<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2800.1400" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY>
<DIV>
<DIV><FONT face=Arial size=2>From: "Boris 'pi' Piwinger" <</FONT><A
href="mailto:3.14@logic.univie.ac.at"><FONT face=Arial
size=2>3.14@logic.univie.ac.at</FONT></A><FONT face=Arial
size=2>></FONT></DIV></DIV>
<DIV><FONT face=Arial size=2>> </FONT><A
href="mailto:tallison@tacocat.net"><FONT face=Arial
size=2>tallison@tacocat.net</FONT></A><FONT face=Arial size=2> wrote:<BR>>
<BR>> > Just for fun I counted up all the IP addresses that sent me spam
and did<BR>> > a tally of how many of these IP addresses sent me how many
spams<BR>> > # spam # of IP addresses<BR>> >
1 4617<BR>> >
2 243<BR>> >
3 28<BR>> >
4 6<BR>> >
5 2<BR>> >
8 3<BR>> >
28 1<BR>> >
180 1<BR></FONT></DIV>
<DIV><FONT face=Arial size=2>Alternatively, look at ASNs. Here are some of
my top ones:</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face="Courier New" size=2>#spam
#ham #ASN</FONT></DIV>
<DIV><FONT size=2>
<DIV><FONT face="Courier New"
size=2> 1050 0
as4294967295</FONT></DIV>
<DIV><FONT face="Courier New">
671 0
as6478</FONT></DIV>
<DIV><FONT face="Courier New">
415 1
as7132</FONT></DIV></FONT></DIV>
<DIV><FONT size=2>
<DIV><FONT face="Courier New"
size=2> 308 217
as22909</FONT></DIV></FONT></DIV>
<DIV><FONT size=2>
<DIV><FONT size=2>
<DIV><FONT face="Courier New"
size=2> 235 13
as3561</FONT></DIV></FONT></DIV>
<DIV><FONT face="Courier New"
size=2> 237
0 as4134</FONT></DIV></FONT></DIV>
<DIV><FONT size=2>
<DIV><FONT face="Courier New"
size=2> 213 5
as3356</FONT></DIV>
<DIV><FONT
face="Courier New"> 172
0 as852</FONT></DIV></FONT></DIV>
<DIV><FONT face="Courier New"
size=2> 173
0 as11938</FONT></DIV>
<DIV><FONT face="Courier New"
size=2> 12 156
as13749</FONT></DIV>
<DIV><FONT size=2><FONT size=2><FONT
face="Courier New"></FONT> </DIV></FONT>
<DIV><FONT face=Arial>Of course the list goes on... there are dozens of very
polarized ASNs in my list. This seems quite useful. Perhaps this is
because spammers will rotate IPs but stay in the same general area.
Subnets might help in this regard too, but probably not quite as
much.</FONT></DIV>
<DIV><FONT face=Arial></FONT> </DIV>
<DIV><FONT face=Arial>Tom</FONT></DIV>
<DIV><FONT face=Arial></FONT> </DIV></FONT></BODY></HTML>