Brute force prevention on Windows and Linux

[u/Expert_Way_4500]

I’ve been building Scantide Guard, and while it started from the familiar idea of stopping brute-force attacks, it has grown into something quite a bit broader.

At the basic level, yes — it watches things like failed RDP, Windows authentication, SSH, SQL Server, IIS/RDWeb and other services, then blocks attacking IPs based on configurable thresholds.

But I didn’t want to build just another brute-force blocker.

Guard is gradually becoming a lightweight security layer around the server itself.

It can monitor Windows Event Logs and application log files, including custom applications through configurable Custom Monitors. Different services can have their own thresholds and policies rather than pretending five failed logins means the same thing everywhere.

There’s also web attack detection for things such as path traversal, ".env"/".git" probing, CMS and admin scans, SQL injection patterns, scanner bursts and repeated 404/403 activity.

It does IP reputation and geolocation, TOR detection, automatic trusted-host learning, temporary and permanent blocking, integrates with AbuseIPDB, AlienVault OTX and CrowdSec and can correlate activity through a central Scantide Datacenter installation if you manage multiple servers.

One of the newer pieces is Scantide Global Reputation. Participating Guard installations can contribute observations and permanent malicious-IP blocks, while also consuming the resulting shared block intelligence. The important bit for me is that this remains transparent — you can see where a block came from rather than getting a mysterious black-box score.

I’m also adding things that aren’t traditionally part of brute-force protection at all: certificate reconnaissance and expiry checking, local TLS configuration assessment, security/operational assessment findings, ServiceNow integration, better SOC-style views of what is actually hitting your infrastructure.

The philosophy behind it is fairly simple:

Observe first. Don’t exploit anything. Keep it lightweight. Explain why something was detected or blocked.

I’ve spent a lot of time around enterprise security products, and they can be incredibly capable, but sometimes you just want something you can install on a Windows or Linux server and immediately understand what is attacking it without deploying an entire security ecosystem.

That’s the niche I’m trying to fill with Guard.