A store has several edges
Probes can find the storefront as well as reachable administration, mail, and database services.
Industry blocklist
Retail and Ecommerce blocklist
Keep a storefront and its supporting administration services covered by one current scanner source list.
The coverage
What our sensors observed
Our sensors saw probes against web, mail, database, and administration services that a store may expose. When a store runs this service mix, the mapping spans its public site and the systems used to manage it.
Why use this feed
A store may run its public site, administration panel, mail, and database access through different systems. Use the observed source list in the edge rules already protecting those services instead of gathering scanner IPs from several logs by hand. Review any new block against customer checkout and approved staff or partner connections. The feed supplies addresses for the rule; it does not replace the access controls on the store itself.
The challenges
Scanning can reveal a reachable service before an exploit attempt, whether a flaw is known or still undisclosed. Our sensors record sources doing that probing. A firewall rule using the feed can deny a listed source before its next connection reaches your service, without needing to recognize the exploit itself.
Exploitation may follow
If one of those public interfaces has a weakness, a later request can try it before the store has reviewed its logs.
First contact is too late
A listed source can be stopped at the web or service edge before it appears in that store’s own records.
Edge enforcement
Defend your edge
The feed loads matching rules into your firewall. Listed sources are intercepted before crossing the edge; traffic with no match continues to your services.
Where this feed fits
Use the observed source list where your existing edge controls meet these reachable services.
Apply the list through the firewall or gateway serving a public store. Review the rule against normal customer traffic.
Use the same source list at the web edge that serves checkout. Keep existing payment and customer access controls in place.
Put the feed in front of reachable site and account management panels. Restrict staff access separately.
Review scanner sources around a database interface that is reachable from outside. Check the applications that still need a connection.
Apply the list at mail gateways supporting store operations. Review it against messages from legitimate partners.
Distribute one updated list to the web edges for each store. Local rules can still account for customers and partners at each site.
Industry blocklist
Start blocking observed scanner sources.
Choose this industry, connect the feed to your firewall, and review access with the people who run each service.