Large amount if failed SMTP access CSF

[NodeWest-Dan]

Has anyone else seen a large amount of SMTP access attempts being blocked via CSF/LFD today? Been seeing it on two different networks.

 

[XFS_Duke]

Yes, I have as well... 90-100 emails every few hours. Woke up yesterday to over 500... lol... Lovely... I checked access logs and such, nobody logged in but me... Sooo yea... LFD and CSF are doing their jobs apparently. Just thought it was me until now.

 

[NodeWest-Dan]

Yes, I have as well... 90-100 emails every few hours. Woke up yesterday to over 500... lol... Lovely... I checked access logs and such, nobody logged in but me... Sooo yea... LFD and CSF are doing their jobs apparently. Just thought it was me until now.

It's mostly in the AM for me from all over the world. But yes. Thank god for CSF haha

 

[AMDbuilder]

The past few days we have seen a good size increase in SMTP blocks.  I'm glad they go to a dedicated address not on my phone!

 

[wlanboy]

Can you please check your logs if it's this:

 

[sv01]

yes, but most of them try to login to random name @company.com

 

[NodeWest-Dan]

Can you please check your logs if it's this:

I'll take a look later today. That's probably what it is. We get this occasionally but never to the extent we had it yesterday. We also had it go through our DNS servers the day before.

 

[NodeWest-Dan]

yes, but most of them try to login to random name @company.com

Those are random names as well but not eve @company just "Rhonda" or "Steve"

 

[peterw]

I got about 100 fail2ban mails today. Every request from another ip. Is this a bot network searching for open relays/mail servers?