Obtain the client public IP, affected username, service and failure time. Use an authorized server administrator for monitor and firewall changes. Keep console access or another permitted administration route when investigating your own blocked connection.

1. Open administrator Brute Force Monitor and inspect the matching events and blocked-address information.
2. Correlate the reported attempts with the relevant DirectAdmin, mail, SSH or other service log. Determine whether the behaviour is legitimate retries, automation or an attack.
3. Correct the source of legitimate repeated failures, including background clients and old saved passwords.
4. Remove only the verified block through the supported control for the layer enforcing it. DirectAdmin panel blocking and an integrated firewall can require different checks.
5. Test one connection and monitor for new failures. Add a narrowly scoped trusted-address exception only when justified and record its owner and review date.

Confirm the intended connection works and the monitor continues recording unrelated activity. Verify whether the client address has changed and whether several users share the same public address. Preserve meaningful incident evidence.

If the monitor shows no matching block, inspect provider firewall rules, service availability and application-level security. Do not disable the monitor globally or permanently allow a large network to solve one login issue. Repeated reblocking means the underlying retry or credential problem remains. Send support timestamps and sanitized errors rather than passwords or authentication tokens.

• Setting up DirectAdmin two-step authentication
• Creating a restricted DirectAdmin login key
• Diagnosing Dovecot login errors on DirectAdmin
• Investigating DirectAdmin disk-usage differences

• DirectAdmin: Securing With Bfm