ConfigServer Community Forum

Hi. Go to CSF, then go to "LFD BLOCKLISTS", look in there the blocklists that you are using. Check if the IP is blocked by any of the BLOCK LISTS that you are using, to do that go to /var/lib/csf and search the IP on all the /var/lib/csf/csf.block.NAME black lists in there. The next step w...

Hi.
Please read https://download.configserver.com/csf/readme.txt
maybe some of your questions will be answered there.

Sergio

Hi. This area is not to resolve doubts about REGEX rules, please use the regular forum.
When you move your question to that area I will answer it there, thank you.
Sergio

Are you using ModSecurity?
Does ModSecurity gives you the rule number that the offending IPs are triggering?
If so, then you can block the attacks in realtime creating your own CSF rules.

Sergio

The best thing is to create your own spamassassin rules for the spam that is not catched by MSFE and assign a very high score. Then create rules for CSF (firewall) to block the server that sent the spam and at last another CSF script to check if more that 10 IPs from the same IP range have been send...

Yes, try adding that specific IP on the ALLOWED IP list

Sergio

Righ now MailsCanner Front-End just have 4 buttons when checking an email, they are: BLACKLIST EMAIL, BLACKLIST DOMAIN, WHITELIST EMAIL and WHITELIST DOMAIN. Would you please consider 2 more: BLACKLIST *.DOMAIN AND WHITELIST *.DOMAIN ? Right now there a thousand of attacks from domains like: root@bn...

Another way to fix this could be to edit the entry at:

/var/lib/csf/zone/us.zone
from this 104.171.32.0/ to 104.171.32.0/20

Yes, in her computer go to:
settings -> system -> about
if it has not been changed by her, it should appear something like per example: DESKTOP-03TITAJ
and that name is what you could search for in all /usr/local/cpanel/logs/ files, hope that will give you a hint on where is the issue.

see above post