Knowledgebase

IP reputation is a very effective way of securing your website. It’s a database with information about various IPs in the world. BitNinja secured websites use IP reputation information automatically on their websites to make security decisions and to find out more about an IP address.

Every website with BitNinja can detect and defend a wide range of attacks. The website can send gathered incident information to our central database. Based on the type, timing, and amount of incidents an IP has in the database, it is categorized into one of the following lists:

Not listed​

If there is no information about an IP address, or based on the latest behavior the IP is not listed.

User Greylist​

In traditional IP reputation terminology, we differentiate black- and whitelists. An IP can be trusted (whitelisted) or absolutely denied (blacklisted). This concept is very inflexible and this is the cause of the bad reputation that IP reputation lists have. If an IP is false-positively blacklisted, users will get angry at you because they can't access the system they want to and they will be frustrated as they are unable to do anything about it.

That's how the concept of greylisting was born. We wanted to represent a list of IPs we think may be malicious but we are not completely sure of it yet.

The greylist contains suspicious IPs that the BitNinja client handles with special care. BitNinja has different CAPTCHA modules for different protocols. The duty of a CAPTCHA module is as follows:

• Decide if the user is human or not
• Inform the user about the fact that his/her IP has been greylisted
• Provide a safe way for the user to delist his/her IP
• Save any requests made by non-human parties, growing the knowledgebase about the IP and the sin list.
• Honeypotting by pretending to be a vulnerable system so bots will try to connect

Global greylist​

If there is enough evidence that an IP is suspicious, we move it to the global greylist and distribute this information to every BitNinja secured website.

Global blacklists​

When an IP is globally greylisted and is still sending malicious requests, we identify it as dangerous. Such IPs are moved to the global blacklist we maintain. BitNinja websites will drop packets for IPs on the global blacklist. The false-positive rate of the global blacklist is very low, as there are many steps before we decide to blacklist an IP. Blacklisted IPs are moved back to the greylist from time-to-time to check if the traffic is still malicious or the system has been disinfected.

Essential list​

Essential list provides protection against the most dangerous IPs. These IPs are often used by the most agressive hackers all around the world. When an IP generates more than 5000 malicious requests, BitNinja places it on this list. The essential list is part of our basic IP reputation package, so it's available for every BitNinja secured website.