Hi John, I think you'll find that the cached IP blocking feature will do this for you.  With the ip limbo/cache featured enabled, ips are recorded for servers that send you a message that was rejected.  If they send more rejected messages within a specific amount of time (3 within 10 minutes, by default), then their is temporarily banned (default: for 60 minutes).

Now, with those defaults, it's not going to block them on their first rejection, but it should help.  In fact, it's probably better that you don't reject after the first rejection....  imagine if I misspelled my friend mike's email as miek@email.com.  I might not be able to re-try sending my message for 4 hours if I don't have a 2nd chance.

Anywho... one thing I like to do: put dozens of bogus honeypot email addresses hidden on my organization's web site.  That's one way to put some spammers straight onto your blacklist once they send to one of the no-no addresses.

jerbo, for my web site's honeypot list I use a combo of white text on white bg, font-size of 1px.  In addition, I keep all of the email addresses in a <DIV> container with a css display property of style="display: none".

In terms of tracking down the i.p.s (at least in SpamFilter v3.1.3.597)...

Finding the original infraction
(the one that added the ip to the list)
*In logs: Entries should look similar to..
... EMail To is in honeypot emails -
... Added 123.123.123.123 to honeypot blacklist
*in quarantine:
"where tblquarantine.rejectid = 18"

Finding rejections due to the fact that an i.p. is in HoneypotBlockedIPs.txt
*In logs: Entries should look similar to...
... IP blocked by honeypot autofilter -
... 123.123.123.123 - Mail from: bozo@spam.com To: me@mydomain.com will be rejected
*in quarantine:
"where tblquarantine.rejectid = 18"

In the quarantine, I don't think there is a way to specificly search for the email that caused the i.p. to go on the list.  Though, if I were trying to do that would do a query with "where rejectid = 18 and (emailto = 'honeypotemail1@mydomain' or emailto = 'honeypotemail2...', etc)"

Also, I made a unix bash script that takes my entire HoneypotBlockedIPs.txt list and runs a reverse DNS for the entire list.  This is helpful for me to identify major domain names and mail sservers.  Would that be useful for you?


Edited by sgeorge

Samsung Wrote:

"If Auth-TO lists are used, and hidden email address seed is not in Auth-TO list, then spammer's action when emailing seeding address does it trigger Honeypot??"

I am also interested in an answer to this question.
Thanks,
Michael

Thermo wrote: Samsung Wrote: "If Auth-TO lists are used, and hidden email address seed is not in Auth-TO list, then spammer's action when emailing seeding address does it trigger Honeypot??" I am also interested in an answer to this question. Thanks, Michael

The name has to be in the AuthorizedTo list as well as the HoneyPot to work.