@bl968 This plugin is designed exactly for the purpose of tracking and blocking distributed attacks.

BruteProtect sounds like a good tool that the greater community can collectively get behind, to gradually erode the recent bot-net outbreak. It strikes me as a good investment.

But my understanding of this kind of distributed IP-collection and blocking, is that it does not immediately confer 'positive' protection on sites using the service. With 90,000 or more bots in the attacking network, attacks on particular sites can continue, and the general menace, though steadily losing IPs to BruteProtect, continues to be a threat.

I am concerned that some are getting the impression that BruteProtect actually stops the attack-pattern, and eliminates the hazard, as soon as it's deployed. If I understand correctly, that is really not how this kind of response works at all.

A good analogy for this service might be the community mosquito control programs that are launched in some places, to reduce the blood-sucker population that is spreading some infection. Drain unused swimming pools. Turn buckets upside down. Spray swampy areas, etc. Gradually, a heavy load of mosquitoes is reduced; the numbers of bites fall, and with that the number of people coming down with the disease declines.

But being part of the mosquito-suppression campaign does not confer any "positive" protection from mosquito bites on any of us, individually. Nor are we in any way guaranteed that if we are bitten, we will not get sick, since we now have a good, responsible control-program up & working.

To be really protected from 'skeeters, we need to wear long-handled clothes, DEET, and possibly even netting. To provide ourselves with similarly direct, immediate, solid protection from the brute-force bot, we have to find those 'lazy' usernames & passwords, and get them changed to decent versions.

The bots are still buzzing around, looking for a blood-meal, even with BruteProtect working on eventual control. And like with mosquitoes, all we will ever really have, is that "degree" of control that we've worked to establish. Both the insects and the bots will still be out there, just not as thick.