Running www.netsecdb.de with drupal and survived tenthousands of exploit attacks since january 2008.
first of all i scripted a live-monitoring block:
I used ssl-links for saftey. clicking an IP opens a popup that requests IP-segment safety info from my database - you can change to call phpwhois or utrace instead.
popup defines in overall html-page header (javascript):
<!--- Whois 0.2 Hack start --->
<script type="text/javascript">
function showwhoispop(url, width, height) {
window.open(url,"whois","toolbar=no,scrollbars=no,resizable=yes,width="+width+",height="+height+"");
}
</script>
<script type="text/javascript">
function showexternwhois(url, width, height) {
window.open(url,"externwhois","toolbar=no,scrollbars=no,resizable=yes,width="+width+",height="+height+"");
}
</script>
<!--- Whois 0.2 Hack ends --->
block-code:
<?php
$number = db_result(db_query('SELECT COUNT(uid) AS number FROM {users} WHERE status=1'));
if (user_access('access content')) {
// Count users with activity in the past defined period.
$interval = time()-variable_get('user_block_seconds_online', 900);
$guests = db_fetch_object(db_query('SELECT COUNT(sid) AS count FROM {sessions} WHERE timestamp >= %d AND uid = 0', $interval));
// Perform database queries to gather online user lists.