> more than 20 such attempts If I am testing a login I don't need 20+ failed attempts to know it's not working. Sometimes the simple answer is the correct one.

> more than 20 such attempts If I am testing a login I don't need 20+ failed attempts to know it's not working. Sometimes the simple answer is the correct one. The series of events does not read as someone, whose job has been reported to disable security and demand root access to systems, testing the already in place login system to make sure Russian IPs (specifically) can not log in.