it looks someone or something is trying to hack our Exchange.
Exchange Server Transport Protocol Logs:
it appears the internet facing IP on the firewall has not been locked down correctly, so is open to all internet traffic (the network team will double check it).
It looks to me that someone is running an smtp-auth attack against us, correct ?
I don't understand why after the Auth Login command i see the 334 and not the Base64 encoded user and password ?
I'm fairly new to security.
Any help i highly appreciated.