Status page shows:
http:BL is enabled and has blocked 0 visits (0 blacklisted and 0 greylisted).
- Nothing in watchdog
- Nothing listed on: admin/reports/blocked_hosts

Blackist check: On all requests
Caching: Database cache and Drupal access table

Looking at my webstats I can see visits from multiple IPs that are active in the projecthoneypot.org database.
http://www.projecthoneypot.org/ip_85.117.224.52
For example; shouldn't that user be caught and blacklisted?

Comments

bryrock’s picture

bryrock commented

Can you post a screenshot of your settings? (block out your honeypot account).

Make sure you are not only checking comments, but "all requests."

The example you sent would not be blacklisted by default (it would have been greylisted with a white-list challenge). The default blacklisting threshold is a threat score higher than 50.

dvancamp’s picture

dvancamp commented
Status: Active » Closed (works as designed)

Thanks bryrock. Just checked back in and it has greylisted 17 and blacklisted 1. Didn't make any changes to the settings just seems to have taken a day for it to "kick in" - probably a caching issue. Many thanks.