Out of Continent Access Control

Yes we used geoip for most of the rules mentioned in the article, less crazybrowser which is blocked everywhere. We also added a 2 hour blacklist to any ips/users that trigger any of the aformentioned rules, and subsequent ips/users are also blocked. We allow the attacker to log in prior to blocking so that we may harvest the users that he managed to exploit.

 

 

two factor authentication will probably not fly in our environment(higher education).