Client IP blocked by exim/lfd when abroad?

[Jordz2203]

Hey everyone, our server is in South Africa, the client is as well, but when they went over seas first to colombia and to france, their IP got blocked, we arent sure why.
If I look at the exim mainlog at /var/log/exim/ then I can see the following line when they were in France.

I believe they are connected via SMTP on their phones.

2023-06-25 08:15:53 1qDJ2P-0001zt-0G <= [email protected] U=root P=local S=1745 T="lfd on za1.ccstudio.co.za: blocked 77.131.11.153 (FR/France/153.11.131.77.rev.sfr.net)" from <[email protected]> for root

When I looked at the rule from within Immunify360 incidents this was the log:
(imapd) Failed IMAP login from 77.131.11.153 (FR/France/153.11.131.77.rev.sfr.net): 10 in the last 3600 secs
Rule: LF_IMAPD

 

[Richard G]

Failed IMAP login from 77.131.11.153

Well... that seems clear enough to me. Failed IMAP login 10 times in the last 15 minutes. So they are trying to login with wrong username/password.
They should try via webmail if they can login, most likely it will state to them they are using a wrong username or password.