From: UnixOS2 Archive To: "UnixOS2 Archive" Date: Sun, 28 Sep 2003 14:11:56 EST-10EDT,10,-1,0,7200,3,-1,0,7200,3600 Subject: [UnixOS2_Archive] No. 206 ************************************************** Saturday 27 September 2003 Number 206 ************************************************** Subjects for today 1 Spam from address - was Checking for word in a string : Dave Saville" 2 Re: Spam from address - was Checking for word in a string : Stefan Neis **= Email 1 ==========================** Date: Sun, 28 Sep 2003 08:41:15 +0100 (BST) From: "Dave Saville" Subject: Spam from address - was Checking for word in a string Right now I have learnt to count again :-) 1100 spams have 1886 Received lines yielding 1675 different IP addresses Here are the last few with counters: 53.122.201.10 : 3 61.236.238.72 : 3 211.46.110.58 : 3 210.91.16.8 : 3 210.202.16.25 : 3 194.242.43.187 : 3 211.198.176.88 : 3 194.242.43.182 : 4 61.53.19.51 : 4 208.251.201.77 : 4 211.158.5.4 : 4 61.159.235.36 : 5 194.242.43.183 : 7 213.212.254.52 : 9 62.240.113.57 : 9 62.253.162.40 : 254 All the rest have a count 2 or 1 so I wonder how effective using this as the basis for autoupdating white & black lists would be. -- Regards Dave Saville **= Email 2 ==========================** Date: Sun, 28 Sep 2003 16:55:55 +0200 (CEST) From: Stefan Neis Subject: Re: Spam from address - was Checking for word in a string On Sun, 28 Sep 2003, Dave Saville wrote: > Right now I have learnt to count again :-) > 213.212.254.52 : 9 > 62.240.113.57 : 9 > 62.253.162.40 : 254 > > > All the rest have a count 2 or 1 so I wonder how effective using this > as the basis for autoupdating white & black lists would be. Maybe if you make some assumptions about subnets and try to count how many spam mails came from the same subnet (e.g. taking all 62.240.113.* IPs as one source of spam ...), you get a better basis for those lists? Regards, Stefan -- Micro$oft is not an answer. It is a question. The answer is 'no'.