My domain host's server is blocking my IP address every few days

antspants · Aug 8, 2024

Sigurd said:
Looks as if YNH have solved the problem. They tightened or updated the spam filters at server level and since then my spam has dropped from the dozens a day to to less than half dozen a day. I have my own Outlook filters in place again. Hopefully that will also solve the locking issue!

That’s at least good news, Ian.

Not sure how you receiving spam and the IP lockout is related, but less spam is a good outcome.

Sigurd · Aug 8, 2024

antspants said:
Not sure how you receiving spam and the IP lockout is related, but less spam is a good outcome.

In my ignorance I had thought that the login attempts that led to lock down were part of spam mail and would be blocked by server.

Sigurd · Aug 28, 2024

Greetings all, especially Sinto - I'm back. The saga continues!

Following a further lockout (2nd or 3rd since last post) I got this form YNH -

We've been looking at the server logs, we can see login failures from 12.07 today:

Edit - Removed by OP - too much detail

The password len=nn tells us the password is being entered incorrectly with nn characters as the password shows as nn characters.

Are you inputting the password in at any time on any device?

Your IP address is being blocked each time it changes (which is most likely due to it being dynamic). Once the IP address changes, it's no longer in the whitelist, and subject to being temporarily blocked by fail2ban.

fail2ban checks for failed email authentication attempts on an IP-basis, and blocks those IPs that have used the wrong credentials too many times (even if there were successful attempts in-between). This is a very strong indicator that the email address is set up, using an older password, which is continuously attempting to connect to the email inbox, thus causing fail2ban to block the IP address, until it is added to the whitelist.

The fact that the IP address gets blocked on the new IP address each time does narrow the suspects down to computers/phones using the same IP address to connect to the internet, but we cannot tell from the logs what mail client is being used, or what specific program is doing the failed authentication attempts.

We would suggest checking every device and verify that It's either got the most up-to-date credentials set up on it, or to have it removed from the device(s).

I followed this up with -
One question – your answer implies that my IP address changes periodically. I am aware that happens but I am not sure if BT uses dynamic IP addresses. Nor do I know if it is possible to get a static IP address. Nor do I know if that would help. Incidentally, we suffered 3 consecutive power cuts, each lasting a few seconds yesterday about 1.30 pm. That meant both my PC and my wife’s and the BT modem had to be re-started each time – with a new IP address?

YNH confirmed I had a dynamic IP as every block was for a different IP.

Which leads me to the questions - Is it worth trying to see if my service provider can give me a static IP address? If I had a static address then YNH could white list it. Secondly, are there any disadvantages to having a static address?

In the meantime I will try and figure out what is the device or app that is trying to login with this incorrect password. Only two PCs and two phones could be guilty. Where do I start apart from the obvious - the passwords used to access mail at the email address in question. Where else?

antspants · Aug 28, 2024

Sigurd said:
Is it worth trying to see if my service provider can give me a static IP address?

Maybe, mate. You could do until this is solved. Would make troubleshooting easier as we wouldn’t have to wait for you to be unblocked, at a cost probably. The objective here is to find out why…

But here’s the thing:

On one hand, you wont get blocked
On the other hand, we wont know if you potentially may have been blocked due to the whitelist, less maybe send/receive being unsuccessful.

I think the first port of call would be to remove the email address from all devices before re-adding the email account.

Remove the email address from both phones. You’re using IMAP so it will be fine.
On the PC’s in Microsoft 365/Outlook, delete all email accounts from File > Account Settings > Account Settings
After all the email accounts are removed from all the devices, start re-adding them to devices one by one.
Be careful when adding the password. If there is an icon to show what you’re typing in, use it.
Check the email is being sent/received successfully before moving to the next PC or device.

I am wondering, you haven't at any point added your email address to any of the native email apps in windows, other than Microsoft 365/Outlook have you? Even by accident? Or in more than one app on one of your phones?
Because if they are old entries and they are checking for mail in the background with the wrong configuration or email password, this could be the cause.

Sigurd · Aug 29, 2024

antspants said:
On the other hand, we wont know if you potentially may have been blocked due to the whitelist, less maybe send/receive being unsuccessful.

Alison said that they had seen one attempt to logon but as the latest IP address was white listed it was allowed. But as I have a dynamic IP address sooner or later the IP address will change and it will no longer be on white list.
I was going to do what you suggest. The problem I find is that thee are so many apps that logon these days it could be difficult to get all. As fa r as I know the only mail programs I use or have used to logon to the YNH mail server are Outlook, WebMail, & BT mail (my service provider, but that uses a different address).

antspants · Aug 29, 2024

Sigurd said:
Alison said that they had seen one attempt to logon but as the latest IP address was white listed it was allowed. But as I have a dynamic IP address sooner or later the IP address will change and it will no longer be on white list.
I was going to do what you suggest. The problem I find is that thee are so many apps that logon these days it could be difficult to get all. As fa r as I know the only mail programs I use or have used to logon to the YNH mail server are Outlook, WebMail, & BT mail (my service provider, but that uses a different address).

Ian you may of setup your email address by accident in one of the Windows Outlook Apps as apposed to Microsoft 365.

You just need to identify what the Microsoft 365/Outlook icon looks like and open any other to see if there is an email address in them.

Having a static IP is fine but it won’t help you when you leave the house, with your phones for example.
It worries me that this blocking is a problem, Ian. There is most likely a simple answer. It’s just that I am not with you to look.

Sigurd · Aug 29, 2024

Suspects - My PC, my wife's PC, Laptop, my phone, wife's phone.
Other items that connect or have the capability to connect to the internet are my TV and the village weather station which I control.

The weather station has a problem and no longer uploads data to the village web site. No need or ability to try to connect with my mail server.
TV only connects to the internet for streaming purposes.
Laptop is rarely on and wasn't on when the last lock out occurred.
PCs are on all day, but my wife's one uses her personal email address and has never been the source of the problem. It is possible I setup a mail access using my address when setting it up initially but I don't think so. However will check.
Our phones are suspects but as far as comms are concerned we only use them for WhatApp, and text messages. We don't use either of them for emails, so they shouldn't be trying to access my mail server a YNH.
So main suspect is my PC.

A useful bit of information from YNH was the comment re the wrong password being used is 13 characters long while the correct one is 12 characters long. That makes it easy to check, up to a point, passwords for correctness

antspants · Aug 29, 2024

Ian it’s safe to say you can rule out all devices less the two phones and your PC.

If only one of the phones uses your email address, rule out the other.
Yes, good thinking about the password length, I am guessing that is key.
However if you look and both or all are only 12, then there is a good chance the email address is setup in another Outlook mail app.
Also, note that some apps with show a long list of dots that don’t reflect the password length. I am not sure if Outlook is one of them.

GokAy · Tuesday at 12:24 AM

Sorry if this is a dumb idea but reading the thread made wonder if using a VPN one at a time on each device help pinpoint the faulting device at least?

Sigurd · Tuesday at 6:35 AM

Can't really comment on that as I have never used a VPN although my AV app does provide the option. I'll leave it to Antspants to comment. Thanks for the interest in my problem.

antspants · Tuesday at 6:40 AM

You have 3 devices, Ian. Not worth worrying about, only in my opinion. Easier just to turn off the other two devices whilst checking. Easier again to remove the email of all devices and reset them.

Good idea though, @GokAy

GokAy · Tuesday at 6:47 AM

Or disconnect the phones from home network if data plan is adequate perhaps? Anyway, as I said just a thought. I would not know how to tackle this even if I did know the offending one. :)

antspants · Tuesday at 6:50 AM

GokAy said:
Or disconnect the phones from home network if data plan is adequate perhaps? Anyway, as I said just a thought. I would not know how to tackle this even if I did know the offending one. :)

Nothing wrong with making suggestions, GokAy. More than half of my posts in here are just blind suggestions.

Sigurd · Tuesday at 6:57 AM

antspants said:
More than half of my posts in here are just blind suggestions.

Most of which work!

antspants · Tuesday at 7:00 AM

@GokAy if there was a choice between switching between devices (only 3) and turning off WiFi and Mobile data on two out of 3, then turning off WiFi and Mobile data on the 3rd and switching it back on for one of the other 2… so on and so forth. I’d choose just turning of the devices not being checked, maybe?

antspants · Tuesday at 7:02 AM

Sigurd said:
Most of which work!

Luck would have it, Ian.

But I can’t fit anymore rabbits feet around my neck.

GokAy · Tuesday at 7:08 AM

Well, as far as I get it there are 2 issues. 1) Which device 2) Why

The "why" part as I said is out of my expertise. I was thinking VPN would force 1 device to use a different IP and hence show up in the logs from host. Switching off WiFi on both phones (if possible, no idea of daily usage) would differentiate their IPs as well. So a VPN + both phones on mobile data could speed the 1st part. And in case some other device is causing something that would show up as well in the 1st instance of a block.

GokAy · Tuesday at 7:15 AM

Oh btw, these devices all have 1 more thing in common, the router. Though I have never heard of a router interfering in such a way. Prolly the dumbest idea lol

antspants · Tuesday at 7:19 AM

Sure.

Pressing send receive repeatedly for 5 min to see if the the mail stops working and IP gets blocked would also work.

The problem I suspect, is there is an email setup in an email client outside of Outlook 365 that is causing the issue. That or on the Android phones.
One that was setup pre a password or setting change.

Making a time with Ian for me to inspect his PC again since he made changes might be less on his stress levels and less of a learning issue when it comes to activating VPN on his 3 (or two?) different platforms

The router has nothing to do with the mail protocol. But I’ve seen stranger things.