Find a logged sender and ban its source IP with Fail2ban.
LogGraphic 1.20.0 adds a form that accepts a sender email address, finds source IPs in retained logs and lets you register a selected IP with Fail2ban.
· Kali Linux amd64 · Debian 1.20.0-20261104002227
Find sources by email address
Open Actions → Ban by email address…, enter one sender address and choose Search source IPs. The same button is available in ADDRESS FLOW; a selected sender node prefills its address.
Review the evidence and ban one IP
Candidates are grouped by source IP and logged server. Review host names, queue/rejection record counts, event counts, first/last timestamps (UTC) and the latest supporting log. Select one IP to open the existing Fail2ban confirmation window.
Matching and search scope
The form matches one ordinary ASCII envelope sender (from=<...>) exactly. Only the ASCII domain is case-insensitive; the local part remains case-sensitive. Surrounding spaces and <user@example.com> are accepted. Internationalized domains can be entered in punycode.
Search covers all retained analysis logs independently of the main search, event filter and playback position. A zero retention limit disables lookup. Editing the input clears previous results, and the current logs are checked again before proceeding with an action.
How records are counted
Queue / rejection records are deduplicated by Queue ID generation. NOQUEUE records and records without an identifier each count as one unit. Delivery events for multiple recipients and retries are shown separately; these units are not a guaranteed count of actual messages.
Settings and the scope of a ban
Configure the target under Settings → SSH settings… and an existing Jail under Settings → Fail2ban settings…. Only valid source IPv4/IPv6 addresses recorded in the logs are used. Recipient/forwarding addresses, delivery relays and DNS lookups are never used to infer a source. Records without a source IP cannot be banned.
The target is the observed source IP associated with the email address. An envelope sender is not proof of identity. A shared or forwarding server IP can affect other senders too. In the final confirmation, review the logged server, actual SSH target, Jail and IP.
Python extensions in installed Linux packages
The resource lookup now finds the bundled files used to list and run Python extensions when the Linux package is installed under the standard /usr prefix.
Validation and supported environment
The Kali amd64 build and all 13 automated tests passed. Separate GTK/Xvfb GUI probes verified email input, candidate selection and stale-candidate invalidation, plus Python extensions using the extracted package’s installed layout. Packaged startup, shared-library dependencies, an APT installation simulation and SHA-256 were also verified. No real-server ban was performed. Command completion does not demonstrate packet blocking; the server Jail defines the scope and duration.
Upgrade instructions
With the LogGraphic APT repository registered, run the commands below and restart the app. apt update refreshes indexes; the second command upgrades the application. Start the GUI from a terminal in the Kali desktop session.
sudo apt update
sudo apt install --only-upgrade loggraphicSHA-256
03d983030ba98e71c4056da5577ffbe6026fb318e6b175dd97c64da3781af2fc