interesting problem

"DougW" <[email protected]> Mon, 16 Jan 2006 16:29:22 -0600
Newsgroups gmane.mail.spam.spamcop.help
Organization Offroading and beer drinking association of associates.
Message-ID <[email protected]>
Seems spammy is starting to use botnets again to do the hosting.
That means more than one IP per host.

I've only seen SC parse the first host.

For example:

n273.net
 083.226.102.124 c-7c66e253.350-1-64736c10.cust.bredbandsbolaget.se
 085.250.129.230 85-250-129-230.bb.netvision.net.il
 012.202.086.220 12-202-86-220.client.insightBB.com
 012.211.120.003 ??
 082.044.095.034 82-44-95-34.cable.ubr09.croy.blueyonder.co.uk

dieforthoseeyes.com
 012.219.075.059 12-219-75-59.client.mchsi.com
 024.074.059.240 cpe-024-074-059-240.carolina.res.rr.com
 068.059.102.169 pcp01023924pcs.panamc01.fl.comcast.net
 069.211.230.163 adsl-69-211-230-163.dsl.chcgil.ameritech.net
 137.099.155.027 d155h27.resnet.uconn.edu

nightsofyourlife.com
 082.138.063.064 ??
 067.149.058.011 d149-67-11-58.try.wideopenwest.com
 067.169.244.022 ??
 069.142.079.147 pcp0010900587pcs.walngs01.pa.comcast.net
 066.041.220.125 c-66-41-220-125.hsd1.mn.comcast.net