Whatoblock

Within minutes of going online, a new server has strangers' computers trying its doors. Most of them are automated scanners and hijacked machines, and blocking each one by hand from your logs never ends. Whatoblock runs HoneyBot, a network of decoy servers that exist only to record who knocks. Each source is sorted as a scanner, a proxy, a flood source that takes sites offline, or a server that steers hijacked machines.

For blocking, you pick your industries, factory control systems included, and the threat categories you want. Your firewall or DNS filter then fetches one self-updating feed from a URL with an API key. Nearby addresses can be merged into blocks of 256 when a firewall prefers ranges.

Each recorded connection can also be looked up with its source address, time, port and network. Paste an address from your server logs, one IPv4 address or record ID at a time, and every observation from that source appears, including the packet it sent. Hosting companies and internet providers who verify their network number get a daily email listing up to 60 of their addresses seen attacking others.