Kdjykuj

Over the last week, there is a constant barrage of authentication failures to my email account from a variety of ip addresses - usually in blocks of exactly 575 attempts.

My password is as strong as a password can be so the chance of brute force winning is infinitesimal. However as a result of the authentication failures, my hosting provider keeps locking the email account.

Is there anything I can do (or that I can ask my hosting provider to do), or am I just screwed until the botnet moves on? Anyone with similar experience who can comment on whether I can expect this to ever end?

No. That's pretty much the background noise of being on the internet.

From a random server I have with e-mail:

$ sudo grep -c "auth failed" /var/log/mail.log

1109

That's today. It's with fail2ban blocking more than five attempts from the same IP.

A few thoughts:

• Usually my first recommendation would be to pick an extremely strong password. But you allready got that covered.


• If there is two factor authentication available, turn it on. If you are lucky, it might make you an unattractive target and cause the attacker to move on.


• If the account lock out doesn't affect other methods of reading your mail, like via IMAP, you could switch to that to maintain access. (To be honest, I don't know much about the security of IMAP, so you might want to consider that before turning it on.)


• Forwarding the mail somewhere else will also ensure that you can read it even if your account is locked.


• Finally, you can try contacting your email provider. I think your best bet here is to just describe the problem to them, and ask what they can do to help you.

Yeah, it's pretty easy to have your official email address forward your emails to a new "burner" email account. Then in the new email account setup, you set your From: field to your official email address. That way mails go out like this.

 From: account-I-always-had@oldserver.com

 Subject: Re: so-and-so

 In-Reply-To: <4735813474834434634@theirmail.com>

 Sender: burneraccount@newserver.com

Or something like that.

Anyway, that lets you keep your identity at the official email address. The attacks on the login server are irrelevant to receiving and forwarding email.

As is evident from the above, your new email address may be obvious from headers so don't set up an autoresponder. Only correspond with people you trust. If this burner email account comes under attack, trash this burner account, setup another one, and tell the official email server to forward to the new burner.

Then, research who you sent mail to in the last 2 days to the last burner account. One of them compromised it. Use one tactic or another to trick them into attacking this or another burner account, that lets you distinguish who exactly did it.

You can set a firewall before your server and with right configuration you can reduce brute force attempts.

You try with your MTA configuration, an example can be Postfix:

smtpd_client_restrictions =

        permit_sasl_authenticated,

        reject_rbl_client zen.spamhaus.org,

        reject_rbl_client bl.spamcop.net,

        reject_rbl_client cbl.abuseat.org,

        reject_rbl_client sbl-xbl.spamhaus.org,

        permit permit_mynetworks,

        permit_inet_interfaces,