• Our team is looking to connect with folks who use email services provided by Plesk, or a premium service. If you'd like to be part of the discovery process and share your experiences, we invite you to complete this short screening survey. If your responses match the persona we are looking for, you'll receive a link to schedule a call at your convenience. We look forward to hearing from you!
  • We are looking for U.S.-based freelancer or agency working with SEO or WordPress for a quick 30-min interviews to gather feedback on XOVI, a successful German SEO tool we’re looking to launch in the U.S.
    If you qualify and participate, you’ll receive a $30 Amazon gift card as a thank-you. Please apply here. Thanks for helping shape a better SEO product for agencies!
  • The BIND DNS server has already been deprecated and removed from Plesk for Windows.
    If a Plesk for Windows server is still using BIND, the upgrade to Plesk Obsidian 18.0.70 will be unavailable until the administrator switches the DNS server to Microsoft DNS. We strongly recommend transitioning to Microsoft DNS within the next 6 weeks, before the Plesk 18.0.70 release.
  • The Horde component is removed from Plesk Installer. We recommend switching to another webmail software supported in Plesk.

Question I installed fail2ban but it doesn't block these attacks and ips

S

shopuser

Basic Pleskian
I installed fail2ban but it doesn't block these attacks and ips

Oct 28 19:11:11 server authpsa[487]: No such user 'mail@mai.com' in mail authorization database
Oct 28 19:11:11 server courier-imapd: LOGIN FAILED, method=PLAIN, ip=[::ffff:85.95.203.99], port=[58892]
Oct 28 19:11:16 server courier-imapd: Disconnected, ip=[::ffff:85.95.203.99], port=[58892], time=5
Oct 28 19:11:17 server courier-imaps: Connection, ip=[::ffff:85.95.203.99], port=[38000]
Oct 28 19:11:17 server authpsa[485]: No such user 'mail@mai.com' in mail authorization database
Oct 28 19:11:17 server courier-imaps: LOGIN FAILED, method=PLAIN, ip=[::ffff:85.95.203.99], port=[38000]
Oct 28 19:11:22 server courier-imaps: Disconnected, ip=[::ffff:85.95.203.99], port=[38000], time=5, starttls=1
Oct 28 19:11:23 server courier-imapd: Connection, ip=[::ffff:85.95.203.99], port=[59450]
Oct 28 19:11:23 server authpsa[487]: No such user 'mail@mai.com' in mail authorization database
Oct 28 19:11:23 server courier-imapd: LOGIN FAILED, method=PLAIN, ip=[::ffff:85.95.203.99], port=[59450]
Oct 28 19:11:28 server courier-imapd: Disconnected, ip=[::ffff:85.95.203.99], port=[59450], time=5
Oct 28 19:11:29 server courier-imaps: Connection, ip=[::ffff:85.95.203.99], port=[38572]
Oct 28 19:11:29 server authpsa[486]: No such user 'mail@mai.com' in mail authorization database
Oct 28 19:11:29 server courier-imaps: LOGIN FAILED, method=PLAIN, ip=[::ffff:85.95.203.99], port=[38572]
Oct 28 19:11:34 server courier-imaps: Disconnected, ip=[::ffff:85.95.203.99], port=[38572], time=5, starttls=1
Oct 28 19:11:34 server courier-imapd: Connection, ip=[::ffff:85.95.203.99], port=[59774]




i have all jails activated.



jorgee-bots Aktiv
named-ddos-udp Aktiv
named-refused-tcp Aktiv
named-refused-udp Aktiv
plesk-apache Aktiv
plesk-apache-badbot Aktiv
plesk-courierimap Aktiv
plesk-modsecurity Aktiv
plesk-panel Aktiv
plesk-postfix Aktiv
plesk-proftpd Aktiv
plesk-roundcube Aktiv
plesk-wordpress Aktiv
postfix-auth Aktiv
postfix-flood-attack Aktiv
recidive Aktiv
ssh Aktiv

i dont have a user with the name mail@mai.com, but this is a valid mail adress, the mail adress have a alias to login.
 
You must log in or register to reply here.

Similar threads

F
Issue Fail2ban: Ip addresses are not blocked by Recidive
Replies
14
Views
1K
frg62
F
wakabayashi
Question SMTP Firewall - is it possible to block brutforce attacks?
Replies
3
Views
629
Vladimir C.
V
wakabayashi
Resolved Fail2Ban - Postfix not working for SASL (bug?)
Replies
4
Views
2K
mizar
mizar
J
Question Fail2ban filter courier imap fails.
Replies
1
Views
1K
Peter Debik
P
S
Resolved How to obtain the IP of a webmail login
Replies
2
Views
1K
SalvadorS
S
Back
Top