Hello,
I am newbie.
One of my client claims that the access from his PC has been blocked many times by csf recently.
He restarts the rooter, then the new ip address allocated by DHCP changes(He uses dynamic ip address) and he can access to the site for a while, however, his new access ip is blocked soon again and again.
I also received the alert of csf many times when his access ip address was blocked. I unblocked that ip address manually but the new ip after rooter restarts is blocked soon by csf.
The below is one of them. I have never seen such an alert.
I added the following ip in white list temporarily, however, it is not the basic solution.
Please let me know how I can fix this trouble.
IP: 180.4.***.*** (Providers name)
Failures: 5 (smtpauth)
Interval: 3600 seconds
Blocked: Yes
Log entries:
2019-11-11 23:53:22 dovecot_plain authenticator failed for p2443234-Providers name([IPv6:::ffff:192.168.1.8]) [180.4.***.***]:64954: 535 Incorrect authentication data (set_id=UserID)
2019-11-11 23:53:39 dovecot_login authenticator failed for p2443234-Providers name([IPv6:::ffff:192.168.1.8]) [180.4.***.***]:64954: 535 Incorrect authentication data (set_id=UserID)
2019-11-11 23:54:21 SMTP call from p2443234-Providers name [180.4.230.234]:64960 dropped: too many syntax or protocol errors (last command was "?\b?\006?\035?\027?\030?#???\026???\027???\r?0?.\004\003\005\003\006\003\b\007\b\b\b \b")
2019-11-11 23:54:22 SMTP call from p2443234-Providers name[180.4.***.***]:64962 dropped: too many syntax or protocol errors (last command was "?\b?\006?\035?\027?\030?#???\026???\027???\r?0?.\004\003\005\003\006\003\b\007\b\b\b \b")
2019-11-11 23:55:07 dovecot_plain authenticator failed for p2443234-Providers name ([IPv6:::ffff:192.168.1.8]) [180.4.***.***]:64968: 535 Incorrect authentication data (set_id=UserID)
Any advice would be appreciated.
Thank you.