<![CDATA[Purpose – This study designs and evaluates an integrated web-security workflow combining ModSecurity, AbuseIPDB, Iptables, and Telegram to connect attack detection, IP-reputation assessment, conditional firewall-rule management, and real-time administrator decisions. Methods – A Research and Development approach was applied in a controlled Ubuntu 24.04 laboratory using Apache 2.4.58, OWASP Core Rule Set, Python 3.12.3, a PHP test application, AbuseIPDB API, Telegram API, and Iptables. Eighteen payloads, comprising six cross-site scripting, six SQL injection, and six local file inclusion cases, were each executed once under two reputation conditions defined by an Abuse Confidence Score threshold of 75. Findings – ModSecurity rejected and logged 18 of 18 selected malicious requests with HTTP 403 responses. All 9 of 9 high-risk cases produced the expected Iptables rule insertion, while all 18 detected events generated Telegram notifications with appropriate Blocklist or Whitelist controls. These results confirm completion of the configured workflow but not subsequent packet rejection from verified network-layer sources. Research implications – Generalizability is limited by the small attack-only dataset, single execution per payload, one laboratory environment, absence of legitimate-traffic controls and advanced evasion tests, reliance on X-Forwarded-For values, and lack of follow-up connections. Consequently, specificity, false-positive rate, production reliability, and actual network containment remain unmeasured. Originality – This study extends prior ModSecurity and AbuseIPDB integration by adding reputation-based Iptables rule insertion and interactive Telegram rule management within one reproducible, human-in-the-loop response chain.]]>
Copyrights © 2026
