something like bruteblock for pf?

[Len Conrad]

>> I've used bruteblock, which manages ipfw, for blocking SMTP attackers and reducing smtp connects by 10s of 1000s per day.
>
>[snip]
>
>> Anybody know of anything similar for pf?
>
>
>http://www.bgnett.no/~peter/pf/en/spamd.setup.html

thanks, but I've never liked tarpitting, no matter how inexpensive it is, and I already have greylisting. 

I'm looking for something like bruteblock that logwatches (smtp, ssh, ftp, whatever) and inserts/removes TCP block rules into pf for x hours, so the protocol daemons are involved.

Len