Brute force and password spraying against email: how to stop them on cPanel

Three ways to guess a password

Password spraying is the most dangerous one for a hosting provider: each account gets so few attempts that per-account lockouts never trigger, and a single user with a common password is all the attacker needs.

How to spot them in the logs

Dovecot (IMAP and POP3) logs failures to /var/log/maillog with lines like imap-login: Disconnected (auth failed, 1 attempts in 2 secs): user=<sales@domain.com>, method=PLAIN, rip=203.0.113.25. Exim logs SMTP authentication failures to /var/log/exim_mainlog as dovecot_login authenticator failed.

# IPs with the most failed IMAP/POP3 logins
grep "auth failed" /var/log/maillog | grep -o "rip=[0-9a-f.:]*" | sort | uniq -c | sort -rn | head

# Users with the most failures (an even spread across many users = spraying)
grep "auth failed" /var/log/maillog | grep -o "user=<[^>]*>" | sort | uniq -c | sort -rn | head -30

# SMTP authentication failures
grep "authenticator failed" /var/log/exim_mainlog | grep -o "set_id=[^)]*" | sort | uniq -c | sort -rn | head

Look for two patterns: one IP with hundreds of failures (brute force, easy to block), and dozens of different users with one or two failures each in the same time window (spraying, harder). If a successful login from a foreign IP follows a wave of failures, treat that account as compromised.

Configure cPHulk

cPHulk is the brute-force protection built into cPanel. It covers cPanel, WHM, webmail, IMAP, POP3 and SMTP. Configure it in WHM › Security Center › cPHulk Brute Force Protection:

1. Add your own and your office IPs to the allow list first, so you don't lock yourself out.
2. Enable both username-based and IP-based protection. The first protects targeted accounts; the second blocks attacking IPs.
3. Use moderate thresholds: for example, 5 failures per IP within 15 minutes, and a block of several hours after repeated failures.
4. If your customers are in only a few countries, consider blocking countries they should never log in from (Countries Management).

cPHulk counts attempts per IP and per username. Against distributed spraying, with many IPs and few attempts per account, it helps little. That's why the measures in the next section matter just as much.

If you run ConfigServer Security & Firewall (CSF), its LF_POP3D, LF_IMAPD and LF_SMTPAUTH settings block IPs with too many failures at the firewall, and LF_DISTATTACK detects distributed attacks against a single account.

Close the doors they rely on

• Disable plaintext authentication: in WHM › Service Configuration › Mailserver Configuration, set "Allow Plaintext Authentication" to No, so no password ever travels unencrypted.
• Mandatory strong passwords in WHM › Security Center › Password Strength Configuration. Spraying relies precisely on weak, common passwords.
• Unique passwords. A password reused and leaked elsewhere works on the first try.
• Review unused accounts. Mailboxes of former staff or test accounts with old passwords are a favorite target.

If an attack succeeded

Change the password, check the mailbox's forwarders and filters, and see whether the account started sending spam. The full procedure is in compromised email account. Keep in mind that, besides brute force, the other big way passwords get stolen is credential phishing, which no failed-login lockout can stop.

Frequently asked questions