Flag next to ip adres

[triple]

Hello,

• I think it is a good idea to have a flag of the country next to the ip adres (ip of the (web) server, when CIS intercepts a connection) in CIS firewall alerts. The flag must only be shown of ip addresses of the web server, so you know exactly where a connection is coming from.
• optional can be shown a link to some geo tools, but the best will be, if the firewall had built in tracing map… 8)

[triple]

@m00nbl00d

I voted yes, but more like to have a frequency of the most attacking countries.

But, what would be the real purpose? There’s no way to know if the blocked IP is from a real attacker.

Or do you have something else in mind?

Thank you for your support m00nbl00d!

Yes the purpose is this: When seeing an alert now, you see remote ip for example, but in now way you know to what country that certain program is connecting… (read: the location of the webserver, where that particular ip adress belongs too…) The Flag should always be listed there, even when there is no attack… it helps gaining trust, also for novice users, when they know for example the connection stays in there own country… it can calm them down…

When hovering over the flag, you see the countryname, an even better also the city! optional you can open a map, when right clicking the flag for example…

This are some handy stuff, other firewalls have incorporated a very very long time ago…

[triple]

@m00nbl00d

I like that. Perhaps, one better way and wouldn’t “wasting” resources from Comodo for that, could be to open a browser in the official DShield site www.dshield.org and place the IP on the search field and automatically give the results. I mean, more detailed ones and folks would also know if there have been any other reports for that IP.

That’s something I suggest to Melih. For Comodo to have a dedicated server to make data correlation from our firewall logs and then send us back a database, in the form of a block list, into the firewall, so that those attackers are blocked, even before they attempt the attack. It would be a coincidence, for example, one same IP targeting many users.

It is better to prevent, then to block on hit. What you think? Any other suggestions? I know is a bit off topic, but goes in the same line, I guess. Sorry.

Regards

I personally do not like always to open a browser window, just to check something… but if people want more detailed results, opening a browsers that has some geo apps is not bad I think. But I prefer just the flag and hover over functions and for more details you can open a browser window…

The blacklist database is a good idea! +1 :-TU

[LarryLaser]

@DaRtH VaDeR. post:3

I personally do not like always to open a browser window, just to check something… but if people want more detailed results, opening a browsers that has some geo apps is not bad I think. But I prefer just the flag and hover over functions and for more details you can open a browser window…

The blacklist database is a good idea! +1 :-TU

The Blacklist/Blocklist is a good desire ;D, the better option is the ability to import the blacklist/blocklist you desire (:CLP).
I have been creating my own blocklist database for my own systems for years. There are many people out there on the Web, that you can trust, that are researching the Internet and build databases in categories that are useful. (:KWL)
Sites Like; DShield, BlueTack, IBlock and many others.
Importing the built list would be a great option :comodojiggy:, and being able to customize it your self is better, "Block List Manager"http://www.bluetack.co.uk/forums/index.php?act=dscript&CODE=showdetails&f_id=61
In my opinion, this would be the best option.

[lupin]

+1

[ilkerol]

• 100000 O0