Gray list - database

[contact]

When checking the gray list I see alot of ips and I just installed IM360.
Are all these gray listed on other Imunify360 servers and imported to our installation? If one IP on that gray list does remove themselves, are that IP populated to other Imunify360 servers and removed from the grey list?

Edit: http://docs.imunify360.com/terminology.htm
"Agent continuously negotiates Gray List with CloudLinux DDoS reputation server to get latest updates regarding graylisted IPs."
-> How often does the agent negotiate with CL server? And if a IP is gray listed on our server, will it be distrubuted to other servers?

[morten]

Hi Morten,

> Are all these gray listed on other Imunify360 servers and imported to our installation?

IPs from pre-populated graylist are those notified on at least two other Imunify agents or honeypots. That is simplified explanation for scoring rules being processed on Imunify central server.

> If one IP on that gray list does remove themselves, are that IP populated to other Imunify360 servers and removed from the grey list?

IP graylist unblock is propagated to other Imunify servers if when user from greylisted IP is unblocked by captcha. Manual graylisted IP edits (via Imunify agent cli) do not propagate to other Imunify servers. At least for now.

[morten]

Ok, thanks for your answer IP graylist unblock is propagated to other Imunify servers if when user from greylisted IP is unblocked by captcha -> How quick those this happend? Will it be propegated at once or is there a cron running once each hour or something?

[morten]

> How quick those this happend? Will it be propegated at once or is there a cron running once each hour or something?

The first option. The feed about raising botnets is delivered immediately.