Re: Log entries - possible compromise

I was not reading the log entry correct and saw it as an outgoing. Yes, I did edit the destination address.

Here is the rule:

rule action proto packets bytes
----   ------    -----    -------     -----
5     drop     all       4       160
condition - match-set SPAMHAUS_DROP src LOG enabled

So, the Spamhaus drop is working as it should.

Thanks for the assistance.