The InfraFence network

An address that attacks one InfraFence customer is likely to attack the next. The network lets organizations that choose to share benefit from each other's detections.

Sharing#

Under Settings › Network, Share attacker addresses with the InfraFence network. Only the attacker's address, the event types and the counts are shared. Never your servers, domains, users or files. An address is shown to others only after three or more organizations have seen it. Organizations that share also see the network's reputation of the addresses that hit them, in the incident analysis.

Network autoblock (Basic and higher)#

Also block the addresses the network reports (Basic): your servers also ban the addresses banned by five or more paying organizations in the last 30 days, up to 1,000 addresses. It needs sharing turned on first.

Real-time network bans (AutoMode)#

When two AutoMode organizations ban the same address within an hour on strong evidence, every AutoMode organization that shares bans it too, for 6 hours. It never touches your whitelist or the networks you log in from. At most 100 new addresses an hour are spread this way.

What stays private#

Your servers, domains, users, files and logs are never shared. The Global view shows network-wide figures only where three or more organizations contributed, and the top attacker addresses only to organizations that share.

Whitelisted addresses are never banned, whatever the network reports.