Adding new smtp parser for failed logins

I am running an SMTP Server and I want to block all IPs which try to login. The relevant log line is

smtp connected host=<unknown>
My idea is to start with the postfix parser from the hub and modify it.

Is this the right approach?

ok, wrong approach. this is the way to go