You can't configure the IMR to use any real time black hole list, which are run by some organisations to prevent spam. If you need to use an external device to perform this function, it makes the IMR's domain blocking irrelevant. The antivirus scanner in the IMR is licensed from Trend Micro, and the price of the IMR includes one year of virus definition updates. The scanner can check message attachments for any viruses in its definition files. You can choose to scan all attachments for maximum security or specify the extensions of attachments you want to scan if you need more performance.
Infected attachments generate a log entry and an alert message to a user-definable email address.
The sender and intended recipient of the message also get notifications informing them of the attachment's infected status and what the IMR has done with it. If cleaning fails then you can fall back on one of the previous options. You can update the virus signature file manually from the IMR's web interface, or set it to perform scheduled downloads at a frequency of your choosing. It's commendable that Mirapoint has made its IMR hardware fault-tolerant, but clusters of mail handlers would achieve the same results. Similarly, the IMR's software provides some excellent functions, but nothing that isn't available from other packages.