Hi,

Its currently possible to ban specific ip addresses in mojoPortal under Administration > Advanced Tools > Banned IP Addresses, but its not currently possible to bane address ranges unless you have some external firewall. Often if you have a dedicated server there may be a firewall provided with it, like this site is hosted on a dedicated server and I get a firewall that I can manage from a web page as well.

You did not mention how you concluded they are trying to hack your site.

I have not noticed any recent changes of dramatic increase of crap in my logs that looks like hacking but I monitor it so frequently that perhaps I've already banned a bunch of the bad ones.

I would note that sometimes things that look like hacking may not be. There are some software out there that people use to create a local html copy of a site and sometimes people do it on this site to get the documentation, it crawls a bit agressively and raises some errors which is rude but I know in some cases I have found it was not malicious intent. One time I looked up the ip and it was a registered user so I contacted him and he responded apologetically and told me about the software (I forget the name of it, its probably still buried in my old email though) he was using to gather documentation.

Also things like viewstate errors can happen when the user has a slow connection and they click buttons before the page is fully loaded so you have to use good judgement about whether an error indicates hacking or you may ban too many people.

If I see lots and lots of errors on the same page in rapid succession I get suspicious, but only a few errors are very clearly hacking attempts. Sometimes you can see sql injection attempts in the url or other things that are clearly malicious and you can ban those guys with confidence.

Best,

Joe