined" and I could no longer connect through RDP after setting "Network Security: Restrict NTLM: Incoming NTLM traffic" to "Deny all accounts". This is on Windows Server 2008 R2.

Hello,

Let me first thank you for making this great script. I've downloaded the latest version from your site on Nov 25/2012.

Download: AnyCPU version
OS: Windows 2008 R2 SP1 with .NET 4 installed x64 running IIS 7.5 / SQL Express

Nothing else runs on this server, it was just added few days ago.

The first time I was able to install and run the service. Then suddenly it stopped working, and any subsequent install/delete/reinstall and start fail with the following error:

Application: ipban.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.NullReferenceException
Stack:
at IPBan.IPBanService.DeleteRule()
at IPBan.IPBanService.ProcessBanFileOnStart()
at IPBan.IPBanService.Initialize()
at IPBan.IPBanService.ServiceThread()
at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
at System.Threading.ThreadHelper.ThreadStart()

I hope you can shed some light on this error...

Thank you,

Tamouh

The service is still not starting after applying the new build.

Hi there!

This is awesome tool to protect the servers with RDP opened. Congrats!

May be a new feature is to protect the PPTP 1723 like 3389.

Cheers!

Hello,

it would be useful if in the firewall rules create by IPBan, the "Group" property is set.

That is adding the following line

rule.Grouping = "IPBan";

between line 77 and 78 of IPBanWindowsFirewall.cs.

The information about the firewall rule group is useful for example for the "Secure Rules" feature of "Windows Firewall Control" application.

Regarding the banlog.txt creation i think that there is an error in the code. On line 55 of IPBanService.cs the list of IP that need to be saved is stored inside the variable ipBlockerDate and not inside the variable ipBlocker.

With the current code every time an IP is banned all the IP in memory, including the ones which have a number of failed login below the FailedLoginAttemptsBeforeBan threshold, are saved inside the banlog.txt. Then if the IPBan service is restarted and the BanFileClearOnRestart is set on false, those IP which have not been banned before IPBan restart (that is the IP which were inside ipBlocker but not inside ipBlockerDate) are now banned (when IPBan restart) inside the function ProcessBanFileOnStart.

Generally i think that the BanFileClearOnRestart features need to be improved, storing inside the banlog.txt for each IP also the datetime when the ban occurred. Then inside ProcessBanFileOnStart this stored date should be loaded and used instead of DateTime.UtcNow for each banned IP.

If you want new features or have bug reports, please consider donating. I make very little money from this project.

I've spent many hundreds of hours providing this code free of charge for the benefit of all.

Thank you.

• Jeff

hi in windows 2012 have this error:

2017-06-27 08:19:45.8561|INFO|FileLogger|Parsing as dns failed '-'
2017-06-27 08:19:45.8561|WARN|FileLogger|Regex (?<ipaddress>.+) did not match any nodes with xpath //Data[@Name='IpAddress']
2017-06-27 08:19:45.8561|WARN|FileLogger|No nodes found for xpath //Data[@Name='Workstation']
2017-06-27 08:19:45.8561|INFO|FileLogger|Processing xml: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-A5BA-3E3B0328C30D}'/><EventID>4625</EventID><Version>0</Version><Level>0</Level><Task>12544</Task><Opcode>0</Opcode><Keywords>0x8010000000000000</Keywords><TimeCreated SystemTime='2017-06-27T06:19:23.687982300Z'/><EventRecordID>12950596</EventRecordID><Correlation/><Execution ProcessID='568' ThreadID='6796'/><Channel>Security</Channel><Computer>mypcname</Computer><Security/></System><EventData><Data Name='SubjectUserSid'>S-1-0-0</Data><Data Name='SubjectUserName'>-</Data><Data Name='SubjectDomainName'>-</Data><Data Name='SubjectLogonId'>0x0</Data><Data Name='TargetUserSid'>S-1-0-0</Data><Data Name='TargetUserName'>MADRID</Data><Data Name='TargetDomainName'></Data><Data Name='Status'>0xc000006d</Data><Data Name='FailureReason'>%%2313</Data><Data Name='SubStatus'>0xc0000064</Data><Data Name='LogonType'>3</Data><Data Name='LogonProcessName'>NtLmSsp </Data><Data Name='AuthenticationPackageName'>NTLM</Data><Data Name='WorkstationName'></Data><Data Name='TransmittedServices'>-</Data><Data Name='LmPackageName'>-</Data><Data Name='KeyLength'>0</Data><Data Name='ProcessId'>0x0</Data><Data Name='ProcessName'>-</Data><Data Name='IpAddress'>-</Data><Data Name='IpPort'>-</Data></EventData></Event>
2017-06-27 08:19:45.8561|INFO|FileLogger|Parsing as IP failed, checking dns '-'

in windows 2016 work correctly
You can help me Thank you

Miky

Since I've installed MultiOTP on a Windows 10 PC (1809) I see lots of RDP failed connections but they don't appear to be getting blocked, or at least not in the log file.

Do you know if the two are incompatible?

https://github.com/multiOTP/multiotp/wiki

...

I have just downloaded the latest version (1.3.5) and put into place on an up-to-date Windows 2012 R2 Standard Edition server. I have noticed that the IPBan rule in the advanced windows firewall is not automatically created, while I have launched the IPBan program (as an executable or windows service, the result is the same).
Any idea ?
I confirm that the clear ban option on start is set to false in the config file.

Hi,

I was looking forward to install IPBan, but i'm not able to find any IPBan.exe in the repository.
Am I tired or ?
Had no problem to change the local security policy or to unblock the repository files but no way to find the .exe ..

Thank you in advance !

It would be good to see support for whitelisting of ip ranges and CIDR notations, something along the lines of:

IPBanService.cs
Add this function
private void SendMail(string ipAddress, string userName)
{
//config.SendMail
string messaggio = "";
messaggio = "Ban IP: " + ipAddress + " User Name: " + userName;
try
{
MailMessage message = new MailMessage(config.MailFrom, config.MailTo, "IP Banned SERVER: " + config.ServerNameIP , messaggio);
SmtpClient emailClient = new SmtpClient(config.MailSmtp);
System.Net.NetworkCredential smtpUserInfo = new System.Net.NetworkCredential(config.MailFrom, config.MailPW);
emailClient.UseDefaultCredentials = false;
emailClient.EnableSsl = config.MailSSL;
emailClient.Credentials = smtpUserInfo;
emailClient.Send(message);
Log.Write(LogLevel.Info, "Message Sent");
}
catch (Exception ex)
{
Log.Write(LogLevel.Warning, "Send Mail Error {0}", ex.ToString());
}
}

Modify this function
private void ProcessIPAddress(string ipAddress, XmlDocument doc)
{
if (string.IsNullOrWhiteSpace(ipAddress))
{
return;
}

        string userName = null;
        XmlNode userNameNode = doc.SelectSingleNode("//Data[@Name='TargetUserName']");
        if (userNameNode != null)
        {
            userName = userNameNode.InnerText.Trim();
        }

        if (config.IsWhiteListed(ipAddress))
        {
            Log.Write(LogLevel.Info, "Ignoring whitelisted ip address {0}, user name: {1}", ipAddress, userName);
        }
        else
        {
            lock (ipBlocker)
            {
                // Get the IPBlockCount, if one exists.
                IPBlockCount ipBlockCount;
                ipBlocker.TryGetValue(ipAddress, out ipBlockCount);
                if (ipBlockCount == null)
                {
                    // This is the first failed login attempt, so record a new IPBlockCount.
                    ipBlockCount = new IPBlockCount();
                    ipBlocker[ipAddress] = ipBlockCount;
                }

                // Increment the count.
                ipBlockCount.IncrementCount();

                Log.Write(LogLevel.Info, "Incrementing count for ip {0} to {1}, user name: {2}", ipAddress, ipBlockCount.Count, userName);

                // check for the target user name for additional blacklisting checks                    
                bool blackListed = config.IsBlackListed(ipAddress) || (userName != null && config.IsBlackListed(userName));

                // if the ip is black listed or they have reached the maximum failed login attempts before ban, ban them
                if (blackListed || ipBlockCount.Count >= config.FailedLoginAttemptsBeforeBan)
                {
                    // if they are not black listed OR this is the first increment of a black listed ip address, perform the ban
                    if (!blackListed || ipBlockCount.Count >= 1)
                    {
                        if (!ipBlockerDate.ContainsKey(ipAddress))
                        {
                            Log.Write(LogLevel.Error, "Banning ip address: {0}, user name: {1}, black listed: {2}, count: {3}", ipAddress, userName, blackListed, ipBlockCount.Count);
                            ipBlockerDate[ipAddress] = DateTime.UtcNow;
                            ExecuteBanScript();
                           // Add This **********************************
                            if (config.SendMail){
                                SendMail(ipAddress, userName);
                            }
                           //************************************************  
                        }
                    }
                    else
                    {
                        Log.Write(LogLevel.Info, "Ignoring previously banned black listed ip {0}, user name: {1}, ip should already be banned", ipAddress, userName);
                    }
                }
                else if (ipBlockCount.Count > config.FailedLoginAttemptsBeforeBan)
                {
                    Log.Write(LogLevel.Warning, "Got event with ip address {0}, count {1}, ip should already be banned", ipAddress, ipBlockCount.Count);
                }
            }
        }
    }

Modify IPBanConfig.cs
public class IPBanConfig
{
private ExpressionsToBlock expressions;
private int failedLoginAttemptsBeforeBan = 5;
private TimeSpan banTime = TimeSpan.FromDays(1.0d);
private string banFile = "banlog.txt";
private TimeSpan expireTime = TimeSpan.FromDays(1.0d);
private TimeSpan cycleTime = TimeSpan.FromMinutes(1.0d);
private string ruleName = "BlockIPAddresses";
private readonly HashSet whiteList = new HashSet(StringComparer.OrdinalIgnoreCase);
private Regex whiteListRegex;
private readonly HashSet blackList = new HashSet(StringComparer.OrdinalIgnoreCase);
private Regex blackListRegex;
private readonly HashSet allowedUserNames = new HashSet();
private bool banFileClearOnRestart;

   // Add This ********************************************************
    private bool sendMail;
    private bool mailSSL;
    private string mailFrom = "" ;
    private string mailTo = "";
    private string mailSmtp = "";
    private string mailPW = "";
    private string serverNameIP = "";
   // *******************************************************************************


    public IPBanConfig()
    {
        ConfigurationManager.RefreshSection("appSettings");
        ConfigurationManager.RefreshSection("configSections");
        ConfigurationManager.RefreshSection("nlog");
        ConfigurationManager.RefreshSection("ExpressionsToBlock");

        string value = ConfigurationManager.AppSettings["FailedLoginAttemptsBeforeBan"];
        failedLoginAttemptsBeforeBan = int.Parse(value, CultureInfo.InvariantCulture);

        value = ConfigurationManager.AppSettings["BanTime"];
        banTime = TimeSpan.Parse(value, CultureInfo.InvariantCulture);

        value = ConfigurationManager.AppSettings["BanFile"];
        banFile = value;
        if (!Path.IsPathRooted(banFile))
        {
            banFile = Path.GetFullPath(banFile);
        }
        value = ConfigurationManager.AppSettings["BanFileClearOnRestart"];
        if (!bool.TryParse(value, out banFileClearOnRestart))
        {
            banFileClearOnRestart = true;
        }

      // Add this **************************************************************************

        value = ConfigurationManager.AppSettings["SendMail"];
        if (!bool.TryParse(value, out sendMail))
        {
            sendMail = true;
        }

        value = ConfigurationManager.AppSettings["MailSSL"];
        if (!bool.TryParse(value, out mailSSL))
        {
            mailSSL = true;
        }
       // *********************************************************************************************

        value = ConfigurationManager.AppSettings["ExpireTime"];
        expireTime = TimeSpan.Parse(value, CultureInfo.InvariantCulture);

        value = ConfigurationManager.AppSettings["CycleTime"];
        cycleTime = TimeSpan.Parse(value, CultureInfo.InvariantCulture);

        value = ConfigurationManager.AppSettings["RuleName"];
        ruleName = value;

       // Add this ********************************************************************************
        value = ConfigurationManager.AppSettings["MailFrom"];
        mailFrom = value;

        value = ConfigurationManager.AppSettings["MailTo"];
        mailTo = value;

        value = ConfigurationManager.AppSettings["MailPW"];
        mailPW = value;

        value = ConfigurationManager.AppSettings["MailSmtp"];
        mailSmtp = value;

        value = ConfigurationManager.AppSettings["ServerNameIP"];
        serverNameIP = value;            
        //************************************************************************************************


        PopulateList(whiteList, ref whiteListRegex, ConfigurationManager.AppSettings["Whitelist"], ConfigurationManager.AppSettings["WhitelistRegex"]);
        PopulateList(blackList, ref blackListRegex, ConfigurationManager.AppSettings["Blacklist"], ConfigurationManager.AppSettings["BlacklistRegex"]);
        Regex ignored = null;
        PopulateList(allowedUserNames, ref ignored, ConfigurationManager.AppSettings["AllowedUserNames"], null);
        expressions = (ExpressionsToBlock)System.Configuration.ConfigurationManager.GetSection("ExpressionsToBlock");

        foreach (ExpressionsToBlockGroup group in expressions.Groups)
        {
            foreach (ExpressionToBlock expression in group.Expressions)
            {
                expression.Regex = (expression.Regex ?? string.Empty).Trim();
                expression.RegexObject = new Regex(expression.Regex, RegexOptions.IgnoreCase | RegexOptions.Singleline);
            }
        }
    }

// Add this declaratrion
public string MailFrom { get { return mailFrom; } }

    /// <summary>
    /// Mail TO
    /// </summary>
    public string MailTo { get { return mailTo; } }

    /// <summary>
    /// Password Mail
    /// </summary>
    public string MailPW { get { return mailPW; } }


    /// <summary>
    /// SMTP Server
    /// </summary>
    public string MailSmtp { get { return mailSmtp; } }

    /// <summary>
    /// Server Name or IP
    /// </summary>
    public string ServerNameIP { get { return serverNam

   /// <summary>
    /// Send Mail true false
    /// </summary>
    public bool SendMail { get { return sendMail; } }

    /// <summary>
    /// Mail SSL
    /// </summary>
    public bool MailSSL { get { return mailSSL; } }

  //***********************************************************************************

In App.Config Add this

<add key="MailFrom" value="Mail from" />

<add key="MailTo" value="mail to" />

<add key="MailPW" value="Mail Password" />

<add key="MailSSL" value="true" />

<add key="MailSMTP" value="mail server" />

<add key="ServerNameIP" value="server IP or name server" />    

// **********************************************************************************************************

ok I hope you did not forget anything, if there is no write me as well.
I also wrote a small software that crypt password mail so as not to put the password in clear text in the config. I added a class to decrypt the password when the software needs to send the notification email. If you are interested please add them too.
Hello
Michele Sinesi

p-s. sorry for my english

Hi there!

New feature: email alert sent when the IP was blocked or summary at the end of day to the attempts and IP's blockeds.

Hi There
I have had someone trying to Hack into my server for a few months now, initially it was 25 Logins a second. I rebooted My DSL router and got a new IP Address and they went away for 24 Hours. I was using a Custom RDP port (15676 instead of The standard 3389) but they found me again ☹. I use a DynDns host name as fixed IP addresses are very expensive here And I figured a dynamic one would be safer. Now the Login attempts are much lower going back to port 3389 and limiting the IP Range to local addresses but they keep trying. They haven’t got in as my Password is tight but I stumbled across your IPBAN program by accident yesterday and I thought “I must try this”, I have been looking for something like This for ever. I am however a total Newbie though. I followed Instructions and downloaded the IPBAN app onto my Server 2012 R2 and followed these
instructions:

Windows
• For Windows, IPBan is supported on Windows Server 2008 or equivalent or newer. Windows XP and Server 2003 are NOT supported.
• Extract the IPBan.zip (inside is IPBanWindows.zip) file to a place on your computer. Right click on all the extracted files and select properties. Make sure to select "unblock" if the option is available.
• You MUST make this change to the local security policy to ensure ip addresses show up: Change Local Security Policy -> Local Policies -> Audit Policy and turn failure logging on for "audit account logon events" and "audit logon events". From an admin command prompt:
auditpol /set /category:"Logon/Logoff" /success:enable /failure:enable
auditpol /set /category:"Account Logon" /success:enable /failure:enable

However when I downloaded Visual Studio 2017 Free, it seems like you have to Compile the program? (Apologies if My wording is wrong) I ran IPBAN service and that shows running, I can get IPBAN to launch with a CMD window But from then on I am stuck. I see all the Clever IT guys don’t have a problem. Is there a tutorial somewhere on how To make the GUI work and compile the program in Visual Studio 2017 or am I totally on the wrong track?

I really love supporting open source software developers because they make really great software and although I am only a small struggling one man business I donate as much as I can. I see you will be going commercial soon? Will the Open Source version still work? Do you have any idea on pricing?

I will gladly donate if IPBAN does what it seems everyone on GitHub suggests.

Thanks in anticipation to any helpers

So thank you for this project.
But I have problem(s) -
I have added several IPs to the config file in the section for comma separated values to ban and never unban.
But it doesn't seem to do anything.
The log file shows them :
2014-09-27 14:32:48.2931|INFO|FileLogger|Whitelist: 127.0.0.1,fe80::40e4:3e6b:47a7:f34b%11,fe80::34ab:288f:3f57:fd38%12,192.168.2.199,2001:0:9d38:90d7:34ab:288f:3f57:fd38,::1,0.0.0.0,-, Whitelist Regex:
2014-09-27 14:32:48.3081|INFO|FileLogger|Blacklist: 95.136.46.177,95.136.46.178,96.57.130.30,198.204.245.84, Blacklist Regex:

But they still get through. (I tried by adding a known IP I have control of, and could still get through. Once I hit the threshold of invalid login attempts, my IP was blocked.)

I'm really puzzled as to what's going on.... I guess it'd be just as easy to create my own rule and update for the IPs I want to permanently block as then it stops me from having to edit IPBan's config file which is dangerous as I've found that any error made in the config file will cause the service to error/abort.

The problem with no ip being logged for ntlm traffic- the workaround involves disabling network level authentication, so requires running in a less secure rdp mode. Have any workarounds been found that don't require this step?

Hi!

I have a small proposal.

To determine brute-force connections we can use Windows IP Helper API (IPHlpApi)
And then ban such IPs. It can be used not only for RDP.

Working example:
http://www.tweaking.com/content/page/remote_desktop_ip_monitor_blocker.html

Examples with source:
https://github.com/Loriowar/IpHlpApidotnet
https://www.codeproject.com/Articles/14423/Getting-the-active-TCP-UDP-connections-using-the-G
http://timvw.be/2007/09/09/build-your-own-netstatexe-with-c/
https://www.codeproject.com/Articles/4173/Windows-netstat-application
https://www.codeproject.com/Articles/7359/EnetstatX
https://www.codeproject.com/Articles/5453/Enhance-netstat

PowerShell example:
https://gist.github.com/empo/958531

I've been getting this error posted in logs at random:

2018-02-09 18:46:02.0660|ERROR|FileLogger|System.Xml.XmlException: '�', hexadecimal value 0x01, is an invalid character. Line 5, position 31.
   at System.Xml.XmlTextReaderImpl.Throw(Exception e)
   at System.Xml.XmlTextReaderImpl.ParseText(Int32& startPos, Int32& endPos, Int32& outOrChars)
   at System.Xml.XmlTextReaderImpl.ParseText()
   at System.Xml.XmlTextReaderImpl.ParseElementContent()
   at System.Xml.XmlCharCheckingReader.Read()
   at System.Xml.XmlLoader.LoadNode(Boolean skipOverWhitespace)
   at System.Xml.XmlLoader.LoadDocSequence(XmlDocument parentDoc)
   at System.Xml.XmlDocument.Load(XmlReader reader)
   at IPBan.IPBanService.ParseXml(String xml)
   at IPBan.IPBanService.ProcessXml(String xml)
   at IPBan.IPBanService.EventRecordWritten(Object sender, EventRecordWrittenEventArgs e)

If you want new features or have bug reports, please consider donating. I make very little money from this project.

Is it possible to reduce the amount of logging? The logfile is growing to rapidly.

I've spent many hundreds of hours providing this code free of charge for the benefit of all.

Thank you.

• Jeff

I've had multiple people asking about when a public database of banned ip addresses will be available. My answer is that I am working on it, slowly, trying to figure out how to make it a good database that does not have false positives, etc. This project is open source and I have currently done it all in my spare time. Donations are extremely rare.

To help get more advanced features available, I am planning on offering a paid version hopefully within a year or so that offers a lot more features, server management and reporting tools and more.

Stay tuned and please visit ipban.com for updates.

It would be nice to be able to exclude specific IP's from ever being banned. It would be a nightmare if I forgot my password and couldn't try n amount of times.

BTW I haven't looked at your code but I assume it would be a simple loop statement through a comma delimited string of IP's from the config.

How do I set up, to send email every time I lock and unlock?

I have had hundreds of SQL login attempts by the several IP's today, so there is something still missing.

You could almost ban any IP that attempts a login with 'sa', and that would quickly resolve the issue. Of course that does not actually fix the issue the service is having.

I looked at your config and it looks right. I saw your test string and the only difference in that one and the attempts today is the extra number in the first octet of the IP. I don't think that matters but here is an example.

- <System>
  <Provider Name="MSSQLSERVER" /> 
  <EventID Qualifiers="49152">18456</EventID> 
  <Level>0</Level> 
  <Task>4</Task> 
  <Keywords>0x90000000000000</Keywords> 
  <TimeCreated SystemTime="2012-03-26T20:25:19.000000000Z" /> 
  <EventRecordID>398386</EventRecordID> 
  <Channel>Application</Channel> 
  <Computer>dallas</Computer> 
  <Security /> 
  </System>
- <EventData>
  <Data>sa</Data> 
  <Data>Reason: Password did not match that for the login provided.</Data> 
  <Data>[CLIENT: 74.63.255.37]</Data> 
  <Binary>184800000E00000007000000440041004C004C00410053000000070000006D00610073007400650072000000</Binary> 
  </EventData>
  </Event>```

Hello Jeff,

Thank you for making IPBan. I've just installed it for the first time on a server 2 weeks ago. Yesterday I was checking the logs and I noticed that IPBan is not blocking brute-forces anymore.

Just checked the firewall and there was no IPBan rules there too. I've checked firewall logs and found this:

A rule has been deleted in the Windows Firewall exception list.

Deleted rule: 
   Rule ID: xxx
   Rule Name: IPBan_0
   Modifying User: SYSTEM
   Modifying Application: D:\test\IPBan.exe

I've stopped and restarted IPBan service but it didn't help and IPBan rules didn't appear in firewall. I've also added an IP in blacklist (In config file) but it's not blocking anyway...

So, I've 2 questions:

1. Is it possible that IPBan delete its rule by itself or is it a hack attack which has removed this rule?
2. Is there any need that I recreate the firewall rule by my own or will it be created automatically by IPBan again?

Thank you again
Iman

I'm trying to get my head around how the logging (For Windows) is set up / configured for IPBan. I've looked through the nLog docs briefly and I think I understand their basic structure... but for IPBan, at least in a "default" windows install, there appears to be no nlog.config or nlog.dll.config file included in that zipfile distribution.

Is this intentional? I see the nlog.config file in the root of the repo, but the mapping between the repo file locations and the distribution files is not obvious (yet?).... Is the expectation that users will copy-possibly-modify the nlog.config file from the base repo and put that in the same directory with the rest of the windows installation? Or is there another way to configure nLog from within a windows install that I haven't found yet? If I can get this figured out I'm happy to do another PR with some additions to the readme file ;-)

do you know if ipban supports ipv6?

I found the following section in the cfg file will block brute force attempts on a RDP Gateway server.

   <!-- This group will block audit failures from RDP Gateway -->
  <Group>
    <Keywords>0x4000000000000000</Keywords>
    <Path>Microsoft-Windows-TerminalServices-Gateway/Operational</Path>
    <Expressions>
      <Expression>
        <XPath>//EventID</XPath>
        <Regex>312</Regex>
      </Expression>
      <Expression>
        <XPath>//IpAddress</XPath>
        <Regex>
          <![CDATA[
            (?<ipaddress>.+):.*
          ]]>
        </Regex>
      </Expression>
    </Expressions>
  </Group>

I looked into why my laptop was unable to ping my DNS server and found that IPBan had blocked it. I cleared the ban list and one web search worked before it was banned again. It inst even touching MS Exchange, Remote Desktop, or SQL.

Any insight into why this is happening? The laptops IPv4 address isnt in the perma ban list either.

Extra Info: It bans its IPv6 address first after a single web search, then proceeds to ban the IPv4 address after a ping.

Hi,

and first of all thank you for the excellent product..I'm still testing the binary as I have no clear ideas how to compile/build myself (I have Visual Studio on a Windows 2008 r2 so I think I can).

I have a question about whitelist..is it possible to whitelist IP ranges or full ip classes? How? That would be interesting feature to add I think when dealing with large amounts of IPs to allow (maybe a whole region or a whole ISP or network).

Thanks again for the fantastic product, I hope to be brave enough soon and build the updated versions!

I have noticed a crash of IPBan in my logfile, log rotation? (version v1.3.6)
Or maybe due to a restart of the system? ...i think i restarted this machine after installing Windows Updates around 08:30 this morning

2019-01-10 08:30:59.8496|ERROR|IPBan.IPBanLog|Exception: System.IO.IOException: The process cannot access the file 'C:\Windows\TEMP\tmpD41F.tmp' because it is being used by another process.
   at System.IO.FileStream.ValidateFileHandle(SafeFileHandle fileHandle)
   at System.IO.FileStream.CreateFileOpenHandle(FileMode mode, FileShare share, FileOptions options)
   at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options)
   at System.IO.StreamReader..ctor(String path, Encoding encoding, Boolean detectEncodingFromByteOrderMarks, Int32 bufferSize)
   at System.IO.StreamReader..ctor(String path, Encoding encoding)
   at System.IO.File.InternalReadAllLines(String path, Encoding encoding)
   at System.IO.File.ReadAllLines(String path)
   at IPBan.IPBanOS..cctor() in C:\Users\Jeff\Documents\GitHub\Windows-IP-Ban-Service\Core\IPBanOS.cs:line 102

Hello,

My aim is to block NTLM and RDP brut force attack on Windows Server 2012 R2 .

In your presentation you say:
For Windows Server 2008 or equivelant, you should disable NTLM logins and only allow NTLM2 logins. On Windows Server 2008, there is no way to get the ip address of NTLM logins. Use secpol -> local policies -> security options -> network security restrict ntlm incoming ntlm traffic -> deny all accounts.

Could you explain why ? What is the aim ?
If we don't do it, what's happening ?
Do we decrease the security by doing this ?
Do we have to do this also on Windows Server 2012 R2 ?
Do you know the equivalent through a command line ?

You say also:
You MUST make this change to the local security policy to ensure ip addresses show up: Change Local Security Policy -> Local Policies -> Audit Policy and turn failure logging on for "audit account logon events" and "audit logon events". From an admin command prompt: auditpol /set /category:"Logon/Logoff" /success:enable /failure:enable

Do we have also to do it if we are focused only on NTLM and RDP brut force attack ?
If yes, then may be we should also do:
auditpol /set /category:"Account Logon" /success:enable /failure:enable

Hello,

Just wanted to say things have been going great for two months, so thanks.

I woke up this morning to see my server was down, and once I had the server host reboot it (it was locked up), I went in to investigate.

My system log was filled with IP's attempting more than 5 times. I went in to check logging, but the log was 400mb+. I would like to keep logging on, so do you think you could have a log root folder, and year/month sub folders with year-month-day text files?

Also, when the server restarts (maybe this even happens when the service restarts), it clears the entire scope of firewall rule. Is there some way to prevent this? I think I really would like the option to permanently ban IP's. If someone really wants to see my websites that bad they can email me and I will remove their IP.

It would be a useful feature to have the date in the old log names instead of an incrementing number. For example, on Jan 14 2019, name the prior day's file logfile.20190113.txt instead of logfile.1321.text.

IPBan.exe.config.txt

hi

I setup the whitelist but it still seems to block the address's I put in it which are 10.0.0.0/16

tried whitelist and regex still not working

anything I need to do?

I am using on windows 2016 server
Exchange 2016

it works great at adding them to the firewall but just want to be able to exclude the internal subnet

any help would be appreciated, also thank you for this great application

The new precompiled version for both x86 and any CPU both crash on startup

Problem signature:
Problem Event Name: CLR20r3
Problem Signature 01: ipban.exe
Problem Signature 02: 1.0.4703.15667
Problem Signature 03: 50a65ed7
Problem Signature 04: mscorlib
Problem Signature 05: 4.0.0.0
Problem Signature 06: 50483a22
Problem Signature 07: 475f
Problem Signature 08: 9d
Problem Signature 09: System.Security.Security
OS Version: 6.1.7601.2.1.0.305.9
Locale ID: 1033
Additional Information 1: decf
Additional Information 2: decf9afcdb05a7d51839a3d9359dd1d0
Additional Information 3: a28b
Additional Information 4: a28b88f66428041dc413a64cbe933541

D:>cd system\IPBan

D:\system\IPBan>ipban debug

Unhandled Exception: System.TypeInitializationException: The type initializer fo
r ‘IPBan.Log’ threw an exception. —> System.Configuration.ConfigurationErrorsE
xception: An error occurred creating the configuration section handler for nlog:
Request failed. (D:\system\IPBan\IPBan.exe.Config line 5) —> System.Security.
SecurityException: Request failed.
at System.RuntimeTypeHandle.CreateInstance(RuntimeType type, Boolean publicOn
ly, Boolean noCheck, Boolean& canBeCached, RuntimeMethodHandleInternal& ctor, Bo
olean& bNeedSecurityCheck)
at System.RuntimeType.CreateInstanceSlow(Boolean publicOnly, Boolean skipChec
kThis, Boolean fillCache)
at System.RuntimeType.CreateInstanceDefaultCtor(Boolean publicOnly, Boolean s
kipVisibilityChecks, Boolean skipCheckThis, Boolean fillCache)
at System.Activator.CreateInstance(Type type, Boolean nonPublic)
at System.Configuration.TypeUtil.CreateInstanceWithReflectionPermission(Type
type)
at System.Configuration.RuntimeConfigurationRecord.RuntimeConfigurationFactor
y.Init(RuntimeConfigurationRecord configRecord, FactoryRecord factoryRecord)
at System.Configuration.RuntimeConfigurationRecord.RuntimeConfigurationFactor
y.InitWithRestrictedPermissions(RuntimeConfigurationRecord configRecord, Factory
Record factoryRecord)
at System.Configuration.RuntimeConfigurationRecord.CreateSectionFactory(Facto
ryRecord factoryRecord)
at System.Configuration.BaseConfigurationRecord.FindAndEnsureFactoryRecord(St
ring configKey, Boolean& isRootDeclaredHere)
— End of inner exception stack trace —
at System.Configuration.BaseConfigurationRecord.FindAndEnsureFactoryRecord(St
ring configKey, Boolean& isRootDeclaredHere)
at System.Configuration.BaseConfigurationRecord.GetSectionRecursive(String co
nfigKey, Boolean getLkg, Boolean checkPermission, Boolean getRuntimeObject, Bool
ean requestIsHere, Object& result, Object& resultRuntimeObject)
at System.Configuration.BaseConfigurationRecord.GetSection(String configKey)
at System.Configuration.ConfigurationManager.GetSection(String sectionName)
at NLog.LogFactory.get_Configuration()
at NLog.LogFactory.GetLogger(LoggerCacheKey cacheKey)
at IPBan.Log..cctor() in c:\Users\Jeff\Desktop\Personal\DigitalRuby\DEV\SVN\t
runk\Utilities\IPBan\Logger.cs:line 22
— End of inner exception stack trace —
at IPBan.IPBanService.OnStart(String[] args) in c:\Users\Jeff\Desktop\Persona
l\DigitalRuby\DEV\SVN\trunk\Utilities\IPBan\IPBanService.cs:line 491
at IPBan.IPBanService.RunConsole(String[] args) in c:\Users\Jeff\Desktop\Pers
onal\DigitalRuby\DEV\SVN\trunk\Utilities\IPBan\IPBanService.cs:line 529
at IPBan.IPBanService.Main(String[] args) in c:\Users\Jeff\Desktop\Personal\D
igitalRuby\DEV\SVN\trunk\Utilities\IPBan\IPBanService.cs:line 548

D:\system\IPBan>

I used sc delete ipban to remove it, close and opened the services.mcs, ran the install in the cmd prompt, and it is giving me:

Services

Windows could not start the IPBAN service on Local Computer.

Error 1053: The service did not respond to the start or control request in a timely fashion.

OK

Hey there,

thank you very much for writing and maintaining this jewel of a tool.

Unfortunately I seem to have hit a roadblock with it. Same issue as the guy in #44 apparently. The firewall rule is deleted just a fraction of a second after it was created.

XML of rule creation:
https://pastebin.com/FTcTREEi

XML of rule deletion:
https://pastebin.com/iRFD2SrB

Additional info:

IPBan version is 1.3.6

ClearBannedIPAddressesOnRestart is set to false

Some tools rely on internal Windows functions and how / in what language these functions return results. Knowing that, I first tested IPBan on a US Win Server 2016 Standard Desktop that I had available at that time, where everything was just fine. Later, as our customer is a German company, I tried running IPBan on a German Win Server 2016 Standard Desktop. It is this German version of the server where the rule is deleted. The language used might have something to do with it, it might not, but it's where both systems differ. The XML output above is from said German Win Server 2016 standard install.

I established the rule ExpireTime to 00: 00: 00: 00 to never forget an IP

Banscript is very long. Exceeds the maximum length of command line string (8191 characters) and fails.

Any solution?

thanks

Will it be possible to add a whitelist host name in the config file in the future? Entering a fixed IP in the white-list does not work well in the scenario where ISP frequently changes IP for customers.

These days, there are many free and paid dynamic dns host providers (no-ip.com, dyndns, etc). Even router firmware like DD-WRT supports updating dynamic host entries.

This does have a man in the middle attack possibility, however, that can be mitigated by the use of opendns servers.

The issue in #33 is not resolved in latest release (1.2.2).

2018-03-07 10:42:48.9290|ERROR|FileLogger|System.Xml.XmlException: '�', hexadecimal value 0x01, is an invalid character. Line 5, position 31.
   at System.Xml.XmlTextReaderImpl.Throw(Exception e)
   at System.Xml.XmlTextReaderImpl.ParseText(Int32& startPos, Int32& endPos, Int32& outOrChars)
   at System.Xml.XmlTextReaderImpl.ParseText()
   at System.Xml.XmlTextReaderImpl.ParseElementContent()
   at System.Xml.XmlCharCheckingReader.Read()
   at System.Xml.XmlLoader.LoadNode(Boolean skipOverWhitespace)
   at System.Xml.XmlLoader.LoadDocSequence(XmlDocument parentDoc)
   at System.Xml.XmlDocument.Load(XmlReader reader)
   at IPBan.IPBanService.ParseXml(String xml) in C:\Users\Jeff\Documents\GitHub\Windows-IP-Ban-Service\IPBanService.cs:line 249
   at IPBan.IPBanService.ProcessXml(String xml) in C:\Users\Jeff\Documents\GitHub\Windows-IP-Ban-Service\IPBanService.cs:line 492
   at IPBan.IPBanService.EventRecordWritten(Object sender, EventRecordWrittenEventArgs e) in C:\Users\Jeff\Documents\GitHub\Windows-IP-Ban-Service\IPBanService.cs:line 516

I checked out the stackoverflow link you posted and applied their solution. It has significantly reduced windows login attempts, but there is still one that occurs at a rate of every 5 minutes and has no IP to block. Here is the XML.

- <System>
  <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /> 
  <EventID>4625</EventID> 
  <Version>0</Version> 
  <Level>0</Level> 
  <Task>12544</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x8010000000000000</Keywords> 
  <TimeCreated SystemTime="2012-03-27T00:25:00.010825500Z" /> 
  <EventRecordID>14069</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="488" ThreadID="2220" /> 
  <Channel>Security</Channel> 
  <Computer>dallas</Computer> 
  <Security /> 
  </System>
- <EventData>
  <Data Name="SubjectUserSid">S-1-5-18</Data> 
  <Data Name="SubjectUserName">DALLAS$</Data> 
  <Data Name="SubjectDomainName">WORKGROUP</Data> 
  <Data Name="SubjectLogonId">0x3e7</Data> 
  <Data Name="TargetUserSid">S-1-0-0</Data> 
  <Data Name="TargetUserName">@@CyBAAAAUBQYAMHArBwUAMGAoBQZAQGA1BAbAUGAyBgOAQFAhBwcAsGA6AweAMDABBQRAEEACBgQAIEADBQLAADAEBwNAUDAtAANAEEADBQNA0CACBANAYDA5AQLAkDABBQNAEDABBAMAMEAxAARAUDA4AQMA0HA</Data> 
  <Data Name="TargetDomainName" /> 
  <Data Name="Status">0xc000006d</Data> 
  <Data Name="FailureReason">%%2313</Data> 
  <Data Name="SubStatus">0xc0000064</Data> 
  <Data Name="LogonType">4</Data> 
  <Data Name="LogonProcessName">Advapi</Data> 
  <Data Name="AuthenticationPackageName">Negotiate</Data> 
  <Data Name="WorkstationName">DALLAS</Data> 
  <Data Name="TransmittedServices">-</Data> 
  <Data Name="LmPackageName">-</Data> 
  <Data Name="KeyLength">0</Data> 
  <Data Name="ProcessId">0x338</Data> 
  <Data Name="ProcessName">C:\Windows\System32\svchost.exe</Data> 
  <Data Name="IpAddress">-</Data> 
  <Data Name="IpPort">-</Data> 
  </EventData>
  </Event>```

Ever see anything like that? 

I don't seem to be able to output used usernames on a Windows Server 2012 box I installed IPBan on, On another instance (Windows 10) used usernames are logged properly.
What have i done wrong?

Windows Server 2012 log output

2019-02-23 00:00:09.2692|WARN|IPBan.IPBanLog|Login attempt failed: 35.198.39.233, , RDP, 1 2019-02-23 00:02:54.6016|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.55, , RDP, 1 2019-02-23 00:03:54.8333|WARN|IPBan.IPBanLog|Login attempt failed: 35.200.248.252, , RDP, 1 2019-02-23 00:04:09.9377|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.163.6, , RDP, 1 2019-02-23 00:05:10.1435|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.48, , RDP, 1 2019-02-23 00:05:40.3087|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.84, , RDP, 1 2019-02-23 00:05:55.4206|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.46, , RDP, 2 2019-02-23 00:07:55.6707|WARN|IPBan.IPBanLog|Login attempt failed: 35.203.5.213, , RDP, 1 2019-02-23 00:10:25.9965|WARN|IPBan.IPBanLog|Login attempt failed: 35.189.101.22, , RDP, 2 2019-02-23 00:11:56.2078|WARN|IPBan.IPBanLog|Login attempt failed: 8.37.44.225, , RDP, 1 2019-02-23 00:12:11.3357|WARN|IPBan.IPBanLog|Login attempt failed: 34.73.7.85, , RDP, 1 2019-02-23 00:14:11.5948|WARN|IPBan.IPBanLog|Login attempt failed: 35.198.15.245, , RDP, 1 2019-02-23 00:14:11.6950|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.80, , RDP, 1 2019-02-23 00:15:26.8909|WARN|IPBan.IPBanLog|Login attempt failed: 148.0.34.241, , RDP, 2 2019-02-23 00:15:27.0037|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.44, , RDP, 1 2019-02-23 00:15:27.0888|WARN|IPBan.IPBanLog|Login attempt failed: 35.228.20.8, , RDP, 2 2019-02-23 00:17:42.3777|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.46, , RDP, 3 2019-02-23 00:19:12.5983|WARN|IPBan.IPBanLog|Login attempt failed: 35.203.1.128, , RDP, 1 2019-02-23 00:19:27.7190|WARN|IPBan.IPBanLog|Login attempt failed: 35.198.14.91, , RDP, 1 2019-02-23 00:21:58.0209|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.163.8, , RDP, 2 2019-02-23 00:22:13.1424|WARN|IPBan.IPBanLog|Login attempt failed: 34.73.72.215, , RDP, 1 2019-02-23 00:23:43.3792|WARN|IPBan.IPBanLog|Login attempt failed: 35.204.12.179, , RDP, 2 2019-02-23 00:24:58.5664|WARN|IPBan.IPBanLog|Login attempt failed: 34.85.13.234, , RDP, 1 2019-02-23 00:26:43.8008|WARN|IPBan.IPBanLog|Login attempt failed: 35.244.7.110, , RDP, 2 2019-02-23 00:27:28.9591|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.95, , RDP, 2 2019-02-23 00:28:59.1695|WARN|IPBan.IPBanLog|Login attempt failed: 35.198.14.91, , RDP, 2 2019-02-23 00:30:29.4038|WARN|IPBan.IPBanLog|Login attempt failed: 34.85.13.234, , RDP, 2 2019-02-23 00:31:14.8132|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.44, , RDP, 2 2019-02-23 00:31:14.9267|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.104, , RDP, 1 2019-02-23 00:31:15.0064|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.49, , RDP, 3 2019-02-23 00:31:30.1187|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.48, , RDP, 2 2019-02-23 00:33:30.3791|WARN|IPBan.IPBanLog|Login attempt failed: 34.76.99.228, , RDP, 1 2019-02-23 00:33:30.7577|WARN|IPBan.IPBanLog|Login attempt failed: 35.198.15.245, , RDP, 2 2019-02-23 00:34:00.8865|WARN|IPBan.IPBanLog|Login attempt failed: 35.203.5.213, , RDP, 2 2019-02-23 00:34:16.0081|WARN|IPBan.IPBanLog|Login attempt failed: 35.203.5.213, , RDP, 3 2019-02-23 00:34:31.3143|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.44, , RDP, 3 2019-02-23 00:38:46.7331|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.163.6, , RDP, 2 2019-02-23 00:40:01.9449|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.48, , RDP, 3 2019-02-23 00:41:47.2557|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.48, , RDP, 4 2019-02-23 00:41:47.3617|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.104, , RDP, 2 2019-02-23 00:43:32.6087|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.124, , RDP, 1 2019-02-23 00:43:47.7337|WARN|IPBan.IPBanLog|Login attempt failed: 35.200.152.33, , RDP, 1 2019-02-23 00:43:47.8380|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.127, , RDP, 2 2019-02-23 00:44:47.9976|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.121, , RDP, 1 2019-02-23 00:46:03.2049|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.122, , RDP, 1 2019-02-23 00:46:33.3410|WARN|IPBan.IPBanLog|Login attempt failed: 35.203.5.213, , RDP, 4 2019-02-23 00:48:18.5688|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.163.6, , RDP, 3 2019-02-23 00:49:03.7394|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.127, , RDP, 3 2019-02-23 00:49:18.8492|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.122, , RDP, 2 2019-02-23 00:50:04.2396|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.115, , RDP, 1 2019-02-23 00:51:34.4675|WARN|IPBan.IPBanLog|Login attempt failed: 35.198.15.245, , RDP, 3 2019-02-23 00:52:34.6324|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.163.8, , RDP, 3 2019-02-23 00:53:04.7518|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.121, , RDP, 2 2019-02-23 00:54:19.9452|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.122, , RDP, 3 2019-02-23 00:55:05.2871|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.115, , RDP, 2 2019-02-23 00:55:20.4713|WARN|IPBan.IPBanLog|Login attempt failed: 35.198.14.91, , RDP, 3 2019-02-23 00:56:35.9734|WARN|IPBan.IPBanLog|Banning ip address: 197.188.221.142, user name: , config black listed: False, count: 5, extra info: 2019-02-23 00:56:36.0810|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.163.6, , RDP, 4 2019-02-23 00:57:21.3106|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.49, , RDP, 4 2019-02-23 00:59:21.5844|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.163.13, , RDP, 1 2019-02-23 00:59:36.9569|WARN|IPBan.IPBanLog|Login attempt failed: 34.73.108.232, , RDP, 1 2019-02-23 01:00:37.1275|WARN|IPBan.IPBanLog|Login attempt failed: 35.200.248.252, , RDP, 2 2019-02-23 01:01:37.3035|WARN|IPBan.IPBanLog|Login attempt failed: 35.203.1.128, , RDP, 2 2019-02-23 01:02:22.4637|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.163.8, , RDP, 4 2019-02-23 01:02:52.6160|WARN|IPBan.IPBanLog|Login attempt failed: 35.200.168.7, , RDP, 1 2019-02-23 01:03:37.7616|WARN|IPBan.IPBanLog|Login attempt failed: 77.246.157.205, , RDP, 1 2019-02-23 01:05:53.0206|WARN|IPBan.IPBanLog|Login attempt failed: 35.203.1.128, , RDP, 3 2019-02-23 01:06:53.1776|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.44, , RDP, 4 2019-02-23 01:09:23.4695|WARN|IPBan.IPBanLog|Login attempt failed: 35.198.39.233, , RDP, 2 2019-02-23 01:10:38.6830|WARN|IPBan.IPBanLog|Login attempt failed: 77.246.157.205, , RDP, 2 2019-02-23 01:12:08.9183|WARN|IPBan.IPBanLog|Login attempt failed: 34.73.108.232, , RDP, 2 2019-02-23 01:13:24.1312|WARN|IPBan.IPBanLog|Login attempt failed: 35.200.152.33, , RDP, 2 2019-02-23 01:15:09.4462|WARN|IPBan.IPBanLog|Login attempt failed: 34.76.99.228, , RDP, 2 2019-02-23 01:15:24.5950|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.115, , RDP, 3 2019-02-23 01:15:39.7410|WARN|IPBan.IPBanLog|Login attempt failed: 34.73.7.85, , RDP, 2 2019-02-23 01:18:55.0940|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.127, , RDP, 4 2019-02-23 01:20:25.2896|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.163.13, , RDP, 2 2019-02-23 01:21:55.5105|WARN|IPBan.IPBanLog|Login attempt failed: 35.200.139.24, , RDP, 1 2019-02-23 01:21:55.5995|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.115, , RDP, 4 2019-02-23 01:23:40.8516|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.84, , RDP, 2 2019-02-23 01:25:11.2097|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.163.13, , RDP, 3 2019-02-23 01:25:26.3609|WARN|IPBan.IPBanLog|Login attempt failed: 35.200.178.119, , RDP, 1 2019-02-23 01:26:26.6117|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.52, , RDP, 2 2019-02-23 01:27:11.7627|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.95, , RDP, 3 2019-02-23 01:27:56.9485|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.46, , RDP, 4 2019-02-23 01:29:42.1954|WARN|IPBan.IPBanLog|Login attempt failed: 35.244.7.110, , RDP, 3 2019-02-23 01:30:27.3817|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.80, , RDP, 2 2019-02-23 01:30:42.5037|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.52, , RDP, 3 2019-02-23 01:30:42.6084|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.122, , RDP, 4 2019-02-23 01:32:42.9026|WARN|IPBan.IPBanLog|Login attempt failed: 34.73.72.215, , RDP, 2 2019-02-23 01:33:13.0470|WARN|IPBan.IPBanLog|Login attempt failed: 35.244.24.212, , RDP, 2 2019-02-23 01:35:58.4673|WARN|IPBan.IPBanLog|Banning ip address: 82.202.160.48, user name: , config black listed: False, count: 5, extra info: 2019-02-23 01:37:43.7958|WARN|IPBan.IPBanLog|Login attempt failed: 34.76.99.228, , RDP, 3 2019-02-23 01:38:43.9629|WARN|IPBan.IPBanLog|Login attempt failed: 35.189.101.22, , RDP, 3 2019-02-23 01:39:14.0966|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.80, , RDP, 3 2019-02-23 01:41:29.3656|WARN|IPBan.IPBanLog|Login attempt failed: 34.85.13.234, , RDP, 3 2019-02-23 01:41:59.5478|WARN|IPBan.IPBanLog|Login attempt failed: 35.202.149.119, , RDP, 2 2019-02-23 01:43:29.8465|WARN|IPBan.IPBanLog|Login attempt failed: 35.200.248.252, , RDP, 3 2019-02-23 01:43:44.9944|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.121, , RDP, 3 2019-02-23 01:44:15.1345|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.55, , RDP, 2 2019-02-23 01:47:15.4535|WARN|IPBan.IPBanLog|Login attempt failed: 34.73.7.85, , RDP, 3 2019-02-23 01:48:00.6566|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.163.13, , RDP, 4 2019-02-23 01:48:00.7662|WARN|IPBan.IPBanLog|Login attempt failed: 34.80.10.85, , RDP, 1 2019-02-23 01:48:30.8827|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.121, , RDP, 4 2019-02-23 01:48:46.0122|WARN|IPBan.IPBanLog|Login attempt failed: 35.198.15.245, , RDP, 4 2019-02-23 01:52:31.4324|WARN|IPBan.IPBanLog|Login attempt failed: 35.200.178.119, , RDP, 2 2019-02-23 01:54:01.6979|WARN|IPBan.IPBanLog|Login attempt failed: 77.246.157.205, , RDP, 3 2019-02-23 01:55:01.8851|WARN|IPBan.IPBanLog|Login attempt failed: 35.198.39.233, , RDP, 3 2019-02-23 01:55:17.0052|WARN|IPBan.IPBanLog|Login attempt failed: 35.202.149.119, , RDP, 3 2019-02-23 01:55:47.1460|WARN|IPBan.IPBanLog|Login attempt failed: 34.73.7.85, , RDP, 4 2019-02-23 01:57:02.3401|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.52, , RDP, 4 2019-02-23 01:57:17.4527|WARN|IPBan.IPBanLog|Login attempt failed: 35.244.24.212, , RDP, 3 2019-02-23 01:59:47.7654|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.124, , RDP, 2 2019-02-23 01:59:47.8761|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.80, , RDP, 4 2019-02-23 02:00:48.0724|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.124, , RDP, 3 2019-02-23 02:01:03.1810|WARN|IPBan.IPBanLog|Login attempt failed: 35.200.139.24, , RDP, 2 2019-02-23 02:01:18.4369|WARN|IPBan.IPBanLog|Banning ip address: 82.202.160.49, user name: , config black listed: False, count: 5, extra info: 2019-02-23 02:03:03.7585|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.95, , RDP, 4 2019-02-23 02:06:34.1595|WARN|IPBan.IPBanLog|Login attempt failed: 95.161.238.219, , RDP, 1 2019-02-23 02:07:04.3097|WARN|IPBan.IPBanLog|Login attempt failed: 77.246.157.205, , RDP, 4 2019-02-23 02:07:49.4858|WARN|IPBan.IPBanLog|Login attempt failed: 34.80.10.85, , RDP, 2 2019-02-23 02:08:34.7630|WARN|IPBan.IPBanLog|Login attempt failed: 34.73.72.215, , RDP, 3 2019-02-23 02:09:19.9059|WARN|IPBan.IPBanLog|Login attempt failed: 35.200.168.7, , RDP, 2 2019-02-23 02:11:35.1746|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.124, , RDP, 4 2019-02-23 02:14:51.4546|WARN|IPBan.IPBanLog|Banning ip address: 82.202.160.121, user name: , config black listed: False, count: 5, extra info: 2019-02-23 02:15:36.8790|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.55, , RDP, 3 2019-02-23 02:17:07.1000|WARN|IPBan.IPBanLog|Login attempt failed: 35.228.20.8, , RDP, 3 2019-02-23 02:17:52.4271|WARN|IPBan.IPBanLog|Banning ip address: 82.202.160.127, user name: , config black listed: False, count: 5, extra info: 2019-02-23 02:19:37.8030|WARN|IPBan.IPBanLog|Banning ip address: 82.202.163.8, user name: , config black listed: False, count: 5, extra info: 2019-02-23 02:20:38.1489|WARN|IPBan.IPBanLog|Banning ip address: 77.246.157.205, user name: , config black listed: False, count: 5, extra info: 2019-02-23 02:21:53.5091|WARN|IPBan.IPBanLog|Banning ip address: 82.202.160.52, user name: , config black listed: False, count: 5, extra info: 2019-02-23 02:21:53.5959|WARN|IPBan.IPBanLog|Login attempt failed: 34.73.72.215, , RDP, 4 2019-02-23 02:22:23.8432|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.55, , RDP, 4 2019-02-23 02:22:54.0116|WARN|IPBan.IPBanLog|Login attempt failed: 35.200.178.119, , RDP, 3 2019-02-23 02:25:39.3326|WARN|IPBan.IPBanLog|Login attempt failed: 95.161.238.219, , RDP, 2 2019-02-23 02:26:39.5106|WARN|IPBan.IPBanLog|Login attempt failed: 35.228.20.8, , RDP, 4 2019-02-23 02:32:25.0863|WARN|IPBan.IPBanLog|Banning ip address: 82.202.160.80, user name: , config black listed: False, count: 5, extra info: 2019-02-23 02:32:25.1895|WARN|IPBan.IPBanLog|Login attempt failed: 34.76.99.228, , RDP, 4 2019-02-23 02:33:25.4811|WARN|IPBan.IPBanLog|Login attempt failed: 35.198.39.233, , RDP, 4 2019-02-23 02:35:25.7602|WARN|IPBan.IPBanLog|Login attempt failed: 35.200.152.33, , RDP, 3 2019-02-23 02:36:55.9804|WARN|IPBan.IPBanLog|Login attempt failed: 35.200.139.24, , RDP, 3 2019-02-23 02:37:41.1654|WARN|IPBan.IPBanLog|Login attempt failed: 34.80.10.85, , RDP, 3 2019-02-23 02:38:11.4155|WARN|IPBan.IPBanLog|Banning ip address: 82.202.160.115, user name: , config black listed: False, count: 5, extra info: 2019-02-23 02:39:11.8222|WARN|IPBan.IPBanLog|Banning ip address: 82.202.160.46, user name: , config black listed: False, count: 5, extra info: 2019-02-23 02:39:57.0919|WARN|IPBan.IPBanLog|Login attempt failed: 35.200.168.7, , RDP, 3 2019-02-23 02:40:12.2478|WARN|IPBan.IPBanLog|Login attempt failed: 35.200.248.252, , RDP, 4 2019-02-23 02:40:27.2852|WARN|IPBan.IPBanLog|Un-banning ip address 92.53.65.157, ban expire: True, whitelisted: False 2019-02-23 02:41:27.6627|WARN|IPBan.IPBanLog|Login attempt failed: 35.202.149.119, , RDP, 4 2019-02-23 02:42:12.8298|WARN|IPBan.IPBanLog|Login attempt failed: 95.161.238.219, , RDP, 3 2019-02-23 02:43:43.1963|WARN|IPBan.IPBanLog|Banning ip address: 82.202.160.55, user name: , config black listed: False, count: 5, extra info: 2019-02-23 02:45:43.5896|WARN|IPBan.IPBanLog|Login attempt failed: 35.200.139.24, , RDP, 4 2019-02-23 02:47:28.8377|WARN|IPBan.IPBanLog|Login attempt failed: 34.80.10.85, , RDP, 4 2019-02-23 02:47:44.0246|WARN|IPBan.IPBanLog|Login attempt failed: 35.204.12.179, , RDP, 3 2019-02-23 02:48:59.2054|WARN|IPBan.IPBanLog|Login attempt failed: 95.161.238.219, , RDP, 4 2019-02-23 02:50:44.4469|WARN|IPBan.IPBanLog|Login attempt failed: 34.73.108.232, , RDP, 3 2019-02-23 02:50:59.5629|WARN|IPBan.IPBanLog|Login attempt failed: 35.200.152.33, , RDP, 4 2019-02-23 02:51:14.6938|WARN|IPBan.IPBanLog|Login attempt failed: 35.198.14.91, , RDP, 4 2019-02-23 02:53:44.9677|WARN|IPBan.IPBanLog|Login attempt failed: 35.204.12.179, , RDP, 4 2019-02-23 02:55:30.4100|WARN|IPBan.IPBanLog|Banning ip address: 95.161.238.219, user name: , config black listed: False, count: 5, extra info: 2019-02-23 02:57:45.9004|WARN|IPBan.IPBanLog|Banning ip address: 82.202.160.124, user name: , config black listed: False, count: 5, extra info: 2019-02-23 02:59:01.2777|WARN|IPBan.IPBanLog|Banning ip address: 82.202.160.122, user name: , config black listed: False, count: 5, extra info: 2019-02-23 03:00:46.6373|WARN|IPBan.IPBanLog|Login attempt failed: 34.73.108.232, , RDP, 4 2019-02-23 03:01:47.0279|WARN|IPBan.IPBanLog|Login attempt failed: 35.203.1.128, , RDP, 4 2019-02-23 03:03:47.3438|WARN|IPBan.IPBanLog|Login attempt failed: 35.244.7.110, , RDP, 4 2019-02-23 03:06:47.6830|WARN|IPBan.IPBanLog|Login attempt failed: 35.200.168.7, , RDP, 4 2019-02-23 03:08:33.0943|WARN|IPBan.IPBanLog|Login attempt failed: 35.189.101.22, , RDP, 4 2019-02-23 03:09:03.2595|WARN|IPBan.IPBanLog|Login attempt failed: 35.189.33.212, , RDP, 3 2019-02-23 03:11:33.5702|WARN|IPBan.IPBanLog|Login attempt failed: 35.244.24.212, , RDP, 4 2019-02-23 03:12:03.8206|WARN|IPBan.IPBanLog|Banning ip address: 82.202.160.44, user name: , config black listed: False, count: 5, extra info: 2019-02-23 03:18:04.5722|WARN|IPBan.IPBanLog|Banning ip address: 34.73.108.232, user name: , config black listed: False, count: 5, extra info: 2019-02-23 03:19:34.8777|WARN|IPBan.IPBanLog|Login attempt failed: 34.85.13.234, , RDP, 4 2019-02-23 03:21:35.5061|WARN|IPBan.IPBanLog|Banning ip address: 82.202.163.13, user name: , config black listed: False, count: 5, extra info: 2019-02-23 03:21:50.8114|WARN|IPBan.IPBanLog|Banning ip address: 35.189.101.22, user name: , config black listed: False, count: 5, extra info: 2019-02-23 03:29:51.8345|WARN|IPBan.IPBanLog|Banning ip address: 82.202.163.6, user name: , config black listed: False, count: 5, extra info: 2019-02-23 03:30:37.2127|WARN|IPBan.IPBanLog|Banning ip address: 34.73.7.85, user name: , config black listed: False, count: 5, extra info: 2019-02-23 03:32:22.6542|WARN|IPBan.IPBanLog|Banning ip address: 35.198.39.233, user name: , config black listed: False, count: 5, extra info: 2019-02-23 03:33:08.0290|WARN|IPBan.IPBanLog|Banning ip address: 35.198.15.245, user name: , config black listed: False, count: 5, extra info: 2019-02-23 03:35:08.3990|WARN|IPBan.IPBanLog|Login attempt failed: 35.200.178.119, , RDP, 4 2019-02-23 03:40:08.8745|WARN|IPBan.IPBanLog|Login attempt failed: 124.204.36.122, , RDP, 3 2019-02-23 03:51:39.8249|WARN|IPBan.IPBanLog|Login attempt failed: 35.189.33.212, , RDP, 4 2019-02-23 03:52:25.1066|WARN|IPBan.IPBanLog|Banning ip address: 35.244.24.212, user name: , config black listed: False, count: 5, extra info: 2019-02-23 03:53:40.3212|WARN|IPBan.IPBanLog|Un-banning ip address 193.188.23.38, ban expire: True, whitelisted: False 2019-02-23 03:54:40.8524|WARN|IPBan.IPBanLog|Banning ip address: 35.204.12.179, user name: , config black listed: False, count: 5, extra info: 2019-02-23 03:58:11.3939|WARN|IPBan.IPBanLog|Banning ip address: 82.202.160.95, user name: , config black listed: False, count: 5, extra info: 2019-02-23 04:01:42.0601|WARN|IPBan.IPBanLog|Banning ip address: 35.200.178.119, user name: , config black listed: False, count: 5, extra info: 2019-02-23 04:07:27.6877|WARN|IPBan.IPBanLog|Login attempt failed: 148.0.42.225, , RDP, 1 2019-02-23 04:07:27.9998|WARN|IPBan.IPBanLog|Banning ip address: 35.203.5.213, user name: , config black listed: False, count: 5, extra info: 2019-02-23 04:15:13.6871|WARN|IPBan.IPBanLog|Login attempt failed: 148.0.34.241, , RDP, 3 2019-02-23 04:17:14.0474|WARN|IPBan.IPBanLog|Banning ip address: 34.85.13.234, user name: , config black listed: False, count: 5, extra info: 2019-02-23 04:18:59.3753|WARN|IPBan.IPBanLog|Login attempt failed: 111.223.73.130, , RDP, 1 2019-02-23 04:20:59.7958|WARN|IPBan.IPBanLog|Banning ip address: 34.76.99.228, user name: , config black listed: False, count: 5, extra info: 2019-02-23 04:21:15.0614|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.84, , RDP, 3 2019-02-23 04:25:30.5896|WARN|IPBan.IPBanLog|Banning ip address: 35.198.14.91, user name: , config black listed: False, count: 5, extra info: 2019-02-23 04:30:16.2327|WARN|IPBan.IPBanLog|Banning ip address: 34.73.72.215, user name: , config black listed: False, count: 5, extra info: 2019-02-23 04:30:46.5414|WARN|IPBan.IPBanLog|Banning ip address: 35.202.149.119, user name: , config black listed: False, count: 5, extra info: 2019-02-23 04:42:47.7890|WARN|IPBan.IPBanLog|Banning ip address: 35.200.139.24, user name: , config black listed: False, count: 5, extra info: 2019-02-23 04:43:18.1758|WARN|IPBan.IPBanLog|Banning ip address: 35.200.152.33, user name: , config black listed: False, count: 5, extra info: 2019-02-23 05:07:05.1036|WARN|IPBan.IPBanLog|Login attempt failed: 124.204.36.122, , RDP, 4 2019-02-23 05:13:05.7536|WARN|IPBan.IPBanLog|Banning ip address: 35.203.1.128, user name: , config black listed: False, count: 5, extra info: 2019-02-23 05:16:21.2886|WARN|IPBan.IPBanLog|Banning ip address: 34.80.10.85, user name: , config black listed: False, count: 5, extra info: 2019-02-23 05:21:51.9178|WARN|IPBan.IPBanLog|Login attempt failed: 193.188.23.38, , RDP, 1 2019-02-23 05:27:37.6490|WARN|IPBan.IPBanLog|Banning ip address: 35.228.20.8, user name: , config black listed: False, count: 5, extra info: 2019-02-23 05:41:23.8878|WARN|IPBan.IPBanLog|Login attempt failed: 193.188.23.38, , RDP, 2 2019-02-23 05:59:25.4651|WARN|IPBan.IPBanLog|Banning ip address: 35.189.33.212, user name: , config black listed: False, count: 5, extra info: 2019-02-23 06:19:42.2326|WARN|IPBan.IPBanLog|Banning ip address: 35.244.7.110, user name: , config black listed: False, count: 5, extra info: 2019-02-23 06:20:57.5646|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.84, , RDP, 4 2019-02-23 06:21:42.7450|WARN|IPBan.IPBanLog|Login attempt failed: 148.0.42.225, , RDP, 2 2019-02-23 06:22:42.9496|WARN|IPBan.IPBanLog|Login attempt failed: 113.43.225.103, , RDP, 1 2019-02-23 06:25:28.3610|WARN|IPBan.IPBanLog|Banning ip address: 35.200.248.252, user name: , config black listed: False, count: 5, extra info: 2019-02-23 06:31:58.9788|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.104, , RDP, 3 2019-02-23 06:32:14.2389|WARN|IPBan.IPBanLog|Banning ip address: 35.200.168.7, user name: , config black listed: False, count: 5, extra info: 2019-02-23 06:32:44.6614|WARN|IPBan.IPBanLog|Banning ip address: 124.204.36.122, user name: , config black listed: False, count: 5, extra info: 2019-02-23 06:33:59.9966|WARN|IPBan.IPBanLog|Login attempt failed: 117.50.38.119, , RDP, 1 2019-02-23 06:48:01.1399|WARN|IPBan.IPBanLog|Login attempt failed: 113.43.225.103, , RDP, 2 2019-02-23 06:52:01.5260|WARN|IPBan.IPBanLog|Login attempt failed: 148.0.42.225, , RDP, 3 2019-02-23 07:02:32.3574|WARN|IPBan.IPBanLog|Login attempt failed: 113.43.225.103, , RDP, 3 2019-02-23 07:15:33.4230|WARN|IPBan.IPBanLog|Login attempt failed: 193.188.23.38, , RDP, 3 2019-02-23 07:16:48.7741|WARN|IPBan.IPBanLog|Login attempt failed: 113.43.225.103, , RDP, 4 2019-02-23 07:31:20.0803|WARN|IPBan.IPBanLog|Banning ip address: 113.43.225.103, user name: , config black listed: False, count: 5, extra info: 2019-02-23 07:32:50.3637|WARN|IPBan.IPBanLog|Login attempt failed: 148.0.34.241, , RDP, 4 2019-02-23 07:36:20.7361|WARN|IPBan.IPBanLog|Login attempt failed: 193.188.23.38, , RDP, 4 2019-02-23 07:37:35.8310|WARN|IPBan.IPBanLog|Un-banning ip address 92.53.65.59, ban expire: True, whitelisted: False 2019-02-23 07:41:36.4185|WARN|IPBan.IPBanLog|Login attempt failed: 185.81.113.101, , RDP, 2 2019-02-23 07:56:22.6576|WARN|IPBan.IPBanLog|Banning ip address: 148.0.34.241, user name: , config black listed: False, count: 5, extra info: 2019-02-23 08:03:23.3164|WARN|IPBan.IPBanLog|Login attempt failed: 82.202.160.104, , RDP, 4 2019-02-23 08:06:53.8584|WARN|IPBan.IPBanLog|Login attempt failed: 212.92.112.101, , RDP, 1 2019-02-23 08:15:09.5114|WARN|IPBan.IPBanLog|Login attempt failed: 8.37.44.13, , RDP, 3 2019-02-23 08:16:09.6946|WARN|IPBan.IPBanLog|Login attempt failed: 212.92.122.86, , RDP, 1 2019-02-23 08:16:39.8554|WARN|IPBan.IPBanLog|Login attempt failed: 212.92.112.101, , RDP, 2 2019-02-23 08:22:55.2537|WARN|IPBan.IPBanLog|Un-banning ip address 212.92.124.221, ban expire: True, whitelisted: False 2019-02-23 08:24:25.6731|WARN|IPBan.IPBanLog|Login attempt failed: 212.92.112.101, , RDP, 3 2019-02-23 08:25:55.8839|WARN|IPBan.IPBanLog|Login attempt failed: 212.92.112.101, , RDP, 4 2019-02-23 08:27:26.2587|WARN|IPBan.IPBanLog|Banning ip address: 212.92.112.101, user name: , config black listed: False, count: 5, extra info: 2019-02-23 08:30:26.6818|WARN|IPBan.IPBanLog|Login attempt failed: 212.92.122.86, , RDP, 2 2019-02-23 08:32:11.9079|WARN|IPBan.IPBanLog|Login attempt failed: 41.218.94.148, , RDP, 2 2019-02-23 08:43:42.8345|WARN|IPBan.IPBanLog|Login attempt failed: 212.92.122.86, , RDP, 3 2019-02-23 08:44:43.0011|WARN|IPBan.IPBanLog|Login attempt failed: 187.136.251.215, , RDP, 1 2019-02-23 08:45:28.1563|WARN|IPBan.IPBanLog|Login attempt failed: 212.92.122.86, , RDP, 4 2019-02-23 08:46:43.3566|WARN|IPBan.IPBanLog|Login attempt failed: 197.81.213.41, , RDP, 1 2019-02-23 08:46:58.6078|WARN|IPBan.IPBanLog|Banning ip address: 212.92.122.86, user name: , config black listed: False, count: 5, extra info: 2019-02-23 08:50:44.4569|WARN|IPBan.IPBanLog|Banning ip address: 82.202.160.84, user name: , config black listed: False, count: 5, extra info: 2019-02-23 08:51:44.8284|WARN|IPBan.IPBanLog|Banning ip address: 82.202.160.104, user name: , config black listed: False, count: 5, extra info: 2019-02-23 09:00:30.6983|WARN|IPBan.IPBanLog|Login attempt failed: 88.214.26.5, , RDP, 3 2019-02-23 09:00:45.9345|WARN|IPBan.IPBanLog|Banning ip address: 88.214.26.5, user name: , config black listed: False, count: 5, extra info: 2019-02-23 09:08:16.7688|WARN|IPBan.IPBanLog|Un-banning ip address 92.53.65.248, ban expire: True, whitelisted: False 2019-02-23 09:09:17.2415|WARN|IPBan.IPBanLog|Banning ip address: 193.188.23.38, user name: , config black listed: False, count: 5, extra info: 2019-02-23 10:15:37.4225|WARN|IPBan.IPBanLog|Login attempt failed: 103.79.141.128, , RDP, 1 2019-02-23 10:26:53.3484|WARN|IPBan.IPBanLog|Login attempt failed: 103.79.141.128, , RDP, 2 2019-02-23 10:33:53.9580|WARN|IPBan.IPBanLog|Login attempt failed: 108.61.115.131, , RDP, 1 2019-02-23 10:34:24.1180|WARN|IPBan.IPBanLog|Login attempt failed: 108.61.115.131, , RDP, 2 2019-02-23 10:35:09.2691|WARN|IPBan.IPBanLog|Login attempt failed: 108.61.115.131, , RDP, 3 2019-02-23 10:37:54.5941|WARN|IPBan.IPBanLog|Login attempt failed: 103.79.141.128, , RDP, 3 2019-02-23 10:46:25.2456|WARN|IPBan.IPBanLog|Login attempt failed: 108.61.115.131, , RDP, 4 2019-02-23 10:47:10.5118|WARN|IPBan.IPBanLog|Banning ip address: 108.61.115.131, user name: , config black listed: False, count: 5, extra info: 2019-02-23 10:49:10.8607|WARN|IPBan.IPBanLog|Login attempt failed: 103.79.141.128, , RDP, 4 2019-02-23 10:51:26.2506|WARN|IPBan.IPBanLog|Banning ip address: 103.79.141.128, user name: , config black listed: False, count: 5, extra info: 2019-02-23 11:26:43.8233|WARN|IPBan.IPBanLog|Un-banning ip address 115.79.140.146, ban expire: True, whitelisted: False 2019-02-23 11:49:45.8915|WARN|IPBan.IPBanLog|Login attempt failed: 184.105.139.68, , RDP, 1 2019-02-23 11:57:01.8438|WARN|IPBan.IPBanLog|Login attempt failed: 5.202.66.17, , RDP, 1 2019-02-23 11:57:16.9841|WARN|IPBan.IPBanLog|Login attempt failed: 5.202.66.17, , RDP, 2 2019-02-23 11:57:32.1232|WARN|IPBan.IPBanLog|Login attempt failed: 5.202.66.17, , RDP, 3 2019-02-23 12:15:18.4724|WARN|IPBan.IPBanLog|Login attempt failed: 5.202.66.17, , RDP, 4 2019-02-23 12:15:33.6283|WARN|IPBan.IPBanLog|Login attempt failed: 5.160.39.146, , RDP, 1 2019-02-23 12:15:48.7675|WARN|IPBan.IPBanLog|Login attempt failed: 5.160.39.146, , RDP, 2 2019-02-23 12:28:49.8832|WARN|IPBan.IPBanLog|Banning ip address: 5.202.66.17, user name: , config black listed: False, count: 6, extra info: 2019-02-23 12:29:05.1251|WARN|IPBan.IPBanLog|Login attempt failed: 5.160.39.146, , RDP, 3 2019-02-23 12:32:35.3752|WARN|IPBan.IPBanLog|Un-banning ip address 195.154.151.141, ban expire: True, whitelisted: False 2019-02-23 12:34:05.8332|WARN|IPBan.IPBanLog|Login attempt failed: 5.160.39.146, , RDP, 4 2019-02-23 12:34:36.0961|WARN|IPBan.IPBanLog|Banning ip address: 5.160.39.146, user name: , config black listed: False, count: 5, extra info: 2019-02-23 12:35:51.3959|WARN|IPBan.IPBanLog|Login attempt failed: 140.143.0.55, , RDP, 2

Windows 10 log output

2019-02-23 11:45:12.6509|WARN|IPBan.IPBanLog|Stopped IPBan service 2019-02-23 11:45:15.4789|WARN|IPBan.IPBanLog|1149 total ip addresses in the ipban.sqlite database 2019-02-23 11:45:16.3852|WARN|IPBan.IPBanLog|IPBan service started and initialized. Operating System: Name: Windows, Version: 10.0.17763, Friendly Name: Microsoft Windows 10 Pro, Description: Microsoft Windows 10.0.17763 2019-02-23 11:45:16.3852|WARN|IPBan.IPBanLog|Log levels: True,True,True,False,False,False 2019-02-23 11:45:16.4095|WARN|IPBan.IPBanLog|Event viewer query string: <QueryList><Query Id='1' Path='Security'><Select Path='Security'>*[System[(band(Keywords,9227875636482146304))]]</Select></Query><Query Id='2' Path='Application'><Select Path='Application'>*[System[(band(Keywords,40532396646334464))]]</Select></Query><Query Id='3' Path='Application'><Select Path='Application'>*[System[(band(Keywords,36028797018963968))]]</Select></Query><Query Id='4' Path='System'><Select Path='System'>*[System[(band(Keywords,36028797018963968))]]</Select></Query><Query Id='5' Path='Application'><Select Path='Application'>*[System[(band(Keywords,36028797018963968))]]</Select></Query><Query Id='6' Path='OpenSSH/Admin'><Select Path='OpenSSH/Admin'>*[System[(band(Keywords,9223372036854775808))]]</Select></Query><Query Id='7' Path='OpenSSH/Operational'><Select Path='OpenSSH/Operational'>*[System[(band(Keywords,4611686018427387904))]]</Select></Query><Query Id='8' Path='Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational'><Select Path='Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational'>*[System[(band(Keywords,4611686018427387904))]]</Select></Query></QueryList> 2019-02-23 12:13:03.3411|WARN|IPBan.IPBanLog|Login attempt failed: 184.105.247.195, , RDP, 1 2019-02-23 12:26:04.2252|WARN|IPBan.IPBanLog|Login attempt failed: 37.116.137.126, , RDP, 1 2019-02-23 12:26:04.2408|WARN|IPBan.IPBanLog|Banning ip address: 37.116.137.126, user name: administrator, config black listed: True, count: 2, extra info: 2019-02-23 12:36:05.2088|WARN|IPBan.IPBanLog|Login attempt failed: 89.250.82.36, , RDP, 1 2019-02-23 12:36:05.2266|WARN|IPBan.IPBanLog|Banning ip address: 89.250.82.36, user name: ADMINISTRATOR, config black listed: True, count: 2, extra info:

Hello Jeff. Thank you for making your work on this available. I implemented this on one of our servers. It was working, I then disconnected, now cannot regain RDP access. I have setup a new Windows 2016 server, and want to make sure I have the settings right this time.

1. Re instruction "For Windows Server 2008 or equivalent, you should disable NTLM logins and only allow NTLM2 logins. On Windows Server 2008, there is no way to get the ip address of NTLM logins. Use secpol -> local policies -> security options -> network security restrict ntlm incoming ntlm traffic -> deny all accounts."

Does this also apply to Windows Server 2016?

2. If there are more than 5 previous audit fail entries in the existing event log FOR MY IP address - will I be automatically banned? I.e. does IPBan ban IPs based on historical events in the audit log, or only on events 'from here on'?

3. Re: "On some Windows versions, NLA will default to on. This will lock you out of remote desktop, so make sure to turn this option off." Can you please expand or explain this in your instructions. You could add "When NLA (network level authentication) is turned on the IP addresses of the clients trying to log in is not stored in the security audit logs. This makes it harder to block brute force or dictionary attacks by a means of a firewall. Having NLA turned on will lock your out because..."

I did not make this change (overlooked it), so I presume this is what locked me out.

Thank you.
Ken

Detecting and banning SSH logins (with enhanced regex for IP address). Here is the group entry from my IPBan.exe.config:

<!-- This group will block audit failures from failed login attempts to SSH -->
    <Group>
    <Keywords>0x80000000000000</Keywords>
    <Path>Application</Path>
    <Expressions>
        <Expression>
            <XPath>//Data</XPath>
            <Regex>

                <![CDATA[user((\W+\w+){1}?)\W+from (?<ipaddress>((5[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.)
                    {3}(25[0-5]|2[0-4] [0-9]|1[0-9][0-9]|[1-9]?[0-9]))]]>
      
            </Regex>
    </Expression>
        </Expressions>
    </Group>

i try with server 2016eand it work fine.
but i have rdpweb and ipban don t work .
May be have you a solution fot rdweb.

great job

2018-04-21 22:27:39.4594|ERROR|FileLogger|Failed to create event viewer watcher: System.Diagnostics.Eventing.Reader.EventLogNotFoundException: The specified channel could not be found. Check channel configuration at System.Diagnostics.Eventing.Reader.EventLogException.Throw(Int32 errorCode) at System.Diagnostics.Eventing.Reader.NativeWrapper.EvtSubscribe(EventLogHandle session, SafeWaitHandle signalEvent, String path, String query, EventLogHandle bookmark, IntPtr context, IntPtr callback, Int32 flags) at System.Diagnostics.Eventing.Reader.EventLogWatcher.StartSubscribing() at IPBan.IPBanService.SetupEventLogWatcher() in C:\Users\Jeff\Documents\GitHub\Windows-IP-Ban-Service\IPBanService.cs:line 550

Everything is default, using latest release.