This article explains why an IP address might not be blocked after exceeding the maximum number of failed login or failed signup attempts. Suspicious IP Throttling uses specific configurable fields to determine when an address is restricted based on login and signup activity.

• Suspicious IP Throttling
• Signup attack
• Universal Login

The issue occurs because the throttling rate, also known as the refill rate, allows an IP address to regain available login attempts over time.

Consider a maximum attempts field value set to 50 and a throttling rate of 100 per day for Suspicious IP Throttling. This maximum attempts value allows an initial burst of 50 failures; however, a throttling rate of 100 per day allows approximately one additional attempt every 15 minutes. If failed logins are distributed throughout the day and never fully deplete the allowed attempts to 0, an IP address can trigger up to 150 failed attempts before a block is enforced, because the system continuously replenishes the allowed attempt count.

Logins and signups have separate configurable values for both maximum attempts and throttling rates.

Keep these in mind when planning to set custom values for each and when evaluating which parameters to increase or decrease.

Related References