Homelab Hero · No. 012: your result

Blocked the door they already used. 0 Hero Points.

Blocking the address treats the symptom: the login already succeeded, hours ago, from an address the intruder can change in seconds. If they left a new account, a key, or a scheduled job behind, none of it cares about your router rule — and by tomorrow's audit the logs you needed may have rotated past the one night that matters.

The lesson: A successful login is a compromise until proven otherwise. Blocking the source IP is not a response.

Share your result:
Homelab Hero No. 012 — I blew the call on the foreign-login call (0/100). Think you would call it better? Play it: https://homelabherald.com/hero/012?s=0

Share it: Post to X WhatsApp Text Reddit Facebook LinkedIn Email

Tomorrow’s incident drops with the next issue at 7:00 AM PT.

Play it again · Read Issue No. 012