ConfigServer Community Forum

Ok, open your CSF Configuration and search for:

SECURITY WARNING
================
LF_EMAIL_ALERT

Sergio

For me it is better to find ModSec blocks info on /etc/apache2/logs/error_log

Check if you have that file and you can use that file to write your own rule at:
/usr/local/csf/bin/regex.custom.pm

Sergio

Access the account with webmail, in webmail on the front page enter into "Email Filters" and create there a rule to delete the emails that you don't want to receive. Example: SUBJECT CONTAINS blocked AND BODY MATCHES REGEX auth failed|Failed password for root|Incorrect authentication data ...

If you still have the password for that email, go to cPanel recreate the account with the old password. Then access the "Manage an Email Account" for that specific account and set the following: Restrictions Receiving Incoming Mail: Suspend Sending Outgoing Email: Suspend Logging In: Allow...

I haven't seen this option in CSF. But you can do the following: - When an attack to xmlrpc.php is blocked, you can send the reportl to an email address of yours from all the servers you have. - Create a bash script that reads all the emails each 15 minutes and get the offending IPs and add the IPs ...

I didn't mean all your attacks, lol.
Just paste an example.

What you need to block is the offending IP not the account.

If you can, paste the text of the failed login and rewrite sensitive info with xxxxx.

Sergio

If you can, paste the text that follows to the message on your image.
The text that follows is the one that is needed to know what needs to be white listed.
If there is sensitive information about an account in your server, you can replace it with xxxxx.

Sergio

I had the same issue on my servers and I resurrected the old /usr/mailscanner/etc/mcp for my use. It works really well and you can copy and paste all the info from server to server. I even created an script that can feed the MCP blacklist with emails that are sent from specific email addresses. The ...

Hi. On some emails the "From Address" are shown in blank, please see the image: https://ibb.co/MNWQczf Checking on the headers of the emails that show this behavior I see: Received: from netman.individualpool.net ([93.119.106.16]:34528 helo=zlm0.lclbgdzb.com) by xxxxx.yyyyyyy.zzz with esmt...