I've been having trouble the past couple of days with one of my VM servers bogging down to the point that I've had to hard-reset it (and all the VMs on it, of course). I finally traced down the problem to the FTP server's resource usage; it was singlehandedly using so much of the VM server's resources that nothing else could get a thread in edgewise. This morning I was giving it a once-over and I discovered this: Well, I knew my router wasn't trying to repeatedly log in using a nonexistent account name, but clearly what it was doing was performing NAT translation on the incoming traffic so I couldn't see the source IP address. That explains why the autoban feature built into FileZilla Server had always caused all traffic to come to a halt within a few hours of turning it on -- it was just autobanning everything coming through the router. Thanks IT guys back at HQ, good planning. So, having discovered all the pieces of the problem, I turned off NAT translation on all traffic going to/from servers with public IP addresses, and turned on the autoban feature on FZS, and then I saw this: As it should be. That's one hackbot that won't be bothering me for a while.