Hi,
By default connections blocked by SenderBase is closed at the start of the SMPT conversation. Meaning there is no domain information in any the log files regards to sender or recipient of the email.
BUT, if you want that information you can enable "HAT delayed rejections".
For example, you now can see the mail from address and each recipient address of the message which is blocked. When you enable HAT delayed rejection, the following behavior occurs:
--The MAIL FROM command is accepted, but no message object is created.
--All RCPT TO commands are rejected with text explaining that access to send e-mail is refused.
--If the sending MTA authenticates with SMTP AUTH, they are granted a RELAY policy and are allowed to deliver mail as normal.
NOTE: This is only configurable from the CLI listenerconfig --> setup command.
Regards to reporting, you did know you can do this on the M-series. But what you can do on C-series is do export the "Internal User" report in CSV format and work with Excel to get the data you want.
/Fredrik