BitNinja will log every request from a challenge listed IP address until the IP address is not delisted. Every request from a challenge listed IP address will be considered as an incident because a human visitor would have already delisted the IP address via one of the CAPTCHA page.
- If BitNinja detects a malicious request from an IP address, then it will be on the account-level challenge list
- After generating an incident at four unique BitNinja accounts, the IP will be globally challenglisted
- If there are more than 50 incident logs about a globally challengelisted IP address, we will send an abuse email to the email address associated with the IP address
- After 500 incidents, the IP address will be blocklisted globally
- After 5000 incidents, the IP will be listed on the Essential list, which means that the IP address can not be delisted and BitNinja won’t log the requests from this IP address.
Any manual IP delisting is automatically broadcasted. BitNinja agents do refresh automatically every 3 seconds, so this process takes around this amount of time.
Automatical delist processes:
We automatically move IP addresses from the blocklist to the global challenge list which generates no incident logs for more than 2 days. So the owner can delist the IP address.
If there are no logs about a challenge listed IP address it will be delisted:
– Static IP addresses: 3 months without logs
– Dynamic IP address: 7 days without logs
We automatically move IP addresses from the blocklist to the global challenge list which generates no incident logs for more than 2 days. So the owner can delist the IP address.
If there are no logs about a challenge listed IP address it will be delisted:
– Static IP addresses: 3 months without logs
– Dynamic IP address: 7 days without logs