Alert for distributed smtpauth attack ONLY when successful Login

Post Reply
shenzy
Junior Member
Posts: 22
Joined: 11 Feb 2009, 23:59

Alert for distributed smtpauth attack ONLY when successful Login

Post by shenzy »

Hello,
The 99% of my "distributed smtpauth attack alerts" are for "535 Incorrect authentication". It would be nice if the alert is sent only when successful access to the email account is detected.
NotLim
Junior Member
Posts: 7
Joined: 27 Feb 2013, 23:42

Re: Alert for distributed smtpauth attack ONLY when successful Login

Post by NotLim »

Actually, it is.

The subject is:

Code: Select all

lfd on server.domain.tld: blocked distributed SMTP Logins on account [account@domain.tld]
Post Reply