<P>Nothing 'normal' about these connections.</P> <P>The first IP address is in Spamhaus and other DNSBLs so you could block that easily. The second isn't - yet.</P> <P>Neither are doing anything but filling up your session log.</P>

<p>I have since months the following entries in my session logging files: </p><p>[quote]21:20:36.875: Connection from 71.6.165.200, Fri Aug 22 21:20:36 2014<lf> 21:20:36.875: << 220-mymailserver.com ESMTP server ready.<cr><lf>220-Use of this server for unauthorised relaying of mail is forbidden.<cr><lf>220-Unsolicited Commercial E-mail ("spam") is NOT welcome here.<cr><lf>220 ALL ACCESS WILL BE MONITORED AND LOGGED.<cr><lf> 21:20:36.875: >> 

8
21:20:36.875: << 501 Syntax error in parameters or arguments.<cr><lf> 21:20:36.875: >> À"À! 21:20:36.875: << 501 Syntax error in parameters or arguments.<cr><lf> 21:20:36.875: >> À/À+À'À#ÀÀ    ÀÀ 21:20:36.891: << 501 Syntax error in parameters or arguments.<cr><lf> 21:20:36.891: >> 21:20:36.891: << 501 Syntax error in parameters or arguments.<cr><lf> 21:20:41.219: 7: NB Socket read error 10054 (connection aborted by remote host) 21:20:41.219: --- Connection closed normally at Fri Aug 22 21:20:41 2014. --- 21:20:41.219: [/quote]</p><p>... </p><p>[quote]15:48:04.845: Connection from 54.183.248.186, Thu Sep 25 15:48:04 2014<lf> 15:48:04.845: << 220-mymailserver.com ESMTP server ready.<cr><lf>220-Use of this server for unauthorised relaying of mail is forbidden.<cr><lf>220-Unsolicited Commercial E-mail ("spam") is NOT welcome here.<cr><lf>220 ALL ACCESS WILL BE MONITORED AND LOGGED.<cr><lf> 15:48:04.126: >> 
15:48:04.142: << 501 Syntax error in parameters or arguments.<cr><lf> 15:48:04.142: >> ­ì™ÜÊ[€öšðì±ÞL^<cr>’× 15:48:04.142: << 501 Syntax error in parameters or arguments.<cr><lf> 15:48:04.142: >> À"À! 15:48:04.142: << 501 Syntax error in parameters or arguments.<cr><lf> 15:48:04.142: >> ÀÀ    ÀÀ 15:48:04.142: << 501 Syntax error in parameters or arguments.<cr><lf> 15:48:04.142: >> 15:48:04.142: << 501 Syntax error in parameters or arguments.<cr><lf> 15:48:24.814: --- Connection closed normally at Thu Sep 25 15:48:24 2014. --- 15:48:24.814: [/quote] </p><p> </p><p>Are this attempts of a normal connection or scans for servers with open Heartbleed bug? </p>