This message was deleted.

I tested with Workspace App and the responder policy did appear to block my authentication ability using it/the embedded browser. Not sure how we continued to get failed auths from that IP given the fact it didn't change and it did break for me.

Just a guess, because it isn't a new connection, yet? NetScaler hasn't gotten the chance to filter the request and drop it before the bad actor refreshes their browser / still has an anonymous-connection, maybe.

Ah, yeah maybe so....I was opening new chrome private mode instances or refreshing Workspace App when I tried.

You should be doing this at the firewall, i'd think

I agree, but our netsec team was busy sleeping and stuff and doing netsec team stuff

Haha. Definitely, good point. =D