# Adding new smtp parser for failed logins

**URL:** <https://discourse.crowdsec.net/t/adding-new-smtp-parser-for-failed-logins/858>\
**Category:** crowdsec\
**Created:** [June 21, 2022, 10:35am UTC](https://discourse.crowdsec.net/t/adding-new-smtp-parser-for-failed-logins/858 "2022-06-21T10:35:15Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![hbauer](https://avatars.discourse-cdn.com/v4/letter/h/ea5d25/32.png) [@hbauer](https://discourse.crowdsec.net/u/hbauer)\
**Post date:** [June 21, 2022, 10:35am UTC](https://discourse.crowdsec.net/t/adding-new-smtp-parser-for-failed-logins/858/1 "2022-06-21T10:35:15Z")

</div>

I am running an SMTP Server and I want to block all IPs which try to login. The relevant log line is

`smtp connected address=107.182.yyy.xxx host=<unknown>`  
My idea is to start with the postfix parser from [the hub](https://hub.crowdsec.net/author/crowdsecurity/configurations/postfix-logs) and modify it.

Is this the right approach?

---

<div class="post-metadata">

**Author:** ![hbauer](https://avatars.discourse-cdn.com/v4/letter/h/ea5d25/32.png) [@hbauer](https://discourse.crowdsec.net/u/hbauer)\
**Post date:** [June 21, 2022, 2:14pm UTC](https://discourse.crowdsec.net/t/adding-new-smtp-parser-for-failed-logins/858/2 "2022-06-21T14:14:02Z")

</div>

ok, wrong approach. [this](https://docs.crowdsec.net/docs/parsers/create/) is the way to go