Poste Dashboard Realtime Connections permanente intento desde ip bloqueado por el server about peladonerd HOT 3 CLOSED

Agrego un log
2022-11-05T10:48:10.896Z [NOTICE] [core] connect ip=5.34.207.185 port=17640 local_ip=104.168.135.190 local_port=465
2022-11-05T10:48:10.896Z [DEBUG] [core] running connect_init hooks
2022-11-05T10:48:10.897Z [DEBUG] [core] running connect_init hook in guard plugin
2022-11-05T10:48:10.898Z [INFO] [guard] Automatically blacklisted connection guard|5.34.207.185/32, hits: NaN
2022-11-05T10:48:10.899Z [DEBUG] [core] hook=connect_init plugin=guard function=hook_connect_init params="" retval=CONT msg=""
2022-11-05T10:48:10.899Z [DEBUG] [core] running connect_init hook in relay plugin
2022-11-05T10:48:10.899Z [DEBUG] [relay] checking 5.34.207.185 in relay_acl_allow
2022-11-05T10:48:10.899Z [DEBUG] [relay] checking if 5.34.207.185 is in 127.0.0.1/24
2022-11-05T10:48:10.899Z [DEBUG] [relay] checking if 5.34.207.185 is in 104.168.135.190/32
2022-11-05T10:48:10.899Z [DEBUG] [core] hook=connect_init plugin=relay function=acl params="" retval=CONT msg=""
2022-11-05T10:48:10.899Z [DEBUG] [core] running connect_init_respond
2022-11-05T10:48:10.900Z [DEBUG] [core] running lookup_rdns hooks
2022-11-05T10:48:10.902Z [DEBUG] [core] running connect hooks
2022-11-05T10:48:10.902Z [DEBUG] [core] running connect hook in guard plugin
2022-11-05T10:48:13.904Z [INFO] [core] hook=connect plugin=guard function=hook_connect params="" retval=DENYDISCONNECT msg="Blacklisted [5.34.207.185]; please try again later or contact administrator"
2022-11-05T10:48:13.905Z [DEBUG] [core] running deny hooks
2022-11-05T10:48:13.905Z [DEBUG] [core] running deny hook in guard plugin
2022-11-05T10:48:13.905Z [DEBUG] [core] hook=deny plugin=guard function=hook_deny params=904 retval=CONT msg=""
2022-11-05T10:48:13.905Z [DEBUG] [core] running deny hook in watch plugin
2022-11-05T10:48:13.905Z [DEBUG] [watch] watch deny saw: guard deny from connect
2022-11-05T10:48:13.905Z [DEBUG] [watch] watch sending dark red to guard
2022-11-05T10:48:13.905Z [DEBUG] [core] hook=deny plugin=watch function=w_deny params=904 retval=CONT msg=""
2022-11-05T10:48:13.905Z [PROTOCOL] [core] S: 554 Blacklisted [5.34.207.185]; please try again later or contact administrator
2022-11-05T10:48:13.905Z [DEBUG] [core] client has disconnected
2022-11-05T10:48:13.905Z [DEBUG] [core] running disconnect hooks
2022-11-05T10:48:13.905Z [DEBUG] [core] client has disconnected
2022-11-05T10:48:13.905Z [DEBUG] [core] running disconnect hook in stats plugin
2022-11-05T10:48:13.906Z [DEBUG] [core] client has disconnected
2022-11-05T10:48:13.906Z [DEBUG] [core] hook=disconnect plugin=stats function=hook_disconnect params="" retval=CONT msg=""
2022-11-05T10:48:13.907Z [DEBUG] [core] client has disconnected
2022-11-05T10:48:13.907Z [DEBUG] [core] running disconnect hook in block_bad_connections plugin
2022-11-05T10:48:13.907Z [DEBUG] [core] Blacklisted/Whitelisted, skipping...
2022-11-05T10:48:13.907Z [DEBUG] [core] client has disconnected
2022-11-05T10:48:13.907Z [DEBUG] [core] hook=disconnect plugin=block_bad_connections function=hook_disconnect params="" retval=CONT msg=""
2022-11-05T10:48:13.907Z [DEBUG] [core] client has disconnected
2022-11-05T10:48:13.907Z [DEBUG] [core] running disconnect hook in log plugin
2022-11-05T10:48:13.907Z [DEBUG] [core] client has disconnected
2022-11-05T10:48:13.907Z [DEBUG] [core] hook=disconnect plugin=log function=hook_disconnect params="" retval=CONT msg=""
2022-11-05T10:48:13.907Z [DEBUG] [core] client has disconnected
2022-11-05T10:48:13.907Z [DEBUG] [core] running disconnect hook in tls plugin
2022-11-05T10:48:13.908Z [DEBUG] [core] client has disconnected
2022-11-05T10:48:13.908Z [DEBUG] [core] hook=disconnect plugin=tls function=hook_disconnect params="" retval=CONT msg=""
2022-11-05T10:48:13.908Z [NOTICE] [core] disconnect ip=5.34.207.185 rdns=NXDOMAIN helo="" relay=N early=N esmtp=N tls=Y pipe=N errors=0 txns=0 rcpts=0/0/0 msgs=0/0/0 bytes=0 lr="554 Blacklisted [5.34.207.185]; please try again later or contact administrator" time=3.013

from peladonerd.

No sé si entendí bien ¿tu servidor colapsa?.
Respecto de la IP 5.34.207.185 al revisarlo con Whois, aparece que es de IRAN, ISLAMIC REPUBLIC OF. Lo que me hace sospechar que es un bot que busca "servidores smtp abiertos". Sin embargo, Poste.io ya lo tiene dentro de la "lista negra" por lo que esa ip tiene bloquedo el acceso al uso del servidor smtp.

from peladonerd.

Este issue se ha marcado automágicamente como "stale" porque no ha tenido actividad reciente. Va a ser cerrado si no se ve actividad nueva. Intentá hacer tu pregunta en Slack. Gracias por sus contribuciones.

from peladonerd.