ConfigServer Community Forum

Last night I found this in the exim_mainlog, but, CSF never blocked it?

IP address 195.3.136.124
Hostname ns5.a1isp.co.uk
ISP Internet On Demand Ltd
Country United Kingdom
2009-04-24 00:46:47 fixed_login authenticator failed for (localhost) [195.3.136.124]: 535 Incorrect authentication data (set_id=test)
2009-04-24 00:46:48 fixed_login authenticator failed for (localhost) [195.3.136.124]: 535 Incorrect authentication data (set_id=test)
2009-04-24 00:46:49 fixed_login authenticator failed for (localhost) [195.3.136.124]: 535 Incorrect authentication data (set_id=test)
2009-04-24 00:46:51 fixed_login authenticator failed for (localhost) [195.3.136.124]: 535 Incorrect authentication data (set_id=info)

Etc... Etc... For a while...

Looks like exim/cPanel have changed the log line format and the regex isn't picking it up. I'll have a new regex in place in the next release.

CSF is the best! Thanks...