• Our team is looking to connect with folks who use email services provided by Plesk, or a premium service. If you'd like to be part of the discovery process and share your experiences, we invite you to complete this short screening survey. If your responses match the persona we are looking for, you'll receive a link to schedule a call at your convenience. We look forward to hearing from you!
  • We are looking for U.S.-based freelancer or agency working with SEO or WordPress for a quick 30-min interviews to gather feedback on XOVI, a successful German SEO tool we’re looking to launch in the U.S.
    If you qualify and participate, you’ll receive a $30 Amazon gift card as a thank-you. Please apply here. Thanks for helping shape a better SEO product for agencies!
  • The BIND DNS server has already been deprecated and removed from Plesk for Windows.
    If a Plesk for Windows server is still using BIND, the upgrade to Plesk Obsidian 18.0.70 will be unavailable until the administrator switches the DNS server to Microsoft DNS. We strongly recommend transitioning to Microsoft DNS within the next 6 weeks, before the Plesk 18.0.70 release.
  • The Horde component is removed from Plesk Installer. We recommend switching to another webmail software supported in Plesk.

How to block smtp_auth hackers what are targeting a specific account?

E

eugenevdm

Regular Pleskian
I get this in my Qmail log files:

tail -f /usr/local/psa/var/log/maillog | egrep -i "unable|failed|refused|error|warning|listed"

Apr 2 13:40:30 server_name smtp_auth: FAILED: compromised_user@domain.com - password incorrect from 189-11-216-61.dsl.cbace701.brasiltelecom.net.br [189.11.216.61]

Apr 2 13:40:54 server_name smtp_auth: FAILED: compromised_user@domain.com - password incorrect from ip-address-pool-xxx.fpt.vn [118.71.120.165]
Click to expand...

This repeats over and over from all different IP address. At some stage the compromised user's password was changed so the spammers can't get back into that account.

However, I want to take additional precaution and permanently block those IP addresses. Please recommend something that checks for repeated failed logins on SMTP and then block the IP addresses.
 
You must log in or register to reply here.

Similar threads

E
How to Set up Your WordPress Website Security
Replies
0
Views
2K
Elvis Plesky
E
danami
Resolved Juggernaut Security and Firewall Plesk Addon
4 5 6
Replies
114
Views
40K
danami
danami
T
Urgent, POP Login Problem After Plesk 11 Upgrade
Replies
3
Views
3K
KDawson
K
M
Need smtp_auth messages even if authentication is successful
Replies
1
Views
2K
madcat
M
P
Failed sudo on Migration
Replies
0
Views
4K
Phoenix Rising
P
Back
Top