Adding new smtp parser for failed logins

I am running an SMTP Server and I want to block all IPs which try to login. The relevant log line is

smtp connected address=107.182.yyy.xxx host=<unknown>
My idea is to start with the postfix parser from the hub and modify it.

Is this the right approach?

ok, wrong approach. this is the way to go