[SA-exim] Identifying repeat offenders using the tuplets

[Matt Bostock]

Hello all,

I've been using SA-Exim for a few months and it has been BRILLIANT. I just recently increased the score weightings for the Razor2 and DCC plugins for SA, and combined with SA-Exim and effect has been phenomenal.

I want to parse the tuplets dir to search for 'repeat offenders', i.e. IP addresses that send high-scoring spam to multiple recipients. What do I need to look for in the tuplets files? For example, what does the 'Query Count' represent?

Many thanks for your help,
Matt :-)