This is an autoblacklist for worms attacks.

When amavis scan a mail positively for virus (you could add spam too), block
the ip for a short amount of time (5min).

So that i don't get those brute force Netsky virus (just one).

The good thing is that it doesn't exclude anybody in particular like dynmic ip
ranges.