SMTP connection from (localhost.localdomain)

I have continuous connections from different ips with this helo. Blacklisting the ip in cphulk and the smtp blacklist has no effect.


SMTP connection from [xxx.xxx.xxx.xxx]:43659 I=[xxx.xxx.xxx.xxx]:587 (TCP/IP connection count = 1)
SMTP protocol error in "AUTH LOGIN" H=(localhost.localdomain) [xxx.xxx.xxx.xxx]:43659 I=[xxx.xxx.xxx.xxx]:587 AUTH command used when not advertised
SMTP connection from (localhost.localdomain) [xxx.xxx.xxx.xxx]:43659 I=[xxx.xxx.xxx.xxx]:587 lost
no MAIL in SMTP connection from (localhost.localdomain) [xxx.xxx.xxx.xxx]:43659 I=[xxx.xxx.xxx.xxx]:587 D=4s C=EHLO,AUTH,RSET

If I block based on helo, and add localhost.localdomain to the blocklist, will it cause problems, or just drop the connection from all these ips using localhost.localdomain?

TCC

April 03, 2015 17:00

I've set up the heloblocks as described in this thread

cPanelMichael

April 08, 2015 17:24

Hello, I am happy to see you were able to find a useable solution. Note that you may want to block those IP addresses in a firewall if the same ones continue to make connection attempts. Thank you.

April 09, 2015 12:23

A firewall would be ideal, but unfortunately CSF won't run on this VPS. I've tried all the installation tweaks I can find but have had no luck.

April 10, 2015 19:00

You may want to consult with CSF's support forums (forum.configserver.com) or consider an alternative firewall such as APF. Thank you.

SMTP connection from (localhost.localdomain)

Comments

Didn't find what you were looking for?