Exchange
401 responses on /owa, /ecp, /ews, ActiveSync, MAPI, RPC, Autodiscover and OAB, OWA form logons, event 4625 from w3wp.exe plus SMTP, POP3 and IMAP protocol logs.
Exchange, IIS & mail
Protect Exchange, IIS and mail servers against brute force
OWA, ActiveSync, SMTP AUTH and web applications are popular targets for password spraying. ServerBouncer reads the logs of IIS, Exchange and mail servers and blocks attackers centrally via WFP.
IIS and web servers
IIS logs as well as Apache and nginx access logs. Web scan rules detect requests for paths such as /.env or /wp-login.php and bursts of 404 responses.
Mail servers and FTP
Mail servers with a JSON-lines log, regex templates for hMailServer, MailEnable, SmarterMail, MDaemon and Kerio Connect, among others (marked as unverified), plus IIS FTP and FileZilla.
Thresholds per endpoint
Every endpoint has its own thresholds – for example stricter for admin interfaces and more lenient for ActiveSync, where mobile devices with an old password produce many failures. A block applies to all ports of the source or only to the chosen ones.
More use cases
Try ServerBouncer on your servers
Starts in learning mode – you first see what would be blocked.