Support

Hello,

We have received hundreds of the "Security Exception due to login failure" notifications overnight. Based on the frequency (1 per second at one point) and the random IP addresses, this must be automated. Blocking IP addresses with Admin Tools > Web Application Firewall > Site IP Blacklist has only seemed to increase the volume and frequency.

It seems the traffic is all coming from outside the US.

Any thoughts about what to do? Thanks in advance. -SL

Keep in mind that hackers don't use their own IP addresses. Blacklisting the IPs won't help much to end the attack and those IP addresses may be used by real customers in the future.

The auto-ban feature is better for this situation. You can ban an IP address that creates X exceptions in Y minutes for Z amount of time. So the ban will automatically expire and not block future customers.

If the IP addresses used in the attack are truly random and are not repeating, there is very little you can do.

Thanks Dale! That's a great idea. I'll try that out. -SL

You're welcome!