Bad Reputation (Bad IPs List)

[mehdi rad]

Hello
How can I find the IP addresses that have been blocked by the smg product as bad reputation through the available reports? As shown in the attached photo, 2205 IPs have been blocked during the past day, if none The IP address is not specified in the output reports
It should be noted that the IP Connection - top rejected Connections report does not give any output during a day and gives the following error.
  No data is available for the report type and time range specified.
Thanks

[alexander smg]

Don’t think u can.

[Thomas Anderson]

You "should" be able to get the information you are looking for by using the malquery tool or (probably more convenient) the GUI to query the Message Audit Log.  The verdict you want to search for is "dns_deny_ip".  The MAL record will show the "connecting" and the "logical" IP addresses.

IF the verdict was due to some intermediate relay/hop, then the IP won't be shown.  (this is probably something we should address).

From the reports you have shown, none of these messages were blocked by Global Reputation, so all of the IPs that were filtered appear to have come from your "local bad senders" list.

Hope this helps.

[mehdi rad]

I did not add any IP in the local bad senders section.

[Thomas Anderson]

Did you query the Message Audit Log information, as I recommended above?  What did you find?