Re: Top 10 ASN and CIDR's for 18 Nov

[Matthias Leisi <ma...@leisi.net>]

Mick Pollard wrote:
> Chris wrote:
>> Seems the huge network of compromised machines that started earlier
>> this month are still going strong and appears to be growing.  My spam
>> input has grown today by about 700%. Below are the top ASN's and
>> CIDR's for todays run:
>>
>> Report date: Sat Nov 18 22:52:53 CST 2006
>> Total spams: 543
>> Total ASNs:  143
> 
> Just out of curiosity, what do you use to compile these stats ?

Only partially related to Chris' stats, but on the same topic: I wrote
an experimental SA plugin to add an X-Spam-ASN: header. Download at
http://matthias.leisi.net/archives/174-ASN-and-SpamAssassin.html

It's rather crude: parsing the generated _REPORT_ to get at the result
of a TXT query on the asn.routeviews.org zone. I would welcome hints for
a more elegant solution.

-- Matthias