Multiple Failed Logins from Single IP

nomit vyas@xoxo

•updated Apr 30, 2026•2•0•160

This rule detects an IP address attempting to log in unsuccessfully to more than 20 distinct user accounts. This behavior is indicative of a brute-force attack or password spraying attempt against multiple accounts from a single source.