I think someone was trying to use my server as a relay

maybl8

this is what I see in the log.
Does this look like a relay attempt?

postfix-mailcow-1  | Feb 22 21:52:52 04d9fb66ab32 postfix/tlsproxy[2652]: Anonymous TLS connection established from [222.106.198.35]:42506: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)
postfix-mailcow-1  | Feb 22 21:52:54 04d9fb66ab32 postfix/postscreen[2631]: NOQUEUE: reject: RCPT from [222.106.198.35]:42506: 550 5.7.1 Service unavailable; client [222.106.198.35] blocked using bl.mailspike.net; from=<billing@dccathome.com>, to=<rockstarbaba@mail.ru>, proto=ESMTP, helo=<8HDFu7>
postfix-mailcow-1  | Feb 22 21:52:54 04d9fb66ab32 postfix/postscreen[2631]: DISCONNECT [222.106.198.35]:42506
postfix-mailcow-1  | Feb 22 21:52:54 04d9fb66ab32 postfix/tlsproxy[2652]: DISCONNECT [222.106.198.35]:42506

I don’t have a billing@dccathome.com address

esackbauer

That would be just a normal spam attempt which is already blocked by mailspike DNSBL.

maybl8

It worried me when I saw the from= to=

I did see that it was blocked.

esackbauer

maybl8 It worried me when I saw the from= to=

you will see that in many spam attacks. The blocklist is triggered earlier than the relay check.