Setup of the Comparison Tool

Requesting the “Comparison Tool”

To request the “Comparison Tool,” you must have an active trial of Abusix Mail Intelligence. You may sign up for a trial at https://abusix.com/free-trial

Once your trial is live, ask our support team for the comparison binary. They will need to know if you need a Linux, Mac, or Windows binary.

Installation

Download the “Comparison Tool” and make it executable:

$ chmod +x ami_compare_linux

If run without any options - it will output its usage and available command line options:

$ ./ami_compare.linux
Usage: ami_compare.linux --apikey <apikey> --list <list> <filename>

Options:
  --version   Show version number                                [boolean]
  --apikey    Abusix Mail Intelligence API key                   [required]
  --list          DNS suffix of the DNSBL to compare against     [required]
  --debug    Write debug output to stderr                        [boolean]
  --cache    Cache result data to reduce DNS load                [boolean]
  -h, --help  Show help                                          [boolean]

Copyright 2021, Abusix Inc.
Node v8.17.0 (x64)
Using DNS servers: 1.1.1.1

Not enough non-option arguments: got 0, need at least 1

Logfile Mode

To use the tool in logfile mode, you must provide a file that contains a list of IPs to be checked. This list should be extracted from your production system(s) log files. The logs should be no more than two days old and as recent as possible to achieve the best results. The list can either be a simple, de-duplicated list of IP addresses or a list that includes a count (e.g., occurrences) and IP addresses. The latter is preferred, as it will provide a more accurate result.

Data Preparation

Here is an example of extracting a list of IPs from a Postfix server using standard UNIX tools. This can be modified to work with most logfile formats with some minor modifications.

$ grep -Poh '\d+\.\d+\.\d+\.\d+' /var/log/mail.log | sort  | uniq -c | sort -rn > ips_to_test

This will create a file called "ips_to_test" that contains "<count> <ip>" pairs, where <count> is the number of times each IP address has been seen in the logs. The file will be sorted such that the IP addresses with the largest number of occurrences appear first.

Learn more about the Comparison Tool

Back to the Overview of Abusix Mail Intelligence