The technique I talked about in Re: Re: Password hacker killer is probably going to be useful. I imagine you'll also need to have things decay out of your block list. Or rather, as you don't want to inconvenience real users too much, just skr1pt kiddies, I'd make it a delay list - if someone's in the list, make their downloads sloooooow.

As someone else has mentioned, those particular addresses are AOL proxies, which indicates that you may want to score whole address ranges instead of individual addresses. This snippet from one of the scripts I use when hunting spammers will help.

use Net::DNS;
my $IP = '64.12.116.67';

my($ASN, $network, $network_bits) = @{
    Net::DNS::Resolver->new()
      ->query(join('.', reverse(split(/\./, $IP))).".asn.routeviews.or
+g", "TXT", "IN")
      ->{answer}->[0]->{char_str_list}
};
print "$network/$network_bits\n";
[download]