How an address ends up on the list
Protection that blocks the wrong thing does more harm than good. That is why the methodology for how something gets into the lists — and how it gets out again — is the most important part of WF SecurityCloud.
Four questions about every address
What did it do?
A clear attack pattern carries more weight than a single connection that may have an innocent explanation.
How often?
Repetition over time separates a systematic attack from a one-off mistake.
Where does it appear?
Hits across several independent sensors weigh more than many hits in one and the same place.
Still active?
An address that has been quiet for a long time loses weight and eventually drops out of the lists.
What can go wrong, and what we do about it
The most serious risk is blocking something that should not be blocked. That happens above all in three situations, and all three require active handling.
Shared addresses
Many users can share the same outbound address, for instance behind a company firewall or at a mobile operator. One attacker among them should not lock out everyone else. Such addresses require stronger evidence.
Reused infrastructure
Addresses in cloud services change customer. A server compromised last month may today belong to someone else entirely. That is why the lists are perishable goods, not an archive.
Legitimate scanning
Search engines, monitoring services and security testing sometimes behave like a scan. Known sources of that kind are not treated as attacks.
Onto the list and off it again
An address is not permanently blocked. Weight is built up by confirmed observations and decreases when they stop. If an address stops appearing it drops out of the lists by itself.
That means the protection reflects the situation now, not the history. A list that only grows becomes both slower and more error-prone over time.
- Observations add weight, silence removes it
- Several independent sources are required before an address gains full weight
- Shared and dynamic addresses are judged more strictly
- Known legitimate sources are excluded
- Lists are updated continuously rather than in large batches
If you or one of your customers is blocked and it is wrong, get in touch with the address and the time. We will review the evidence and correct it if it is a mistake. We would much rather hear about a wrong block than have it stay in place.
Report a wrongful block
Send the address and roughly when it happened and we will look at it.