A few days ago I successfully switched my existing mail server to hMailServer. I was browsing my LOG files and found some IPs tried to DOS the SMTP service.
I made a tool which checks all of the LOG files and looks for 530 and 535 errors, collects the IP addresses and the times and prints it out to the screen in this format:
--> IP Address
Date & Time (tab)
You only have to browse the output to check which are the most problematic IPs to ban
Script was written in PERL and requires only 1 variable to set to let it work. I attached a CMD file too, which collects the results and opens them in a Notepad.