While reviewing logs on the email server I noticed 126.96.36.199 trying to authenticate via SASL.
This is not a normal IP that would be relaying email through the server, so I decided to block it at the firewall.
Undoubtedly, someone was trying to relay spam, whether they were aware or not.
First, I logged into my firewall via ssh to get a rule in place immediately:
iptables -I CHAIN -s 188.8.131.52 -j DROP
Listing the rules:
iptables -L --line-number
1 DROP 0 — ppp-184.108.40.206.revip.proen.co.th anywhere
Shows the new rule at the top of the chain. Exactly where I need it.