Brute force attacks

Question asked by Ciaran Morgan - 7/28/2026 at 1:13 AM

Unanswered

Hello

Is there a way to block brute force login attempts where the attacker is using just a single word as user identity?

I'm currently suffering this across a range of IP addresses from multiple countries. My standard approach is to regularly check the logs, find failed login attempts and then block the ip address but I would like to automate this as much as possible.

8 Replies

Reply to Thread

J. LaDow Replied

7/28/2026 at 6:33 AM

[NOT A PAID ENDORSEMENT]

Digital Ruby's IPBan -- it scans log files and can ban IPs based on regex recipes -- it's what we use for situations like this. Runs on Windows and Linux hosts.

Getting the regex rules right can be tricky but it definitely cuts down on the bad traffic. Ours is set for 90 day blocks, but you have options. Make sure to safe-list necessary external and internal IPs before anything else.

MailEnable survivor / convert --

Brandon Murphy Replied

8/5/2026 at 2:07 PM

Employee Post

Hello,

If you are seeing brute force login attempts from multiple countries, I'd first recommend implementing our 'Block Authentication by Country' feature located at [Settings -> General]. This will prevent IP ranges from specified countries from even attempting to authenticate. Additionally, you can use our IDS Rules found at [Settings -> Security -> IDS Rules] to block these authentication attempts by IP address or email. Furthermore, we recently made some improvements to our IDS rules including rule stacking and successful authentications decreasing the IDS threshold count. I'll link our help article on IDS rules and our blog post regarding the recent improvements to IDS rules.

https://help.smartertools.com/SmarterMail/Current/Topics/SystemAdmin/Security/Advanced/AbuseDetection

https://www.smartertools.com/blog/2026/05/intrusion-detection-improvements

Brandon Murphy

System/Network Administrator

SmarterTools Inc.

www.smartertools.com

Ciaran Morgan Replied

8/5/2026 at 2:40 PM

Thanks both.

I am using the "Block Authentication by Country" and have used it to target the main culprits (Russia, China, North Korea and Iran). Can't block all the countries that attacks are coming from as my customers have legitimate contacts from those countries.

The problem I have is the attempts come from multiple, random countries with very little time difference between them so my IDS rules trigger very quickly. I also am hammered by attempts with a logon id of "admin", "root", "noreply" etc and wish I could block them faster than other IDS rules.

What I would like to see is an IDS rule that allows the instant blocking of an IP address when username/password combinations have failed and do not match the country from which the most recent successful login has occurred. That would help a lot!

I will have a read of the new IDS improvements to see if that would also help.

Andrew Barker Replied

8/5/2026 at 2:51 PM

Employee Post

Currently, there is no setting that allows scoring attempts that don't use a full email address differently than those that do. The main reason is that providing just a user name is a valid authentication attempt for SmarterMail. Not only is it the only option for system admins, but it can also be used by users, under the right circumstances. For example, if domain "example.com" has it's host name configured as "webmail.example.com" in SmarterMail, and if "webmail.example.com" routes to SmarterMail, then "user@example.com" can go to webmail.example.com/interface/root#/login and authenticate using just "user" instead of their full email address.

Andrew Barker
Lead Software Developer
SmarterTools Inc.
www.smartertools.com

Ciaran Morgan Replied

8/5/2026 at 3:14 PM

Thanks Andrew.

That makes sense - thanks for the explanation.

What are your thoughts on the other suggestion - the one of comparing country codes of the ip address for successful and failed login attempts?

Douglas Foster Replied

8/6/2026 at 6:18 AM

J. LaDow has the right idea - detect the bad IP addresses, and block them preferably at the firewall.

AbuseIPdb.com is a good place to start.. Of course, there other sources and our firewall actually uses a combination of several. Better firewalls can use these IP reputation services, supplemented by a local text file with site-specific blocks.

J. LaDow Replied

8/6/2026 at 8:03 AM

we have shifted to ipapi.is for IP data - the speed and pricing is more in line with our usage as of late.

MailEnable survivor / convert --

ß Replied

8/7/2026 at 9:44 AM

@Brandon Murphy

What you said is not exactly true in regards to this issue.

Country blocking will not apply to login attempts for users with no domains or for non-existent users. I've already gone through this with SmarterTools. Country blocking only gets triggered for exsistent users.

Non-Existent users (which includes single-word usernames with no domain) do not get stopped by country blocking.... and according to your people... this is by design.

Back to Community Threads

Reply to Thread

Enter the verification text