The fastest way to block suspicious IPs in your Windows Firewall! The script utilizes the IP blacklist from stamparm's ipsum repository, an open-source project that tracks suspicious IP addresses ...
"In intrusions where firewall logs were captured, message event ID 238 (WAN zone remote user login allowed) or message event ID 1080 (SSL VPN zone remote user login allowed) were observed ...