# SPDX-License-Identifier: AGPL-3.0-only
# Something that is not a mail client talking to the SMTP port:
#   warning: non-SMTP command from unknown[203.0.113.9]: GET / HTTP/1.1
#   warning: non-SMTP command from unknown[203.0.113.9]: \026\003\001...
#
# HTTP verbs and TLS handshake bytes on port 25 are port scanners and
# exploit probes, never a misconfigured sender. Translated from
# CrowdSec's postfix-non-smtp-command (instant ban).
#
# The hostname before the bracket is rDNS and untrusted; the address
# inside the brackets is what postfix measured.
parser: postfix-non-smtp
log: mail
prefilter: "non-SMTP command"
regex: '^(?P<time>[A-Z][a-z]{2} [ 0-9]\d \d{2}:\d{2}:\d{2}) \S+ postfix/smtpd\[\d+\]: warning: non-SMTP command from \S+\[(?P<ip>[0-9a-fA-F.:]+)\]:'
time_field: time
time_format: syslog
