I'm using Fail2ban on a Mailcleaner server which works pretty good, but I want to update it to ban hosts who want to spoof our addresses. I'm using the "original" mc-exim-filter, but I don't really understand how regular expressions work.
Here is an example from the log:
2021-02-26 00:02:37 H=([220.127.116.11]) [18.104.22.168] Ffirstname.lastname@example.org rejected RCPT email@example.com: This domain does not accept mail from itself (spoofing)
I tried many combination based on the already existing failregexes, but it doesn't want to ban the attackers.
Can anyone help?