Ours show up in administrative.log - detail level set to "detailed"
This is a sample of Country Block "denial" on SMTP protocol, but from administrative.log:
00:10:20.503 [101.13.5.26] SMTP User [REDACTED] with IP 101.13.5.26 attempting login from country Taiwan (TW) not on the allowed country list.
MailEnable survivor / convert --