While reviewing logs on the email server I noticed 18.104.22.168 trying to authenticate via SASL.
This is not a normal IP that would be relaying email through the server, so I decided to block it at the firewall.
Undoubtedly, someone was trying to relay spam, whether they were aware or not.
First, I logged into my firewall via ssh to get a rule in place immediately:
iptables -I CHAIN -s 22.214.171.124 -j DROP
Listing the rules:
iptables -L --line-number
1 DROP 0 — ppp-126.96.36.199.revip.proen.co.th anywhere
Shows the new rule at the top of the chain. Exactly where I need it.