In our security logs, I’m noticing several brute force attack attempts on several of our websites, all coming from the same set of IP addresses. Although from looking at the paths they are attempting to target, I know they will not succeed, I’m guessing they are targeting the sites by doing some sort of domains by IP address lookup.
For some sites, I have an automated black-list created and cached, with lookups done on each request through a…
protected override void OnActionExecuting(ActionExecutingContext filterContext)
…method in my controller base class.
Are there any other measures that can be taken to prevent these attempts?
You should simply block these ips in your firewall and iis. Also some firewalls will do automatic blacklisting here if it’s a non ssl connection