I wasn’t even at the server. I do have some email clients running checking mail every so often but I haven’t changed anything with them.
Here is all the entries related to the ban.
netfilter-mailcow-1 | 47.200.48.82 matched rule id 6 (imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<danc@dccathome.com>, method=PLAIN, rip=47.200.48.82, lip=172.22.1.250, TLS: Connection closed, TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256_256 bits))
netfilter-mailcow-1 | 9 more attempts in the next 600 seconds until 47.200.48.82/32 is banned
netfilter-mailcow-1 | 47.200.48.82 matched rule id 6 (imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 6 secs): user=<danc@dccathome.com>, method=PLAIN, rip=47.200.48.82, lip=172.22.1.250, TLS: Connection closed, TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256_256 bits))
netfilter-mailcow-1 | 8 more attempts in the next 600 seconds until 47.200.48.82/32 is banned
netfilter-mailcow-1 | 47.200.48.82 matched rule id 6 (imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<danc@dccathome.com>, method=PLAIN, rip=47.200.48.82, lip=172.22.1.250, TLS: Connection closed, TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256_256 bits))
netfilter-mailcow-1 | 7 more attempts in the next 600 seconds until 47.200.48.82/32 is banned
netfilter-mailcow-1 | 47.200.48.82 matched rule id 6 (imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 6 secs): user=<danc@dccathome.com>, method=PLAIN, rip=47.200.48.82, lip=172.22.1.250, TLS: Connection closed, TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256_256 bits))
netfilter-mailcow-1 | 6 more attempts in the next 600 seconds until 47.200.48.82/32 is banned
netfilter-mailcow-1 | 47.200.48.82 matched rule id 6 (imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<danc@dccathome.com>, method=PLAIN, rip=47.200.48.82, lip=172.22.1.250, TLS: Connection closed, TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256_256 bits))
netfilter-mailcow-1 | 5 more attempts in the next 600 seconds until 47.200.48.82/32 is banned
netfilter-mailcow-1 | 47.200.48.82 matched rule id 6 (imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 6 secs): user=<danc@dccathome.com>, method=PLAIN, rip=47.200.48.82, lip=172.22.1.250, TLS: Connection closed, TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256_256 bits))
netfilter-mailcow-1 | 4 more attempts in the next 600 seconds until 47.200.48.82/32 is banned
netfilter-mailcow-1 | 47.200.48.82 matched rule id 6 (imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<danc@dccathome.com>, method=PLAIN, rip=47.200.48.82, lip=172.22.1.250, TLS: Connection closed, TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256_256 bits))
netfilter-mailcow-1 | 3 more attempts in the next 600 seconds until 47.200.48.82/32 is banned
netfilter-mailcow-1 | 47.200.48.82 matched rule id 6 (imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 6 secs): user=<danc@dccathome.com>, method=PLAIN, rip=47.200.48.82, lip=172.22.1.250, TLS: Connection closed, TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256_256 bits))
netfilter-mailcow-1 | 2 more attempts in the next 600 seconds until 47.200.48.82/32 is banned
netfilter-mailcow-1 | 47.200.48.82 matched rule id 6 (imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<danc@dccathome.com>, method=PLAIN, rip=47.200.48.82, lip=172.22.1.250, TLS: Connection closed, TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256_256 bits))
netfilter-mailcow-1 | 1 more attempts in the next 600 seconds until 47.200.48.82/32 is banned
netfilter-mailcow-1 | 47.200.48.82 matched rule id 6 (imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 6 secs): user=<danc@dccathome.com>, method=PLAIN, rip=47.200.48.82, lip=172.22.1.250, TLS: Connection closed, TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256_256 bits))
netfilter-mailcow-1 | Banning 47.200.48.82/32 for 30 minutes
netfilter-mailcow-1 | Warning: Extension REJECT revision 0 not supported, missing kernel module?
netfilter-mailcow-1 | 47.200.48.82 matched rule id 6 (imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<danc@dccathome.com>, method=PLAIN, rip=47.200.48.82, lip=172.22.1.250, TLS: Connection closed, TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256_256 bits))
netfilter-mailcow-1 | Banning 47.200.48.82/32 for 30 minutes
netfilter-mailcow-1 | 47.200.48.82 matched rule id 6 (imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 6 secs): user=<danc@dccathome.com>, method=PLAIN, rip=47.200.48.82, lip=172.22.1.250, TLS: Connection closed, TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256_256 bits))
netfilter-mailcow-1 | Banning 47.200.48.82/32 for 30 minutes
netfilter-mailcow-1 | Unbanning 47.200.48.82/32