OT, but curious

[Glenn English]

On Mon, 2004-10-18 at 11:48, .rp wrote:
> > I built a script that puts spammer IPs in the firewall for a few days.
> >
> ooh,ooh, would you mind posting it?

It's kind of big (20K) for list posting, but if you'd like to see it,
I'd be more than happy to send it to you;

It's Perl, written with a strong Pascal/Java accent;
When I've changed my mind about what to firewall, I've commented out
some old lines and un-commented others and/or written new;

There's a whitelist file; 
The script uses Linux ipchains and modifies an input chain called
"spammers"; 
The age cutoff is set in a global variable; 
It builds networks, max size also in a global, with the IPs found; 
Right now, it's going through maillog and pulling out IPs that have been
rejected by Postfix (mostly from the spamhaus rbl) but there's code
(commented out) than will look through a mailbox, in mbox format, called
"bogofilter".

If you want it, let me know.

> I've noticed groups of 5. I think it is related to how many accounts are 
> more sussepticle (sp?) to getting spammed. We had (note the 'had') 5 
> addresses that were put out in plain text on our Web homepage.

Thank you. That seems to explain what I see -- and why others didn't see
any pattern...

-- 
Glenn English
ghe at slsware.com