ConfigServer Community Forum

That depends on what you want to do, you can add it to QUICK DENY or TEMPORARILY ACCESS/DENY buttons, or you can add them to your own CSF GLOBAL DENY file. What IP address to use, again, depends on what you want to do, single IP address, /24 range or /16 range. /24 is used in most cases but /16 is m...

Great sawbuck!
That is a good solution for MSFE, hope Sarah adds this on the next MailScanner update, so, all the domains added in MSFE white list could be added automatically to the skiprbldomains file.

Sergio

Do you know if the attack target is to WordPress or Joomla sites?

Sergio

It suggest that DENY_IP_LIMIT in your CSF is configured to only handle 552 bans.

Sergio

MailsScanner is one thing and using an RBL at exim side is more effective, that is why I am asking if you have checked that IPs. If you haven't done it yet, get one IP and check that at www.mxtoolbox.com using the black list option, open your EXIM and add the RBL to EXIM, that is more efficient that...

You said that the emails comes from different IPs, have you checked those IPs against RBLs? If so, what RBLs are these IPs on? Have you tried to add the RBLs to exim?

Sergio

If it is light blue, the email is sent to the destinatary, if it is blue (darker) it means that the email was deleted at your server side, no email is sent to the other party. This way you will be discarding all the emails that triggers your rules.

Try to ban by "subject" or "email content", to do that you can use MCP, that is very effective. Doing this, MailScanner will block all the emails that comes with what you specify on the MCP rules.

Sergio

It is good to read the latest readme or the "man csf".
This post is very old and there has been a few csf changes over the years:

csf -tr, -temprm ip
Remove an IP from the temporary IP ban or allow list

Ok, do what you want, but in the mean time read:
http://www.iana.org/assignments/service ... bers.xhtml
http://tcp-udp-ports.com/linux-ports.php
http://aihr.us/server/what-ports-should ... el-server/
http://knowledgelayer.softlayer.com/faqs/139