Block IP Addresses In HttpModule
<p>I have taken over a domain that had was running an old version of Community Server. Needless to say the bots are spamming me trying to find holes.</p>

<p>I'd like to block entire IP blocks before <code>System.Web.HttpRequest.ValidateInputIfRequiredByConfig()</code> is fired. I have a <code>IHttpModule</code> that I have tried but I assume it's getting called after because HealthMonitoring is catching the Exceptions. Here is the module:</p>

<pre><code> public class IpBlockerModule : IHttpModule
{
    private static readonly string[] Hacks = new[]
                                                 {
                                                     "60.169.73.",
                                                     "60.169.75.",
                                                     "61.160.232.",
                                                     "61.160.207.",
                                                     "92.85.161."
                                                 };

    public void Dispose()
    {

    }

    public void Init(HttpApplication context)
    {
        context.BeginRequest += (Application_BeginRequest);
    }

    private void Application_BeginRequest(object source, EventArgs e)
    {
        var context = ((HttpApplication) source).Context;
        var ipAddress = context.Request.UserHostAddress;

        if (!IsHackIpAddress(ipAddress))
        {
            context.Response.StatusCode = 403; // (Forbidden)
        }
    }

    private static bool IsHackIpAddress(string ip)
    {
        if (ip == null) return true;

        return Hacks.Any(x =&gt; x.StartsWith(ip));
    }
}
</code></pre>

<p>And the relevent web.config sections:</p>

<pre><code>&lt;system.web&gt;
    &lt;httpModules&gt;
      &lt;add name="IpBlockerModule" type="MyNameSpace.IpBlockerModule" /&gt;
    &lt;/httpModules&gt;    
&lt;/system.web&gt;

&lt;system.webServer&gt;
    &lt;validation validateIntegratedModeConfiguration="false" /&gt;
    &lt;modules runAllManagedModulesForAllRequests="true" &gt;
      &lt;add name="IpBlockerModule" type="MyNameSpace.IpBlockerModule" preCondition="" /&gt;
    &lt;/modules&gt;   
&lt;/system.webServer&gt;
</code></pre>

<p>The reasoning behind this is my inbox is getting spammed from all the </p>

<pre><code>A potentially dangerous Request.Path value was detected from the
client
</code></pre>

<p>and</p>

<pre><code> A potentially dangerous Request.Form value was detected from the client
</code></pre>

<p>notifications. Is something wrong with my Module, or am I correct in assuming modules don't get fired until after the fact?</p>
