spam IP addresses

[Tom Anderson]

From: "Boris 'pi' Piwinger" <3.14 at logic.univie.ac.at>
> tallison at tacocat.net wrote:
> 
> > Just for fun I counted up all the IP addresses that sent me spam and did
> > a tally of how many of these IP addresses sent me how many spams
> > # spam    # of IP addresses
> > 1         4617
> > 2         243
> > 3         28
> > 4         6
> > 5         2
> > 8         3
> > 28        1
> > 180       1

Alternatively, look at ASNs.  Here are some of my top ones:

#spam    #ham     #ASN
 1050       0     as4294967295
  671       0     as6478
  415       1     as7132
  308     217     as22909
  235      13     as3561
  237       0     as4134
  213       5     as3356
  172       0     as852
  173       0     as11938
   12     156     as13749

Of course the list goes on... there are dozens of very polarized ASNs in my list.  This seems quite useful.  Perhaps this is because spammers will rotate IPs but stay in the same general area.  Subnets might help in this regard too, but probably not quite as much.

Tom
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.bogofilter.org/pipermail/bogofilter/attachments/20040524/bc22ed89/attachment.html>