spam IP addresses

[Boris 'pi' Piwinger]

dave-bogofilter at homer.cymry.org wrote:

>> This suggests, that most IP addresses are only used once or
>> twice. This is in line with my tests which showed, that IP
>> addresses are not useful for me (see
>> http://piology.org/bogofilter/). From your results we cannot
>> see if subnets are useful, for me I could easily do without.

>1. Yes the number of spams sent from a single ip is disproportionatly high, but given a
>situation where BF is protecting a large number of addresses using a single set of
>wordlists, it can be seen that a single ip may be used to send a single spam to hundreds
>or thousands of different email addresses. Thus IP can become good data for spam
>recognition in certain situations.  

That seems to work even if you don't take it as an ip
address, but as four numbers.

>2. Even if IP is not a piece of data that lends itself towards recognizing spam, it is
>most certainly a piece of data useful for recognizing ham, which in my case is at least
>equally important.

Also that was not found in my test.

pi