ConfigServer Community Forum

Do you know if the attack target is to WordPress or Joomla sites?

Sergio

It suggest that DENY_IP_LIMIT in your CSF is configured to only handle 552 bans.

Sergio

MailsScanner is one thing and using an RBL at exim side is more effective, that is why I am asking if you have checked that IPs. If you haven't done it yet, get one IP and check that at www.mxtoolbox.com using the black list option, open your EXIM and add the RBL to EXIM, that is more efficient that...

You said that the emails comes from different IPs, have you checked those IPs against RBLs? If so, what RBLs are these IPs on? Have you tried to add the RBLs to exim?

Sergio

If it is light blue, the email is sent to the destinatary, if it is blue (darker) it means that the email was deleted at your server side, no email is sent to the other party. This way you will be discarding all the emails that triggers your rules.

Try to ban by "subject" or "email content", to do that you can use MCP, that is very effective. Doing this, MailScanner will block all the emails that comes with what you specify on the MCP rules.

Sergio

It is good to read the latest readme or the "man csf".
This post is very old and there has been a few csf changes over the years:

csf -tr, -temprm ip
Remove an IP from the temporary IP ban or allow list

Ok, do what you want, but in the mean time read:
http://www.iana.org/assignments/service ... bers.xhtml
http://tcp-udp-ports.com/linux-ports.php
http://aihr.us/server/what-ports-should ... el-server/
http://knowledgelayer.softlayer.com/faqs/139

Check that server IP is not blocked.

You need to have port 25 open IN and OUT in TCP and UDP.