Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a bit of an issue, this has caught my attention yesterday. Someone or something, a botnet I presume, has been trying to gain access to specific e-mail addresses.

The server software keeps blocking the login attempts but the problem is that I keep getting more and more hits. The IPs are not from one specific range but from all over the world.

There are a little over 500 attempts since Feb 26th. Is there anything I can do to block this "attack" besides blocking the IPs after an X amount of attempts?

I am running a CentOS server with Direcadmin installed. I use csf+lfd as a add-on.

share|improve this question
1  
Small semantic but email address and email accounts are two different things, distinguishing them is needed to understand the solution. –  ETL Feb 27 at 22:06
    
Sorry, it is a specific e-mail address. It is attacking admin@example.com and admin@example2.com –  sevvlor Feb 27 at 22:11
1  
You don't attack an email ADDRESS. You can send spam to it. You can try to logon to an ACCOUNT which is linked to an ADDRESS. You're talking about login attempts, so that is an ACCOUNT. An address is like a door number. Does not mean who lives there. It means there is a house there you can route mail to. –  ETL Feb 27 at 22:14

1 Answer 1

up vote 2 down vote accepted

Cancel that email account, make a new one for the person who owns it. Make the address an alias to the new one so the emails can still be received.

share|improve this answer
    
I'll try this for now. Thanks for the tip! If there are more suggestions please let me know. I'm a little paranoid. –  sevvlor Feb 27 at 22:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.