Topic: Fail2Ban against Qpsmtpd IP 212.83.168.232

[SchulzStefan]

The IP 212.83.168.232 attempts a lot times against Qpsmtpd.

https://www.talosintelligence.com/reputation_center/lookup?search=212.83.168.232

brings up:

Hostname   front.koozali.org

What does this mean?

regards,
stefan

[Daniel B.]

This is the main IP address of Koozali's infra, including the one emails of our mailing lists are sent from. When you say "attempts" I guess you mean this server tries to deliver emails to you, which is probably legitimate. Please send any further info to security@contribs.org and we'll investigate if necessary

[Daniel B.]

Please send me directly some logs of those SMTP transactions (from your qpsmtpd logs)

[SchulzStefan]

This might have been the reason:

#config show qpsmtpd BadCountries
qpsmtpd=service
    BadCountries=snip - FR - snip

I deleted FR from my list and will report back, if this helped.

regards,
stefan

[Daniel B.]

This certainly can be a reason
Koozali infra is hosted in France indeed

[SchulzStefan]

It was the reason.

regards,
stefan

[CharlieBrady]

#config show qpsmtpd BadCountries
qpsmtpd=service
    BadCountries=snip - FR - snip

NATO allies, are they not?

[SchulzStefan]

NATO allies, are they not?

They are, of course. My bad. I should trust any French IP. J'aime beaucoup nos amis francaise. And it's not only because of the Bordeaux-Wine and the delicious food... This is going to be OT now...

regards,
stefan