My domain host's server is blocking my IP address every few days

Firstly my domain host is being helpful and is quick to unblock me, and is investigating the issue, so I am not going to knock them. They are doing their best.

The issue is simple. Every few days my host's server detects a few failed attempts to login to my emails using my email address and wrong passwords and blocks my IP address. According to my host's server logs it is my IP address, email address and wrong passwords that is responsible. Obviously it's not me - I know my password and I normally have no problem in logging in. The timing of the block doesn't tie in with any activities on my part. However something or someone is trying with the wrong password and as a result the server reacts by blocking my IP address. Apart form blocking my access to my in and out emails, it also blocks everyone's access access to a couple of web sites based on this domain. Needless to say, as far as I and Avast can tell, my PC is clean.

I have tried various things to prevent this without success - resetting the email access details, looking at all possible other sources of access attempts, but only my PC and laptop are setup to access my mail server. No one could possibly have access to my computer or laptop (only my wife and I use the IP address unless that IPa address is shared with any machine outside my house. My wife's email address uses the same @domain_name and that has never triggered any problems.

As I said, my domain host is looking into it but I get the impression they don't really know. Hopefully this forum of hi-spec experts may have suggestions!

Hi, Ian.

The POP3 (PST) email address that I setup when I connected to your computer, in my opinion was not completed properly due to time restraints.
After this, you decided (from memory) to revert back to using IMAP

Did you remove the POP3 (PST) account from your Microsoft 365 APP after you decided to stay with IMAP?
Is there any chance that Outlook is checking for mail from an IMAP and a POP3 (PST) account for the same email address at the same time?

I ask this because if your email client is checking both protocols at exactly the same time, the end server might confuse this as an attempt to exploit (I’ve seen similar issues before) and block your IP.

I agree with Sinto. I truly believe in this day and time, modern email apps are designed around using imap which is a modern protocol, If a user has an email account set as pop on one device and imap on another, all kinds of weird issues can pop up. I also agree your issue could well be due to a timing conflict caused by having a mixed pop/imap environment if you also receive your mail on your phone. Try going into your modern email app (such as Outlook 2021, Outlook 365) and change how often the app scans for new emails.

glasskuter said:

If a user has an email account set as pop on one device and imap on another, all kinds of weird issues can pop up.

Click to expand...

When I left it, there were both an IMAP and a POP3 account in the same Outlook app on one computer, for the same email address (I think) which is my concern. I don’t believe we had time to remove the IMAP after the POP3 was setup, due to time restraints.

Pressing send and receive for 5 different email accounts (mixed protocols or not) at the same time is fine.
Pressing send and receive and having Outlook send requests for the same email address with two different protocols at the same time, to me is a problem.

But for all I know, Ian removed one later on. Which would rule out my concerns.

Sigurd said:

email address and wrong passwords that is responsible.

Click to expand...

This sounds like what I'm seeing when I look at the information for my Microsoft account. At least very recently, there's attempted logins to my account, but I don't get blocked, thankfully. MS is showing that it's mostly unauthorized login attempts from Brazil.

Hi all - thanks for your (continuing) interest in my email woes!

Both IMAP and POP accounts were involved the first few times after Antspants helped set them up because of another issue. After the penultimate block, at the host's suggestion (which evidently they got from Plesk) I deleted both accounts and recreated the IMAP one so I have only had that account running. The penultimate block a few days ago was while I only had the IMAP one running. I hadn't setup the POP one again. So while a reasonable suggestion, and one why I hadn't reinstalled POP after I got the suggestion to setup the account again, it didn't prevent a further block.
Incidentally, the POP account was for a different address - different domain but obviously it was being accessed from same IP.

Although I have just sent the above (2210 BST). I started it this morning. In the meantime I have been blocked again - around midday - neither my emails nor my web sites based on the two domains.

I understand that this company is being helpful, I understand that you don’t want to knock them, but if they can’t tell you what it is being sent from your PC that is causing your IP to be blocked, to me, that is inadequate.
Either it’s your PC or their server that is the cause. Even their hosting & email information is kind of out of date.
There would be entries in their logs that have some indication of why your IP got blocked every time it happens. Like what your connection sent that caused a block.

If it is someone else attempting to access your email, it will say so due to IP addresses accessing their web server..

Their web-based mail server should have brute force protection in place, which turns on when it detects a specific large number of frequent, unsuccessful login attempts. The problem, however, could be in the IMAP or POP3 configurations of your email client.
Having an error in the stored login credentials or if using SMTP validation, for example, (which doesn’t prevent the software from trying to reach out to the server on the web), could result in the connection attempt being blocked as well.
I know, for a fact, that when I setup your POP email address it was setup correctly, just as I have setup a POP/PST email in Outlook 1000’s/countless times for many people, including a couple of this forums members, remotely.
The settings were correct proven by the successful attempts to get mail. The only thing I didn’t do was remove the IMAP account.

As we are past this and you have undone everything I setup, I don’t know what may be configured incorrectly, If anything.

Have they asked you to ping their server address? What is it they said they have done?

Search for command prompt from your toolbar and right click on it and open as admin
Type into the command box
Ping [space] 87.239.18.135
Or click on the cfollowing to copy to your clipboard and paste it into the command box
Ping 87.239.18.135
Press enter
Take a screenshot of your result or highlite/copy the result and paste in between these codes:

[ICODE]replace this text[/ICODE]

A note regarding the company you use “YNH”
Their troubleshoot/help information is by far out of date, it is also contradicting. They are so out of date they show information for how to setup “Windows Mail” although the settings should be the same for Outlook, it’s still old info and I wonder if they have noticed the following:

In one instance in their POP setup instructions page, they tell you to use “mail.yourdomainname.co.uk” for the mail server settings
A couple of lines down, they tell you to use “mail.tnhltd.co.uk” for both POP3 & SMTP
It’s either one mail. address or the other.
And to add, they also have a 3rd address mail.ynhsmtp.co.uk which they randomly throw into the mix.
Plus, they don’t show you the ports to use for POP & SMTP. I believe we had to ask. Defaults are usually 465/995
They also ask you to use clear text authentification. I don’t even think Outlook has that as an option. The secure authentication setting I used elude me at the moment.

We used mail.ynhltd.co.uk for incoming and outgoing (POP/SMTP)

A question; have you changed anything in your wifes laptop? Does she also access stbees email?

Don't open Outlook.

Open Control panel by searching for it in your taskbar

1. At the top of control panel, type mail

2. Open Mail (Microsoft Outlook)





3. Open "Email Accounts"
4. Open "Data Files"
5. Open "Show Profiles"
6. Go back into "Email Accounts"

You could skip steps 7 & 8 and scroll down to Open Outlook

7. Select "New"




8. Add your IMAP email account

The problem here without the above:

Open Outlook:

Hi Sinto. Thanks for taking the time to help, especially when you rightly feel I scrapped all you did during the remote access session. I can assure you that had not been a waste of your time as as I had noted what you did and after I "undid" it and when I set it up again the settings were as you had done them, except that the mail servers were what YNH sent me directly. I had not looked at the help section your refer to.
In the meantime, the information YNH sent me (from their logs) in respect of what was happening is that it was failed attempts using my email address and my IP address. They are trying to sort things out, and my reluctance not to be critical of them is that over the 25 years I have used them they have been nothing but helpful. They are a small company, so the service is very personal. No endless list of press 1 for this 2 for that etc.
One thing that may or may not be relevant is that some months ago they changed their server provision.
As for my wife's PC, she was affected in the same way, her email address uses the same domain, Her Outlook is set up same as mine.
The settings we use are the ones YNH gave me after the first 3 or 4 lock outs.
Server - In and out - ynh4.uk.easy-server.com
In port - 993
Out port - 465
Encryption SSL/TLS

I'll go through your extensive suggestions above, thanks for your time on this, later this morning. I have to go out for a while now.

And again, sorry if you feel I threw away your previous work. I assure you I didn't.

Sigurd said:

And again, sorry if you feel I threw away your previous work. I assure you I didn't.

Click to expand...

Sorry Ian, it’s Ok I don’t feel anything about it, people change their mind, I know you were/are grateful. Maybe bad wording on my part. I just meant that I don’t know what might of changed since the settings I put in and the settings that are now oput in place. The difference being, it worked at the time we did it, now it doesn’t.

I really do not recall the in & out being ynh4.uk.easy-server.com. I am certain I’d remember that interesting address.
It wasn’t all that long ago that we setup, so perhaps all addresses are relevant. But I truly don’t remember that address. I can’t find my notes.

Sigurd said:

I had not looked at the help section your refer to.

Click to expand...

I did, before I connected to your PC. I knew our time was limited so I wanted all the info I could get to get through it.


The only info I recall YNH giving us,or that we needed, was the In & out port numbers.

Hold up. I take it back.

The info Alison sent you is as follows.

The details you would need for POP3 are as follows:

Incoming Mail Server POP3: ynh4.uk.easy-server.com
Username: youremail@stbees.org.uk
Password: corresponding email password
Port 995
SSL = ON

Outgoing Mail Server SMTP ynh4.uk.easy-server.com
Username: youremail@stbees.org.uk
Password: corresponding email password
Port 465
SSL = ON

The SSL might be key. But you’re not using POP, you’re currently concerned about IMAP. I’ll get back to you on that in a minute.

When you setup the IMAP, in advanced settings, check what SSL protocol it is using. Have they asked you that?
Possibly make sure they are set to SSL/TLS

After you have entered the IMAP address via Outlook (or if you did it via Control Panel) check the following.

In Control Panel "Mail (Microsoft Outlook)"
Click on email accounts, it will open (1.)"Account Settings"
2. Click More settings
3. Check settings
4. You might not only have to test between using ynh4.uk.easy-server.com & mail.yourdomain.org.uk but also item 4.




Port numbers and mail in & out as given to you by YNH, not me.

antspants said:

I really do not recall the in & out being ynh4.uk.easy-server.com. I am certain I’d remember that interesting address.
It wasn’t all that long ago that we setup, so perhaps all addresses are relevant. But I truly don’t remember that address. I can’t find my notes.

Click to expand...

That address was given to me recently by YNH after the 3rd or 4th lockout, so you would not have seen it.

Currently I seem to be able to receive mail but can't send. This time round it has been an off problem. Previously lockout meant just that - no access to mail server, no access to my two web sites. The Web sites came back and a bit later I could receive emails but not send.

At the moment I am torn between watching the Open Golf Championship and sorting this out. I also should do some gardening since the sun is out (rare these days!).

Glad to hear my concern re "falling out" was unfounded!

I think I will need to leave this till tomorrow. Things are somewhat odd at YNH. I can receive emails but not send, and I can't set up or edit accounts.
One disadvantage of YNH is that they don't provide a 24/7 service. The price of a personal service I suppose.

Sigurd said:

That address was given to me recently by YNH after the 3rd or 4th lockout, so you would not have seen it.

Click to expand...

I found it in our private messages, but I don’t remember using it.

Watch the golf Ian

Hi Ian.

A couple of things.
Did your issues start around the 18th of July?

YNH changed servers in May last year, so that In & Out should of been relevant since that time. I still don’t recall using them.
Back to when your issue started. Please read the following from YNH: -—>

18/07/2024 10.14AM

Websites are now back online on ynhltd-plesk-server.com, thank you for your patience.

==============================================================

18/07/2024 09.49

We are currently having issues with ynhltd.plesk-server.com, we are working on this now and truly appreciate your patience while we resolve the issues with your websites.

================================================================

05/05/2023

Important Server Maintenance

We are moving to a new data centre!

To make this upgrade it will unfortunately cause a short downtime of up to 3 hours per server on Friday 12th May between 11Pm and 6AM

Websites and emails will be down during this time whilst the update is performed.

Thank you very much for your patience during this essential maintenance work.