# False IP ban from scenario "http-generic-bf"

**URL:** <https://discourse.crowdsec.net/t/false-ip-ban-from-scenario-http-generic-bf/1383>\
**Category:** crowdsec\
**Created:** [August 14, 2023, 8:12am UTC](https://discourse.crowdsec.net/t/false-ip-ban-from-scenario-http-generic-bf/1383 "2023-08-14T08:12:08Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![steifhahn](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/steifhahn/32/654_2.png) [@steifhahn](https://discourse.crowdsec.net/u/steifhahn)\
**Post date:** [August 14, 2023, 8:12am UTC](https://discourse.crowdsec.net/t/false-ip-ban-from-scenario-http-generic-bf/1383/1 "2023-08-14T08:12:08Z")

</div>

It happens when i try to login to SOGo webmail (mailcow) and put in a wrong passwort. But thats usually not a BF attack?

Here the detail log:

```auto
docker exec crowdsec cscli alerts inspect 2583 -d

################################################################################################

 - ID : 2583
 - Date : 2023-08-14T07:47:50Z
 - Machine : localhost
 - Simulation : false
 - Reason : LePresidente/http-generic-403-bf
 - Events Count : 8
 - Scope:Value : Ip:91.xxxx
 - Country : DE
 - AS : Deutsche Telekom AG
 - Begin : 2023-08-14 07:46:46.041611421 +0000 UTC
 - End : 2023-08-14 07:47:50.20209917 +0000 UTC
 - UUID : 92fd56bb-fe10-4db5-9bcd-xxxxxxx

 - Events :

- Date: 2023-08-14 07:47:45 +0000 UTC
+---------------------+----------------------------------+
| Key | Value |
+---------------------+----------------------------------+
| ASNNumber | 3320 |
+---------------------+----------------------------------+
| ASNOrg | Deutsche Telekom AG |
+---------------------+----------------------------------+
| IsInEU | true |
+---------------------+----------------------------------+
| IsoCode | DE |
+---------------------+----------------------------------+
| SourceRange | 91.0.0.0/10 |
+---------------------+----------------------------------+
| datasource_path | /var/log/traefik/access.log |
+---------------------+----------------------------------+
| datasource_type | file |
+---------------------+----------------------------------+
| http_args_len | 0 |
+---------------------+----------------------------------+
| http_path | /SOGo/so/passwordRecoveryEnabled |
+---------------------+----------------------------------+
| http_status | 403 |
+---------------------+----------------------------------+
| http_user_agent | - |
+---------------------+----------------------------------+
| http_verb | POST |
+---------------------+----------------------------------+
| log_type | http_access-log |
+---------------------+----------------------------------+
| service | http |
+---------------------+----------------------------------+
| source_ip | 91.xxxxxx |
+---------------------+----------------------------------+
| timestamp | 2023-08-14T07:47:45Z |
+---------------------+----------------------------------+
| traefik_router_name | nginx-mailcow-secure@docker |
+---------------------+----------------------------------+
| user | - |
+---------------------+----------------------------------+

- Date: 2023-08-14 09:47:45 +0200 +0200
+-----------------+--------------------------------------------------------------+
| Key | Value |
+-----------------+--------------------------------------------------------------+
| ASNNumber | 3320 |
+-----------------+--------------------------------------------------------------+
| ASNOrg | Deutsche Telekom AG |
+-----------------+--------------------------------------------------------------+
| IsInEU | true |
+-----------------+--------------------------------------------------------------+
| IsoCode | DE |
+-----------------+--------------------------------------------------------------+
| SourceRange | 91.0.0.0/10 |
+-----------------+--------------------------------------------------------------+
| datasource_path | mailcowdockerized-nginx-mailcow-1 |
+-----------------+--------------------------------------------------------------+
| datasource_type | docker |
+-----------------+--------------------------------------------------------------+
| http_args_len | 0 |
+-----------------+--------------------------------------------------------------+
| http_path | /SOGo/so/passwordRecoveryEnabled |
+-----------------+--------------------------------------------------------------+
| http_status | 403 |
+-----------------+--------------------------------------------------------------+
| http_user_agent | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 |
| | (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 |
+-----------------+--------------------------------------------------------------+
| http_verb | POST |
+-----------------+--------------------------------------------------------------+
| log_type | http_access-log |
+-----------------+--------------------------------------------------------------+
| service | http |
+-----------------+--------------------------------------------------------------+
| source_ip | 91.xxxx |
+-----------------+--------------------------------------------------------------+
| timestamp | 2023-08-14T09:47:45+02:00 |
+-----------------+--------------------------------------------------------------+

- Date: 2023-08-14 09:47:48 +0200 +0200
+-----------------+--------------------------------------------------------------+
| Key | Value |
+-----------------+--------------------------------------------------------------+
| ASNNumber | 3320 |
+-----------------+--------------------------------------------------------------+
| ASNOrg | Deutsche Telekom AG |
+-----------------+--------------------------------------------------------------+
| IsInEU | true |
+-----------------+--------------------------------------------------------------+
| IsoCode | DE |
+-----------------+--------------------------------------------------------------+
| SourceRange | 91.0.0.0/10 |
+-----------------+--------------------------------------------------------------+
| datasource_path | mailcowdockerized-nginx-mailcow-1 |
+-----------------+--------------------------------------------------------------+
| datasource_type | docker |
+-----------------+--------------------------------------------------------------+
| http_args_len | 0 |
+-----------------+--------------------------------------------------------------+
| http_path | /SOGo/so/passwordRecoveryEnabled |
+-----------------+--------------------------------------------------------------+
| http_status | 403 |
+-----------------+--------------------------------------------------------------+
| http_user_agent | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 |
| | (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 |
+-----------------+--------------------------------------------------------------+
| http_verb | POST |
+-----------------+--------------------------------------------------------------+
| log_type | http_access-log |
+-----------------+--------------------------------------------------------------+
| service | http |
+-----------------+--------------------------------------------------------------+
| source_ip | 91.xxxxxx |
+-----------------+--------------------------------------------------------------+
| timestamp | 2023-08-14T09:47:48+02:00 |
+-----------------+--------------------------------------------------------------+

- Date: 2023-08-14 07:47:48 +0000 UTC
+---------------------+----------------------------------+
| Key | Value |
+---------------------+----------------------------------+
| ASNNumber | 3320 |
+---------------------+----------------------------------+
| ASNOrg | Deutsche Telekom AG |
+---------------------+----------------------------------+
| IsInEU | true |
+---------------------+----------------------------------+
| IsoCode | DE |
+---------------------+----------------------------------+
| SourceRange | 91.0.0.0/10 |
+---------------------+----------------------------------+
| datasource_path | /var/log/traefik/access.log |
+---------------------+----------------------------------+
| datasource_type | file |
+---------------------+----------------------------------+
| http_args_len | 0 |
+---------------------+----------------------------------+
| http_path | /SOGo/so/passwordRecoveryEnabled |
+---------------------+----------------------------------+
| http_status | 403 |
+---------------------+----------------------------------+
| http_user_agent | - |
+---------------------+----------------------------------+
| http_verb | POST |
+---------------------+----------------------------------+
| log_type | http_access-log |
+---------------------+----------------------------------+
| service | http |
+---------------------+----------------------------------+
| source_ip | 91.xxxxx |
+---------------------+----------------------------------+
| timestamp | 2023-08-14T07:47:48Z |
+---------------------+----------------------------------+
| traefik_router_name | nginx-mailcow-secure@docker |
+---------------------+----------------------------------+
| user | - |
+---------------------+----------------------------------+

- Date: 2023-08-14 09:47:50 +0200 +0200
+-----------------+--------------------------------------------------------------+
| Key | Value |
+-----------------+--------------------------------------------------------------+
| ASNNumber | 3320 |
+-----------------+--------------------------------------------------------------+
| ASNOrg | Deutsche Telekom AG |
+-----------------+--------------------------------------------------------------+
| IsInEU | true |
+-----------------+--------------------------------------------------------------+
| IsoCode | DE |
+-----------------+--------------------------------------------------------------+
| SourceRange | 91.0.0.0/10 |
+-----------------+--------------------------------------------------------------+
| datasource_path | mailcowdockerized-nginx-mailcow-1 |
+-----------------+--------------------------------------------------------------+
| datasource_type | docker |
+-----------------+--------------------------------------------------------------+
| http_args_len | 0 |
+-----------------+--------------------------------------------------------------+
| http_path | /SOGo/so/passwordRecoveryEnabled |
+-----------------+--------------------------------------------------------------+
| http_status | 403 |
+-----------------+--------------------------------------------------------------+
| http_user_agent | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 |
| | (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 |
+-----------------+--------------------------------------------------------------+
| http_verb | POST |
+-----------------+--------------------------------------------------------------+
| log_type | http_access-log |
+-----------------+--------------------------------------------------------------+
| service | http |
+-----------------+--------------------------------------------------------------+
| source_ip | 91.xxxx |
+-----------------+--------------------------------------------------------------+
| timestamp | 2023-08-14T09:47:50+02:00 |
+-----------------+--------------------------------------------------------------+

- Date: 2023-08-14 07:47:50 +0000 UTC
+---------------------+----------------------------------+
| Key | Value |
+---------------------+----------------------------------+
| ASNNumber | 3320 |
+---------------------+----------------------------------+
| ASNOrg | Deutsche Telekom AG |
+---------------------+----------------------------------+
| IsInEU | true |
+---------------------+----------------------------------+
| IsoCode | DE |
+---------------------+----------------------------------+
| SourceRange | 91.0.0.0/10 |
+---------------------+----------------------------------+
| datasource_path | /var/log/traefik/access.log |
+---------------------+----------------------------------+
| datasource_type | file |
+---------------------+----------------------------------+
| http_args_len | 0 |
+---------------------+----------------------------------+
| http_path | /SOGo/so/passwordRecoveryEnabled |
+---------------------+----------------------------------+
| http_status | 403 |
+---------------------+----------------------------------+
| http_user_agent | - |
+---------------------+----------------------------------+
| http_verb | POST |
+---------------------+----------------------------------+
| log_type | http_access-log |
+---------------------+----------------------------------+
| service | http |
+---------------------+----------------------------------+
| source_ip | 91.xxxx |
+---------------------+----------------------------------+
| timestamp | 2023-08-14T07:47:50Z |
+---------------------+----------------------------------+
| traefik_router_name | nginx-mailcow-secure@docker |
+---------------------+----------------------------------+
| user | - |
+---------------------+----------------------------------+

```

the scenario has a capacity of 5, does that not mean after 5 trys i should get banned?

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [August 14, 2023, 9:11am UTC](https://discourse.crowdsec.net/t/false-ip-ban-from-scenario-http-generic-bf/1383/2 "2023-08-14T09:11:39Z")

</div>

> the scenario has a capacity of 5, does that not mean after 5 trys i should get banned?

Not directly as there a concept of leaky bucket event will leak over time here a image that might explain [Format | CrowdSec](https://docs.crowdsec.net/docs/next/scenarios/format#leaky)

You have duplicate datasources so the events are being counted twice. (So one failed attempt will count as two)

```auto
+-----------------+--------------------------------------------------------------+
| datasource_path | mailcowdockerized-nginx-mailcow-1 |
+-----------------+--------------------------------------------------------------+
| datasource_type | docker |
+-----------------+--------------------------------------------------------------+

```

```auto
+---------------------+----------------------------------+
| datasource_path | /var/log/traefik/access.log |
+---------------------+----------------------------------+
| datasource_type | file |
+---------------------+----------------------------------+

```

---

<div class="post-metadata">

**Author:** ![steifhahn](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/steifhahn/32/654_2.png) [@steifhahn](https://discourse.crowdsec.net/u/steifhahn)\
**Post date:** [August 14, 2023, 9:26am UTC](https://discourse.crowdsec.net/t/false-ip-ban-from-scenario-http-generic-bf/1383/3 "2023-08-14T09:26:03Z")

</div>

Thanks for feedback.  
But then it counts only two. I mean after the first wrong login i get banned?

How to get rid of it?

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [August 14, 2023, 9:28am UTC](https://discourse.crowdsec.net/t/false-ip-ban-from-scenario-http-generic-bf/1383/4 "2023-08-14T09:28:26Z")

</div>

Well either remove one of the duplicate sources I would recommend the docker nginx source as traefik is already logging them for all domains.

> But then it counts only two

What you mean by this? it counts two per one event so since there was 4 events it counted 8 hence ` - Events Count : 8`

---

<div class="post-metadata">

**Author:** ![steifhahn](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/steifhahn/32/654_2.png) [@steifhahn](https://discourse.crowdsec.net/u/steifhahn)\
**Post date:** [August 14, 2023, 10:08am UTC](https://discourse.crowdsec.net/t/false-ip-ban-from-scenario-http-generic-bf/1383/5 "2023-08-14T10:08:23Z")

</div>

Thanks. So one wrong login creates 4x 401 entrys. That makes 8. Got it 😉  
I deleted mailcowdockerized-nginx-mailcow-1

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [August 14, 2023, 10:20am UTC](https://discourse.crowdsec.net/t/false-ip-ban-from-scenario-http-generic-bf/1383/6 "2023-08-14T10:20:48Z")

</div>

> So one wrong login creates 4x 401 entrys. That makes 8.

Depends on the application and the developers what request they do, upon failed login it might try to get some resource that needs authentication 🤷 Dont know I dont use mailcow so cant explain application