spam IP addresses

[dave-bogofilter at homer.cymry.org]

On Mon, May 24, 2004 at 03:09:44PM +0200, Boris 'pi' Piwinger wrote:
> tallison at tacocat.net wrote:
> 
> > Just for fun I counted up all the IP addresses that sent me spam and did
> > a tally of how many of these IP addresses sent me how many spams
> > # spam    # of IP addresses
> > 1         4617
> > 2         243
> > 3         28
> > 4         6
> > 5         2
> > 8         3
> > 28        1
> > 180       1
> 
> I changed the sorting to numeric;-)
> 
> This suggests, that most IP addresses are only used once or
> twice. This is in line with my tests which showed, that IP
> addresses are not useful for me (see
> http://piology.org/bogofilter/). From your results we cannot
> see if subnets are useful, for me I could easily do without.
> 

A fascinating thread. 

Below is the same excercise on two weeks of my companies spam (200,000+ spams). Two
points. 

1. Yes the number of spams sent from a single ip is disproportionatly high, but given a
situation where BF is protecting a large number of addresses using a single set of
wordlists, it can be seen that a single ip may be used to send a single spam to hundreds
or thousands of different email addresses. Thus IP can become good data for spam
recognition in certain situations.  

2. Even if IP is not a piece of data that lends itself towards recognizing spam, it is
most certainly a piece of data useful for recognizing ham, which in my case is at least
equally important.

#spam   #Ip's
1       36605
2       8640
3       3835
4       2169
5       1443
6       990
7       711
8       596
9       438
10      353
11      234
12      193
13      136
14      114
15      121
16      71
17      79
18      64
19      58
20      53
21      56
22      33
23      27
24      42
25      25
26      33
27      27
28      21
29      34
30      31
31      37
32      33
33      29
34      29
35      23
36      31
37      21
38      19
39      22
40      20
41      18
42      15
43      17
44      17
45      13
46      7
47      15
48      9
49      10
50      7
51      12
52      2
53      7
54      4
55      6
56      7
57      10
58      8
59      2
60      13
61      4
62      3
63      5
64      7
65      4
66      7
67      5
68      6
69      6
70      9
71      2
72      8
73      4
74      2
75      7
76      5
77      2
78      1
79      2
80      3
81      5
82      3
83      7
84      5
85      2
86      1
87      1
88      1
89      1
90      2
91      3
92      3
93      1
94      1
95      1
96      2
97      4
98      2
99      1
100     1
101     2
102     3
103     1
104     2
106     4
110     2
111     3
112     3
114     1
115     1
117     2
118     1
119     3
121     2
122     1
123     1
125     1
126     1
127     1
128     1
129     1
130     1
131     1
132     1
133     1
134     2
135     2
138     1
139     4
142     1
143     1
145     2
146     2
147     2
148     1
152     1
154     1
155     2
156     2
157     2
162     1
164     1
168     1
169     2
174     1
175     1
176     1
177     1
180     1
181     1
186     1
191     1
193     2
194     1
199     3
200     2
204     1
206     1
207     1
208     1
209     1
210     2
214     1
215     2
221     1
232     1
234     1
238     1
239     1
240     1
241     1
244     1
245     1
247     1
253     1
255     1
260     1
265     1
266     1
269     1
273     3
278     3
285     1
299     2
304     1
310     2
313     1
314     1
316     1
323     1
329     2
340     2
342     1
354     1
359     1
369     1
371     1
374     1
378     1
380     1
419     1
421     1
426     1
458     1
461     1
464     1
473     1
488     1
496     1
504     1
513     1
520     1
525     1
536     1
661     1
709     1
739     1
762     1
881     1
911     1
949     1
963     1
1018    1
1110    1
1139    1
1686    1
1903    1