People who follow the SVN commits list will have seen that I posted an enemies_list plugin in contrib.
EnemiesList is a database of regular expressions that map to dynamic-looking hosts. It's non-free, which is why I've posted it in the contrib directory. In the EL contrib directory (on their server) there's a perl module for loading the regular expressions and matching very quickly against a hostname in there (much faster than if you loaded all the regexps into perl itself). If you have all that working (the DNS::RE module) then the plugin queries the EL database for the HELO host given. This is generally a very strong spamware sign, though I've left it so that the plugin just stores the results in $transaction->notes so you can do with it as you wish. http://enemieslist.com/about/
