Too many failed logins from xx.xx.xx.xx for facility portal. UTM9

IP 45.140.17.26 ?
Scans around the world. located in russia.

You should not publish any portal to the internet ... or use country blocking at least.

Yes, I think so. Are there any additional steps we should take besides country blocking? I believe we’ve only published the user portal, not the admin portal. Should we consider not publishing the user portal as well?

Regards & Thanks

Yes, I think so. Are there any additional steps we should take besides country blocking? I believe we’ve only published the user portal, not the admin portal. Should we consider not publishing the user portal as well?

Regards & Thanks

You should not publish the userportal to the internet ... or use country blocking at least.

We need to publish the user portal, as its the most practical way to get TFA setup for our SSL VPN clients (most of our users are remote, so can't set this up in the office). We have country blocking on, and I did use a custom port. We did still get attempted brute force attacks recently from multiple IPs, so in the end I changed the custom port and its been quiet since.