Hello Laszlo,
As you can see in ThreatVault, " This signature detects suspicious and non-RFC compliant SMTP traffic on port 25. This could be associated with applications sending non SMTP traffic using port 25 or indicate possible malicious activity. "
This signature is alerting on port 25 traffic that is not valid SMTP traffic per RFC 5321 - Simple Mail Transfer Protocol. Security best practices recommend not allowing non SMTP traffic via port 25. Identifying the specific issue requires investigation into the actual traffic and/or hosts sending the traffic. Due to the broad category of non-rfc compliance, we are unable to provide a more specific description, as this signature simply detects if the traffic is not compliant with the RFC.
... View more