But I know a very simple explanation for adding random ips into the results:

People tend to download files which are served by many hosts, and since those who are listed are no known spammers, the files might get downloaded quite frequently.

It's quite a nice way to get your files to be seen (and your website to be hated... ).

__________________

-> put this banner into your own signature! <-
--
Erst im Spiel lebt der Mensch.
Nur ludantaj homoj vivas.
GnuFU.net - Gnutella For Users
Draketo.de - Shortstories, Poems, Music and strange Ideas.

Yes, for example, you can discard everything with more than 16 sources in an GGEP ALT block. That's 100% spam. I don't know the limit for BearShare but for LimeWire it's 10 and Gtk-Gnutella it's 15.

A few months ago, there appeared some spammers using this for more efficient spamming. The old school spammers still use multiple query hits. Some GUIs don't show this difference.

It's best to dump the raw packets and analyze the raw data. That gives you some clues what can be promptly blocked. Most of the time you can either block packets with certain abnormal characteristics, exact files or otherwise an IP (range). In a few cases, you really have to wait for more information. Just try to get as much information from a suspicious host as possible, that will give you a good idea whether it's really a spammer and if yes, how they work.