netsecurity database

in general

We do not tag single host - we always tag the complete smallest network segment we find for the offending IP.

One attack from a netrange and it's no customer net:
CIDR gets blocked.

If it is already tagged as spammer, it will get a hacking tag.
If not, its only tagged as webspammer.

If it's a foreign DialIn Net, it gets completely blocked.

country dependant

If the net is located in KR, CN, UA, RU, TW, BR, AR, CL etc - it always gets tagged as hacker.

The level of blocking for these countries is dependant on the interest of our customers to stay connected.

No interest = no connection needed = block complete.
If we need single host-communication from there - whitelisting will do it's job and override blocking.

If the attack originates from a customer network:

is it a datacenter? - gets blocked as webspammer to remain smtp open.

exception from rules:

-as always-

Is the hoster, as example, is located in US and known to host illegal content like pornos/filesharing and anonymizer services. Maybe, he offers anonymous registration of domains to hide the customer - the range is handled like a KR network.

to sum up

It's like in real life:
"Guests who spit in the living room are not invited again."