I've had this problem for a very long time. I thought I'd reported it but can't find any trail in these forums of my email so I must be imagining it.
When I get an email about a brute force attack, the time of the email and the end time of the block are the same. I had convinced myself that the block was happening anyway and that I was just too slow logging on to see the block in the brute force tab.
Today I was pretty quick off the mark (within 5 mins of getting the email) but there was no block listed
Attached are the email with times highlighted and the brute force settings. If I correctly understand the mechanism, I would expect these settings to give an initial block of 20 mins, followed by blocks of between 5 and 100 minutes.
I wondered if it was a timezone discrepancy but I can't figure out how. The Joomla config has website timezone set to Melbourne, which is UTC+10 (or +11 in DST). I understand that the servers are physically in this timezone
Any idea how I can make sure that blocks are really happening, and also be reassured by the emails?