REPORT - Login Success / Failure count by Country
Idea shared by Rod Strumbel - 8/6/2020 at 6:03 AM
Proposed
I've seen the request for the ability to block by Country, and understand that could be a complex task of configuring.  Could we possibly in the interim get a REPORT that would show in the same typical Hourly/Daily/Date Range break-downs the number of successful and number of failed login attempts by country?   

We are just blocking countries in our Firewall and started thinking how much are we blocking that is valid client access (could be assumed by successful login... granted a cracked account would skew the numbers, but for the most part it would indicate a CLIENT traveling (for us anyway)).  

A report simply showing (for example, don't read anything into this, these are OUR big hackers):
Country       Login-OK   Login-FAIL
China               22        8,345
Netherlands          0          734
Russia               3       16,455
Vietnam              0          999
United States  475,132       16,343

etc.
That would at least allow us to make a semi-informed decision before preventing an entire country from accessing our email server at the firewall level.

I'd just be  interested in it being a SYSTEM WIDE report, I can see others wanting it possibly by domain though as well.

2 Replies

Reply to Thread
0
Agree, this would be a good way to prevent unwanted traffic.
And system admin can see login fails from any country, which country source is attacking mail system.
0
I would not recommend blocking ANY country for email service. The traveling customers will find these issues, eventually. Good security practice and there is no need to block any IP.

Just my opinion.

Thanks,
Ron

Reply to Thread