Hit 500 failed login attempts blocked by my firewall in a single day last Tuesday

That number made me realize how many random bots are just constantly pinging random IPs looking for an open door, has anyone else checked their logs lately?

1 comments

1 Comment

simontorres3d ago

Yeah that number is pretty normal actually. 500 attempts in one day is on the low side for a public IP. Most home routers see thousands of those a day from all the random scanning scripts running out there. The real problem isn't the number of attempts, it's that you're blocking them at the firewall at all. If you've got an open port for SSH or RDP you're already behind the curve. Should be using key based auth and maybe a VPN if you actually need remote access. Those bots are just casting a wide net, they don't care about you specifically until they find a way in. So 500 blocks is good news really means your firewall is doing its job.