Hit 2,000 blocked threats on my home router, then realized I was tracking the wrong thing

I keep a little spreadsheet of every blocked attempt on my home network, just for fun since 2019. Last month the counter passed 2,000 and I got all excited, but then I looked closer and saw most of those were just the same three bot IPs hammering my port 22 every single day. What actually mattered was the one odd PowerShell callback from a smart plug firmware update that I almost ignored. That got me thinking, how do you all separate real alerts from noise when your logs pile up like that?

1 comments

1 Comment

lucaslane2d ago

You ever have one of those moments where you realize you've been keeping score in the wrong game? I feel you. I did the same thing with my firewall logs for years. Was super proud of hitting 1,500 blocked pings, then found out it was literally one printer trying to phone home every hour. The real scary stuff always hides in plain sight. I started tagging any new device IP as "suspicious" until it's been clean for a week. That smart plug thing is exactly why I check firmware reviews before I even plug stuff in now. Logs mess with your head. Makes you feel busy but not safe.