cPHulk show our server IP address

[okamigo]

Hello,
When I check the server for brute force attack, in the IP section it shows the IP of our server, and in the Authentication Service section it shows dovecot, country LT, although the server is not even in this country.
Can someone explain why it shows the IP of our server?

 

[cPanelLauren]

Hello,


Do you have username blocking enabled in cPHulk? This would explain the local IP address being shown if the username is getting blocked it logs the same data as an IP address block. As far as the country reported is concerned, it bases that off the country code associated with the IP when performing the geoip lookup.

 

[keat63]

I can't comment on why your IP is being listed, but I can comment on the country association.
The Geo Loookup, is not 100% accurate.
I had a user based in an office only 100 yards away from mine, the Geo lookup had her 4000 miles away in the USA.

 

[okamigo]

Hello,


Do you have username blocking enabled in cPHulk? This would explain the local IP address being shown if the username is getting blocked it logs the same data as an IP address block. As far as the country reported is concerned, it bases that off the country code associated with the IP when performing the geoip lookup.

NO, this user is not blocked, its show email which does not exist.