IIS, IDS, and Me.

I've just been going over my IIS logs and can see a number of attempts from various IP addresses to find a way into my system and to hack my website To help deal with this I'm currently developing a program that will examine the historical logs for suspicious activity, and add the IP addresses identified as the source of the suspicious activity to the IP deny list for the website being targetted Eventually this will evolve into a service that will actively monitor inbound web activity, and automatically add any IP addresses involved in suspicious activity to the DENY list of the targetted website Right now? It's reading the log files nicely, and presenting a list of those IP addresses it had identified as being the source of suspicious activity I'm working on getting it to identify the name of the website being targetted (I am hosting several on the same server), once I can identify the target domain, I can sort out the mechanics of getting the DENY list updated by the program, and not manually Once I get that done? I look at making it an active monitoring service that will automatically add suspicious IP addresses to the DENY list as soon as they happen Cheers -=A=- .