spam IP addresses

[Chris Wilkes]

On Mon, May 24, 2004 at 09:02:44AM -0400, tallison at tacocat.net wrote:
> Just for fun I counted up all the IP addresses that sent me spam and did
> a tally of how many of these IP addresses sent me how many spams
> # spam    # of IP addresses
> 1         4617
> 180       1
> 2         243
> 28        1
> 3         28
> 4         6
> 5         2
> 8         3

Can you break down the IPs into their class C subnets (ie 192.168.0.x)?
Do a reverse DNS lookup?  Course the dnslookup isn't very helpful.

I've attached a gziped perl script (that shouldn't enter into anyone's
wordlists, right?) that will do it for you.  Run the help to see how to
use it:  "./sortbysubnet.pl -h"

Chris
-------------- next part --------------
A non-text attachment was scrubbed...
Name: sortbysubnet.pl.gz
Type: application/x-gunzip
Size: 702 bytes
Desc: not available
URL: <http://www.bogofilter.org/pipermail/bogofilter/attachments/20040524/853ccf3b/attachment.bin>