Re: spamvertizing on Level3

[Gunnar Lindberg <]

Hm, interesting idea popped up... Let's "grep | sort -u" in syslog...

Now, of course hostnames don't say much, do they :-)? Or do they?
NB, it's the authentic .in-addr.arpa (PTR) names, it's  n o t  "HELO".

Numbers in () are the actual # of calls those hosts made that day.
Single day syslog.

	Gunnar Lindberg

whois -h whois.arin.net
Level 3 Communications, Inc. (NETBLK-LEVEL3-CIDR)
   Netblock: 209.244.0.0 - 209.247.255.255

/var/log/syslog (70)
relay=mailer1.goodcleanporn.com [209.245.127.11]
relay=mailer4.goodcleanporn.com [209.245.127.14]
relay=mailer5.goodcleanporn.com [209.245.127.15]
relay=mailer6.cuttingedgeoffers.com [209.245.127.66]
relay=mailer7.cuttingedgeoffers.com [209.245.127.67]
/var/log/syslog.0 (35)
relay=mailer6.cuttingedgeoffers.com [209.245.127.66]
relay=mailer6.cuttingedgeoffers.com. [209.245.127.66]
relay=mailer7.cuttingedgeoffers.com [209.245.127.67]
/var/log/syslog.1 (10)
relay=mailer1.goodcleanporn.com [209.245.127.11]
relay=mailer2.goodcleanporn.com [209.245.127.12]
relay=mailer6.cuttingedgeoffers.com [209.245.127.66]
relay=mailer7.cuttingedgeoffers.com [209.245.127.67]
/var/log/syslog.2 (10)
relay=mailer4.goodcleanporn.com [209.245.127.14]
relay=mailer5.goodcleanporn.com [209.245.127.15]
/var/log/syslog.3 (22)
relay=mailer2.goodcleanporn.com [209.245.127.12]
relay=mailer4.goodcleanporn.com [209.245.127.14]
relay=mailer5.goodcleanporn.com [209.245.127.15]
/var/log/syslog.4 (2)
relay=mailer5.goodcleanporn.com [209.245.127.15]
/var/log/syslog.5 20)
relay=mailer2.goodcleanporn.com [209.245.127.12]
relay=mailer4.goodcleanporn.com [209.245.127.14]
relay=mailer5.goodcleanporn.com [209.245.127.15]
/var/log/syslog.6 (0)
/var/log/syslog.7 90)
relay=mailer1.powerfulporn.com [209.245.127.21]
relay=mailer1.powerfulporn.com. [209.245.127.21]
relay=mailer3.powerfulporn.com [209.245.127.23]
relay=mailer4.powerfulporn.com [209.245.127.24]
relay=mailer4.powerfulporn.com. [209.245.127.24]
relay=mailer5.powerfulporn.com [209.245.127.25]
relay=mailer6.powerfulporn.com [209.245.127.26]
/var/log/syslog.8 (41)
relay=mailer1.goodcleanporn.com [209.245.127.11]
relay=mailer1.powerfulporn.com [209.245.127.21]
relay=mailer2.goodcleanporn.com [209.245.127.12]
relay=mailer3.powerfulporn.com [209.245.127.23]
relay=mailer4.goodcleanporn.com [209.245.127.14]
relay=mailer5.powerfulporn.com [209.245.127.25]
relay=mailer5.powerfulporn.com. [209.245.127.25]
relay=mailer6.powerfulporn.com [209.245.127.26]
/var/log/syslog.9 (0)
/var/log/syslog.10 (8)
relay=mailer1.powerfulporn.com [209.245.127.21]
relay=mailer5.powerfulporn.com [209.245.127.25]
/var/log/syslog.11 (16)
relay=mailer4.powerfulporn.com [209.245.127.24]
relay=mailer5.powerfulporn.com [209.245.127.25]
/var/log/syslog.12 (159)
relay=mailer1.powerfulporn.com [209.245.127.21]
relay=mailer2.pornvideospecials.com [209.245.127.82]
relay=mailer3.pornvideospecials.com [209.245.127.83]
relay=mailer4.pornvideospecials.com [209.245.127.84]
relay=mailer5.pornvideospecials.com [209.245.127.85]
relay=mailer6.pornvideospecials.com [209.245.127.86]
/var/log/syslog.13 (20)
relay=mailer1.powerfullporn.com [209.245.127.21]
relay=mailer4.powerfullporn.com [209.245.127.24]
relay=mailer4.powerfulporn.com [209.245.127.24]
/var/log/syslog.14 (14)
relay=mailer1.powerfullporn.com [209.245.127.21]
relay=mailer4.powerfullporn.com [209.245.127.24]
/var/log/syslog.15 (0)