Stories
Slash Boxes
Comments
NOTE: use Perl; is on undef hiatus. You can read content, but you can't post it. More info will be forthcoming forthcomingly.

All the Perl that's Practical to Extract and Report

The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

The Russian Spam Mafia Wants Me Probed 1 Comment More | Login | Reply /

 Full
 Abbreviated
 Hidden
More | Login | Reply
Loading... please wait.
  • other than /32

    I know you said you have hundreds of thousands, but the sample spamreport.txt only has a little over 20K. Even still, doing just a cursory glance you would be a lot better off not blocking individual IPs.

    #!/usr/bin/perl
    use strict;
    use warnings;

    my $spam = $ARGV[0] || 'spamreport.txt';
    open (SPAM, '<', $spam) or die "Unable to open $spam for reading : $!";

    print
    map { $_->[4] }
    sort { $a->[0] <=> $b->[0] || $a->[1] <=> $b->[1]
                               ||
           $a->[2] <=> $b->[2] || $a->[1] <=> $b->[2] }
    map  { [ m|(\d+)\.(\d+)\.(\d+)\.(\d+)/|, $_ ] } <SPAM>;

    I think if you used better masks, perhaps by checking http://www.arin.net/ [arin.net] to see who owns the block and how big it is, you would be able to reduce the total number of rules quite dramatically.

Stories, comments, journals, and other submissions on use Perl; are Copyright 1998-2006, their respective owners.