Bruteforce notifications stopped working

Freddy

Verified User
Joined
Apr 14, 2016
Messages
119
Good morning and a happy new year to all who's reading this.

This morning I had a problem with a brute force attack on one of our servers. I checked the Brute Force Monitor and saw that the monitor stopped notifying. This means that my custom script is also not being run and the attacker won't be blocked. See the screenshot below. I checked the other servers and they all seem to have the same problem. Attacks that hit the "Notify Admins after an IP has" amount are not nitified! The weird thing is that some of the attacks are being notified and others are not. I can't seem to find the key to this randomness. It has nothing to do with whitelisted IP's and all attacks with over 100 hits should be notified.


Are there any changes made to DirectAdmin that could cause this problem?
 
Does anyone have a clue why this happens?
Fresh attacks keep coming and are not being blocked due to this problem. Check the Notified column, it says No to most attacks. I have no idea why some of the attacks are being notified and others are not. The problem seem to have started around 31 december. I have multiple servers with the same problem. Some of those servers also run CSF. The server from the screenshot isn't. It has a custom script that hasn't changed for months.

 
Back
Top