Bruteforce attack SMTP vpopmail

NodeWorx
, ,
1

When I check the maillog, I see the following.
Can anyone point me in the right direction in how to resolve this?

Feb 21 16:02:07 hawk vpopmail[9152]: vchkpw-smtp: vpopmail user not found la@kwdserver.com:192.168.11.1
Feb 21 16:02:07 hawk vpopmail[9148]: vchkpw-smtp: vpopmail user not found old.test@:192.168.11.1
Feb 21 16:01:57 hawk vpopmail[9072]: vchkpw-smtp: vpopmail user not found ljw@kwdserver.com:192.168.11.1
Feb 21 16:01:52 hawk vpopmail[9068]: vchkpw-smtp: vpopmail user not found testuser@kwdserver.com:192.168.11.1
Feb 21 16:01:52 hawk vpopmail[9067]: vchkpw-smtp: vpopmail user not found titanic@:192.168.11.1
Feb 21 16:01:47 hawk vpopmail[8998]: vchkpw-smtp: vpopmail user not found gusti@kwdserver.com:192.168.11.1
Feb 21 16:01:37 hawk vpopmail[8992]: vchkpw-smtp: vpopmail user not found pl@kwdserver.com:192.168.11.1
Feb 21 16:01:34 hawk vpopmail[8980]: vchkpw-smtp: vpopmail user not found fregna@kwdserver.com:192.168.11.1
Feb 21 16:01:33 hawk vpopmail[8979]: vchkpw-smtp: vpopmail user not found chocolate@:192.168.11.1
Feb 21 16:01:24 hawk vpopmail[8911]: vchkpw-smtp: vpopmail user not found fotografie@kwdserver.com:192.168.11.1
Feb 21 16:01:22 hawk vpopmail[8909]: vchkpw-smtp: vpopmail user not found qunimade@kwdserver.com:192.168.11.1
Feb 21 16:01:18 hawk vpopmail[8906]: vchkpw-smtp: vpopmail user not found testblog@:192.168.11.1
Feb 21 16:01:14 hawk vpopmail[8842]: vchkpw-smtp: vpopmail user not found ams1@kwdserver.com:192.168.11.1
Feb 21 16:01:09 hawk vpopmail[8681]: vchkpw-smtp: vpopmail user not found canoe@kwdserver.com:192.168.11.1
Feb 21 16:01:03 hawk vpopmail[8311]: vchkpw-smtp: vpopmail user not found grade@:192.168.11.1
Feb 21 16:01:02 hawk vpopmail[8254]: vchkpw-smtp: vpopmail user not found pa@kwdserver.com:192.168.11.1
Feb 21 16:00:55 hawk vpopmail[8155]: vchkpw-smtp: vpopmail user not found manchester@kwdserver.com:192.168.11.1
Feb 21 16:00:53 hawk vpopmail[8153]: vchkpw-smtp: vpopmail user not found libby@kwdserver.com:192.168.11.1
Feb 21 16:00:49 hawk vpopmail[8151]: vchkpw-smtp: vpopmail user not found swage@:192.168.11.1

2

Hello–

I would recommend blocking that IP address in the firewall.

Thanks,
-Jenna

3

Thank you.

That is the IP address of the Nodeworx server.

4

Hello–

If the attack is coming from inside the server, you may want to run a malware program such as maldet: Using MalDet to Protect Servers from Malware and Spammers — InterWorx documentation

Thanks,
-Jenna