(What's really annoying is that sendmail doesn't log the ip of the remote connection until it's done (if you're blocking them) -- I'd love to be able to create an RBL on this and nip it in the bud).
We use a variation of rumplekiller.pl for exactly this purpose: http://bignosebird.com/notebook/rumplekill.shtml
The script as written just blackholes the IP address, but it's easy enough to change what it runs when it catches one.
We used to get 10+ each day, but in the last few months it's gone down to 2 or 3.
-- Kelson Vibber SpeedGate Communications <www.speed.net>
