Here's the starting point: SpamCop-QuickReports-ResolvedDomains-Part01.txt
The following scripts are meant to extract email addresses and IPv4 addresses and print them with the text columnn first, followed by the IPv4 address. This has been troublesome because many lines repeat the IPv4 address. The first script works OK where there is but one IPv4 address:
cat SpamCop-QuickReports-ResolvedDomains-Part01.txt | grep "Cached" | sed 's/Tracking\ message\ source\://g' | sed 's/Cached\ whois\ for\ //g' | sed 's/warning\:Looks\ like\ a\ forgery\ //g' | awk '{$1=$1};1' | sed 's/\:/\t/g' | awk 'FS="\t"' | awk 'NF==2 {print $2,$1}' '-' | sort -u
The second script fails at handling the data groups whose records have duplicate IPv4 addresses and gets only one group right of the three-column outputs and truncates the other two groups:
cat SpamCop-QuickReports-ResolvedDomains-Part01.txt | grep "Cached" | sed 's/Tracking\ message\ source\://g' | sed 's/Cached\ whois\ for\ //g' | sed 's/warning\:Looks\ like\ a\ forgery\ //g' | awk '{$1=$1};1' | sed 's/\:/\t/g' | awk 'FS="\t"' | awk '{print $3,$1}' '-' | sort -u
It's important to resolve these email addresses to their originating IPv4 addresses, because the emails are over a decade old but I've found them by searching a collection of old emails with current spammy domain names.
