cPHulk show our server IP address

okamigo

• February 26, 2020 01:02

Hello, When I check the server for brute force attack, in the IP section it shows the IP of our server, and in the Authentication Service section it shows dovecot, country LT, although the server is not even in this country. Can someone explain why it shows the IP of our server?

• 

  cPanelLauren

  • February 26, 2020 15:49

  Hello, Do you have username blocking enabled in cPHulk? This would explain the local IP address being shown if the username is getting blocked it logs the same data as an IP address block. As far as the country reported is concerned, it bases that off the country code associated with the IP when performing the geoip lookup.

  0
• 

  keat63

  • February 26, 2020 19:14

  I can't comment on why your IP is being listed, but I can comment on the country association. The Geo Loookup, is not 100% accurate. I had a user based in an office only 100 yards away from mine, the Geo lookup had her 4000 miles away in the USA.

  0
• 

  okamigo

  • February 27, 2020 06:29

  Hello, Do you have username blocking enabled in cPHulk? This would explain the local IP address being shown if the username is getting blocked it logs the same data as an IP address block. As far as the country reported is concerned, it bases that off the country code associated with the IP when performing the geoip lookup.

  
  NO, this user is not blocked, its show email which does not exist.

  0

Please sign in to leave a comment.