Sometimes a user cannot connect from home, their office, or a specific location, but can connect from other places.
In these situations, the most likely cause is that our server firewall has blocked your IP address.
Why does an IP get blocked?
Basically to protect the server and the sites hosted on that machine. An IP is blocked when it is considered a threat.
Why has my IP been considered a threat?
In most cases, it is due to repeated failed connection attempts to one of the services — for example, failed attempts to access FTP, email, or cPanel.
Here is an example of a blocked user:
Time: Fri May 16 23:30:14 2014 +0200
IP: 186.3.208.100 (EC/Ecuador/-)
Failures: 7 (smtpauth)
Interval: 86400 seconds
Blocked: Temporary Block (IP match in csf.allow, block may not work)
Log entries:
2014-05-16 22:45:05 dovecot_plain authenticator failed for ([192.168.0.111]) [186.3.208.100]:34473: 535 Incorrect authentication data (set_id=info@xxxxx)
May 16 22:45:12 us30 dovecot: imap-login: Aborted login (auth failed, 1 attempts in 6 secs): user=<info@xxxx>, method=PLAIN, rip=186.3.208.100, lip=69.64.48.59, TLS, session=<OcsXfYr5BQC6A9Bk>
2014-05-16 23:00:05 dovecot_plain authenticator failed for ([192.168.0.111]) [186.3.208.100]:56948: 535 Incorrect authentication data (set_id=info@xxxx)
May 16 23:00:12 us30 dovecot: imap-login: Aborted login (auth failed, 1 attempts in 6 secs): user=<info@xxxx>, method=PLAIN, rip=186.3.208.100, lip=69.64.48.59, TLS, session=<8q69sor5sgC6A9Bk>
2014-05-16 23:15:05 dovecot_plain authenticator failed for ([192.168.0.111]) [186.3.208.100]:39386: 535 Incorrect authentication data (set_id=info@xxxxx)
May 16 23:15:12 us30 dovecot: imap-login: Aborted login (auth failed, 1 attempts in 6 secs): user=<info@xxxxx>, method=PLAIN, rip=186.3.208.100, lip=69.64.48.59, TLS, session=<3O9h6Ir53QC6A9Bk>
2014-05-16 23:30:04 dovecot_plain authenticator failed for ([192.168.0.111]) [186.3.208.100]:57003: 535 Incorrect authentication data (set_id=info@xxxx)
As you can see, this user was repeatedly attempting to access the IMAP service with an incorrect password. The server considered them a threat and blocked them — protecting the domain owner who was receiving the brute force attack.
What can I do in this case?
Blocks are usually lifted every 10 minutes. There are two things you need to do:
- Fix the problem that caused the block.
- Wait for the block to be released.
What if I do not know the reason for the problem?
In that case, contact us with your IP address. We will send you a report and an explanation of why your IP was blocked.
How do I find out my IP address?
You can check your IP address by visiting: www.tuip.org
What if I need to restore my access urgently?
In that case, contact us via chat or phone and one of our technicians will remove your IP from the blocked list in the firewall.