snippet.sh

for o in $(grep -A1 "failed mail authentication attempt for user" /var/log/maillog |grep "authentication fail" | perl -pe 's#.*unknown\[([^\]].*?)\].*#\1#' | grep -E "^[[:digit:]]+" | uniq); do whois $o | grep -E "([0-9]{1,3}[\.]){3}[0-9]{1,3}\/" | grep -v "^%" | awk '{print $2}'; done

one liner to find and list ip addresses in maillog