Hope to get some attention about this idea to reduce hacking passwords.
Here is a list of about 700,000 IP addresses that are hacking passwords through SMTP AUTH
http://ipadmin.junkemailfilter.com/auth-hack.txt
This is a list of IP addresses that attempted to authenticate against my fake AUTH advertizing on servers with no authentication. We do front end spam filtering for thousands of domains and I decided to advertize authentication where there is none and I accept and blackhole all authenticated email to those servers. I have harvested the IP addresses in this list that is available through an RBL.
It seems to me that a nice dovecot feature would be the ability to do a black list check against IP addresses connecting and deny access if listed.
Thoughts?