Get the offender IP data

DNSBL

Point your mail server at dnsbl.mxo.michaelspost.com for a DNSBL. It returns 127.0.0.2 for any blocked IP.

A Postfix smtpd_recipient_restrictions line:

reject_rbl_client dnsbl.mxo.michaelspost.com=127.0.0.2

You might notice that the timestamps on some rows are all the same. I’ve been gathering the data for quite some time, but only recently started tracking the timestamp.