Вот начирикал скриптик антиспама для сервера под Exim :

#!/usr/bin/php
<?php
/*

Zapusk po crontab kajdie 3 min.
Zapusk po crontab kajdie 2 chasa na sbros ipset -F drop (/flush_drop.sh) ESLI HOCHETSA PROSCHAT

*/
//exit(1);
$dat=date("d-m-Y H:i");
$time=time();
`/bin/cp /var/log/exim/mainmail.log /tmp/t.log`;
`echo $dat > /var/log/exim/mainmail.log`;
$un=" where inet_ntoa(ip) not like '192.168.%'";  // ISSKLUCHENIA
mysql_connect("localhost","USER_NAME","PASSWORD");
mysql_select_db("spam_block");
$g=fopen("/tmp/t.log","r");
while(!feof($g))
{
$f=fgets($g, 4096);
$d=substr($f,0,strlen($f)-1);
$i1=strpos($d,'[');
$i2=strpos($d,']');
$ip=substr($d,$i1+1,$i2-$i1-1);
$ins=mysql_query("insert into spam_tmp (ip,dates) values (inet_aton('".$ip."'),'".$time."');");
}
/*
# mysql database
create database spam_block;
create table spam_tmp (ip int(15)unsigned not null, dates int(15)not null);
create table ban (ip int(15)unsigned not null, dates timestamp);
# ipset droping
ipset -N drop iphash
iptables -I INPUT -p tcp --dport 25 -m set --set drop src -j DROP
#
*/
$chk_ban=mysql_query("select inet_ntoa(ip) , count(ip) from spam_tmp ".$un." group by ip DESC;");
while($row_ban=mysql_fetch_array($chk_ban))
{
if($row_ban[1]>50){
`/sbin/ipset -qA drop $row_ban[0]`;
// or
//`iptables -A INPUT -p tcp --dport 25 -s $row_ban[1] -j DROP`;
// ESLI NET IPSET
echo "Blocked: ".$row_ban[0]."\tNum: ".$row_ban[1]."\n";
$ins_ban=mysql_query("insert into ban (ip) values (inet_aton('".$row_ban[0]."'));");
}
}
$clear=mysql_query("delete from spam_tmp;");
pclose($g);
?>