Please could I check something with this mod?
There's 2 kinds of rules you can set up for failed login attempts. 1 is for any IP address in eg. 5 mins and the other is for 1 IP address in eg. 5 mins. I think I understand the alerts produced for 1 IP address in eg. 5 mins in that 1 IP address has made multiple attempts to access accounts and has failed? but was does the alert for any IP address in eg. 5 mins mean? It will mention a handful of usernames but only one IP so I'm not sure what the IP relates to in that situation?
|