OT, but curious

[David Relson]

On Fri, 15 Oct 2004 11:08:57 -0600
Glenn English wrote:

> I built a script that puts spammer IPs in the firewall for a few days.
> 
> I noticed this morning in the firewall log that spam connect attempts
> seem to come in "quanta" of 9 tries (9, 18, 27...). Some don't, but by
> far most do -- or did yesterday, anyway. Anybody know why?

Glenn,

Sorry, no such pattern here in Michigan.  I used grep, awk, sed, etc to
extract the IP address and do a frequency count.  With 9100 messages
this month (so far), there were 4920 distinct addresses used between 1
and 402 times.  Here're the details:

   3568 1 - many addresses appeared exactly once 
    640 2 - 640 addresses appeared twice
    306 3
    214 4
     49 5
     42 6
     16 7
     16 8
     10 9
     13 10
      6 11
      5 12
      6 13
      6 14
      3 15
      3 16
      3 18
      4 19
      1 21
      1 25
      1 28
      1 30
      1 35
      1 69
      1 70
      1 153 - 1 address used 153 times
      1 186 - 1 --- 186x
      1 402 - 1 --- 402x