Checked the syslog and its like a ghost in the machine rummaging through our open ports. Theres dozens of failed auth tries right when im about to hit the sack. Cant tell if its just some bored script kiddie playing with fancy toys or a serious bot net gearing up. Im slapping that block on the firewall now before whoever it is gets any bright ideas. Lets see how long they stick around once they realize ive got them on a leash.