Thanx everyone
Sorry for overlapping to other posts.
I found that blocking the addresses with the open sessions solves the problem (until they switch ip)
here is the log you requested:
@400000005bcc30422fee706c 22364 Connection from Unknown [49.72.92.97]
@400000005bcc30422fee783c 22364 in config(plugins)
@400000005bcc30422fee783c 22364 config(plugins): hook returned (0,)
@400000005bcc30422fee783c 22364 in config(plugin_dirs)
@400000005bcc30422fee7c24 22364 config(plugin_dirs): hook returned (0,)
@400000005bcc30422fee7c24 22364 Loading hosts_allow from /usr/share/qpsmtpd/plugins/hosts_allow
@400000005bcc30422fee800c 22364 hosts_allow hooking pre-connection
@400000005bcc30422fee800c 22364 in config(plugin_dirs)
@400000005bcc30422feea334 22364 config(plugin_dirs): hook returned (0,)
@400000005bcc30422feea334 22364 Loading peers from /usr/share/qpsmtpd/plugins/peers
@400000005bcc30422feea71c 22364 in config(peers/0)
@400000005bcc30422feea71c 22364 config(peers/0): hook returned (0,)
@400000005bcc30422feea71c 22364 in config(plugin_dirs)
@400000005bcc30422feeab04 22364 config(plugin_dirs): hook returned (0,)
@400000005bcc30422feeab04 22364 (init) peers: Loading tls ssl/cert.pem ssl/cert.pem ssl/cert.pem ssl/dhparam.pem from /usr/share/qpsmtpd/plugins/tls
@400000005bcc30422feebaa4 22364 (init) peers: Loading auth/auth_cvm_unix_local cvm_socket /var/lib/cvm/cvm-unix-local.socket enable_smtp yes enable_ssmtp yes from /usr/share/qpsmtpd/plugins/auth/auth_cvm_unix_local
@400000005bcc30422feec274 22364 (init) peers: Loading earlytalker from /usr/share/qpsmtpd/plugins/earlytalker
@400000005bcc30422feec274 22364 (init) peers: Loading bogus_bounce from /usr/share/qpsmtpd/plugins/bogus_bounce
@400000005bcc30422feeddcc 22364 (init) peers: Loading count_unrecognized_commands 4 from /usr/share/qpsmtpd/plugins/count_unrecognized_commands
@400000005bcc30422feee1b4 22364 (init) peers: Loading relay from /usr/share/qpsmtpd/plugins/relay
@400000005bcc30422feee1b4 22364 (init) peers: Loading helo policy lenient reject naughty from /usr/share/qpsmtpd/plugins/helo
@400000005bcc30422feee59c 22364 (init) peers: Loading resolvable_fromhost from /usr/share/qpsmtpd/plugins/resolvable_fromhost
@400000005bcc30422fef00f4 22364 (init) peers: Loading headers from /usr/share/qpsmtpd/plugins/headers
@400000005bcc30422fef00f4 22364 (init) peers: Loading loadcheck max_load 7 from /usr/share/qpsmtpd/plugins/loadcheck
@400000005bcc30422fef04dc 22364 (init) peers: Loading sender_permitted_from reject 1 no_dmarc_policy 0 from /usr/share/qpsmtpd/plugins/sender_permitted_from
@400000005bcc30422fef08c4 22364 (init) peers: Loading dkim reject 0 from /usr/share/qpsmtpd/plugins/dkim
@400000005bcc30422fef435c 22364 (init) peers: Loading dmarc reject 0 reporting 1 from /usr/share/qpsmtpd/plugins/dmarc
@400000005bcc30422fef4744 22364 (init) peers: Loading naughty reject mail from /usr/share/qpsmtpd/plugins/naughty
@400000005bcc30422fef4b2c 22364 (init) peers: Loading badmailfrom from /usr/share/qpsmtpd/plugins/badmailfrom
@400000005bcc30422fef629c 22364 (init) peers: Loading badrcptto more_badrcptto badrcptto_ext from /usr/share/qpsmtpd/plugins/badrcptto
@400000005bcc30422fef6684 22364 (init) peers: Loading check_goodrcptto extn - from /usr/share/qpsmtpd/plugins/check_goodrcptto
@400000005bcc30422fef6a6c 22364 (init) peers: Loading rcpt_ok from /usr/share/qpsmtpd/plugins/rcpt_ok
@400000005bcc30422fef6a6c 22364 (init) peers: Loading tnef2mime from /usr/share/qpsmtpd/plugins/tnef2mime
@400000005bcc30422fef7a0c 22364 (init) peers: Loading queue/qmail-queue from /usr/share/qpsmtpd/plugins/queue/qmail-queue
@400000005bcc30422fef7df4 22364 peers hooking valid_auth
@400000005bcc30422fef7df4 22364 peers hooking set_hooks
@400000005bcc30422fef81dc 22364 in config(plugin_dirs)
@400000005bcc30422fef81dc 22364 config(plugin_dirs): hook returned (0,)
@400000005bcc30422fef81dc 22364 in config(tls_ciphers)
@400000005bcc30422fef8d94 22364 config(tls_ciphers): hook returned (0,)
@400000005bcc30422fef917c 22364 in config(tls_protocols)
@400000005bcc30422fef917c 22364 config(tls_protocols): hook returned (0,)
@400000005bcc30422fef9564 22364 tls: ciphers: ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM
@400000005bcc30422fef9564 22364 tls hooking connect
@400000005bcc30422fef9564 22364 tls hooking ehlo
@400000005bcc30422fef994c 22364 tls hooking helo
@400000005bcc30422fef994c 22364 tls hooking rcpt
@400000005bcc30422fefa504 22364 tls hooking mail
@400000005bcc30422fefa504 22364 tls hooking data
@400000005bcc30422fefa8ec 22364 tls hooking post-connection
@400000005bcc30422fefc05c 22364 tls hooking unrecognized_command
@400000005bcc30422fefc05c 22364 (set_hooks) running plugin: peers
@400000005bcc30422fefc444 22364 in config(peers/0)
@400000005bcc30422fefc444 22364 config(peers/0): hook returned (0,)
@400000005bcc30422fefc444 22364 in config(plugin_dirs)
@400000005bcc30422fefc82c 22364 config(plugin_dirs): hook returned (0,)
@400000005bcc30422fefc82c 22364 in config(peers/0)
@400000005bcc30422fefc82c 22364 config(peers/0): hook returned (0,)
@400000005bcc30422fefd7cc 22364 in config(plugin_dirs)
@400000005bcc30422fefd7cc 22364 config(plugin_dirs): hook returned (0,)
@400000005bcc30422fefdbb4 22364 peers hooking valid_auth
@400000005bcc30422fefdbb4 22364 peers hooking set_hooks
@400000005bcc30422fefdbb4 22364 in config(plugin_dirs)
@400000005bcc30422fefdf9c 22364 config(plugin_dirs): hook returned (0,)
@400000005bcc30422fefdf9c 22364 logging::logterse hooking queue
@400000005bcc30422fefdf9c 22364 logging::logterse hooking deny
@400000005bcc30422fefef3c 22364 in config(plugin_dirs)
@400000005bcc30422fefef3c 22364 config(plugin_dirs): hook returned (0,)
@400000005bcc30422fefef3c 22364 in config(tls_ciphers)
@400000005bcc30422feff324 22364 config(tls_ciphers): hook returned (0,)
@400000005bcc30422feff324 22364 in config(tls_protocols)
@400000005bcc30422feff324 22364 config(tls_protocols): hook returned (0,)
@400000005bcc30422feff70c 22364 tls: ciphers: ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM
@400000005bcc30422ff002c4 22364 tls hooking connect
@400000005bcc30422ff006ac 22364 tls hooking ehlo
@400000005bcc30422ff006ac 22364 tls hooking helo
@400000005bcc30422ff006ac 22364 tls hooking rcpt
@400000005bcc30422ff00a94 22364 tls hooking mail
@400000005bcc30422ff00a94 22364 tls hooking data
@400000005bcc30422ff02204 22364 tls hooking post-connection
@400000005bcc30422ff02204 22364 tls hooking unrecognized_command
@400000005bcc30422ff02204 22364 in config(plugin_dirs)
@400000005bcc30422ff025ec 22364 config(plugin_dirs): hook returned (0,)
@400000005bcc30422ff025ec 22364 auth::auth_cvm_unix_local hooking auth-plain
@400000005bcc30422ff025ec 22364 auth::auth_cvm_unix_local hooking auth-login
@400000005bcc30422ff029d4 22364 in config(plugin_dirs)
@400000005bcc30422ff029d4 22364 config(plugin_dirs): hook returned (0,)
@400000005bcc30422ff04cfc 22364 earlytalker hooking connect
@400000005bcc30422ff04cfc 22364 earlytalker hooking data
@400000005bcc30422ff050e4 22364 in config(plugin_dirs)
@400000005bcc30422ff050e4 22364 config(plugin_dirs): hook returned (0,)
@400000005bcc30422ff050e4 22364 bogus_bounce hooking data_post
@400000005bcc30422ff054cc 22364 in config(plugin_dirs)
@400000005bcc30422ff054cc 22364 config(plugin_dirs): hook returned (0,)
@400000005bcc30422ff054cc 22364 count_unrecognized_commands hooking unrecognized_command
@400000005bcc30422ff0646c 22364 in config(plugin_dirs)
@400000005bcc30422ff0646c 22364 config(plugin_dirs): hook returned (0,)
@400000005bcc30422ff06854 22364 relay hooking connect
@400000005bcc30422ff06854 22364 in config(plugin_dirs)
@400000005bcc30422ff06854 22364 config(plugin_dirs): hook returned (0,)
@400000005bcc30422ff06c3c 22364 helo hooking helo
@400000005bcc30422ff06c3c 22364 helo hooking ehlo
@400000005bcc30422ff06c3c 22364 helo hooking data_post
@400000005bcc30422ff077f4 22364 in config(plugin_dirs)
@400000005bcc30422ff07bdc 22364 config(plugin_dirs): hook returned (0,)
@400000005bcc30422ff07bdc 22364 resolvable_fromhost hooking mail
@400000005bcc30422ff07bdc 22364 in config(plugin_dirs)
@400000005bcc30422ff09b1c 22364 config(plugin_dirs): hook returned (0,)
@400000005bcc30422ff09b1c 22364 headers hooking data_post
@400000005bcc30422ff09b1c 22364 in config(plugin_dirs)
@400000005bcc30422ff09f04 22364 config(plugin_dirs): hook returned (0,)
@400000005bcc30422ff09f04 22364 loadcheck hooking connect
@400000005bcc30422ff09f04 22364 in config(plugin_dirs)
@400000005bcc30422ff0a2ec 22364 config(plugin_dirs): hook returned (0,)
@400000005bcc30422ff0a2ec 22364 sender_permitted_from hooking mail
@400000005bcc30422ff0b28c 22364 sender_permitted_from hooking data_post_headers
@400000005bcc30422ff0b28c 22364 in config(plugin_dirs)
@400000005bcc30422ff0b674 22364 config(plugin_dirs): hook returned (0,)
@400000005bcc304230afef94 22364 dkim hooking data_post_headers
@400000005bcc304230b08404 22364 in config(plugin_dirs)
@400000005bcc304230b0e1c4 22364 config(plugin_dirs): hook returned (0,)
@400000005bcc304237004ca4 22364 dmarc hooking data_post_headers
@400000005bcc30430085fad4 22364 dmarc hooking data_post
@400000005bcc30430085febc 22364 in config(plugin_dirs)
@400000005bcc30430085febc 22364 config(plugin_dirs): hook returned (0,)
@400000005bcc3043008602a4 22364 naughty hooking data_post
@400000005bcc3043008602a4 22364 naughty: registering hook mail
@400000005bcc3043008602a4 22364 naughty hooking mail
@400000005bcc30430086068c 22364 in config(plugin_dirs)
@400000005bcc30430086068c 22364 config(plugin_dirs): hook returned (0,)
@400000005bcc304300860a74 22364 badmailfrom hooking mail
@400000005bcc304300863954 22364 in config(plugin_dirs)
@400000005bcc304300863954 22364 config(plugin_dirs): hook returned (0,)
@400000005bcc304300863954 22364 badrcptto hooking rcpt
@400000005bcc304300863d3c 22364 in config(plugin_dirs)
@400000005bcc304300863d3c 22364 config(plugin_dirs): hook returned (0,)
@400000005bcc304300863d3c 22364 check_goodrcptto hooking rcpt
@400000005bcc304300864124 22364 in config(plugin_dirs)
@400000005bcc304300864124 22364 config(plugin_dirs): hook returned (0,)
@400000005bcc304300865c7c 22364 rcpt_ok hooking rcpt
@400000005bcc304300866064 22364 in config(plugin_dirs)
@400000005bcc304300866064 22364 config(plugin_dirs): hook returned (0,)
@400000005bcc304300866064 22364 tnef2mime hooking data_post
@400000005bcc30430086644c 22364 in config(plugin_dirs)
@400000005bcc30430086644c 22364 config(plugin_dirs): hook returned (0,)
@400000005bcc30430086644c 22364 queue::qmail_2dqueue hooking queue
@400000005bcc304300866834 22364 Plugin peers, hook set_hooks returned DECLINED,
@400000005bcc30430086dd64 22364 (connect) running plugin: tls
@400000005bcc307f22d6bd44 22364 (connect) tls: fail, unable to establish SSL
@400000005bcc307f22d7ea0c 22364 Plugin tls, hook connect returned DENYHARD, Cannot establish SSL session
@400000005bcc307f22d9ab44 22364 (deny) logging::logterse: ` 49.72.92.97 Unknown tls 903 Cannot establish SSL session msg denied before queued
@400000005bcc307f22daf74c 22364 550 Cannot establish SSL session
@400000005bcc307f22db938c 22364 click, disconnecting
@400000005bcc307f22dd21fc 22364 (post-connection) running plugin: tls
@400000005bcc307f22de1814 22364 Plugin tls, hook post-connection returned DECLINED,
@400000005bcc307f22f5e5d4 22364 DESTROY called by main, /usr/bin/qpsmtpd-forkserver, 0
@400000005bcc3080155ffe14 20626 cleaning up after 22364
Thanks for the help everyone