The Abusix Exploits list observes the behavior of SMTP clients connecting to Abusix traps and their partners’ mail services. It lists any IP exhibiting irregular SMTP client behavior in a way that indicates that it is either a compromised host or service (including loT devices), open-proxy, VPN, TOR exit node, viruses/worms, or botnet infected.