diff --git a/tools/bulkdetect b/tools/bulkdetect
new file mode 100755
index 0000000000000000000000000000000000000000..f86d13ca4728c342a9d27fc92ad8432c7b355cc2
--- /dev/null
+++ b/tools/bulkdetect
@@ -0,0 +1,45 @@
+#!/usr/bin/perl -w
+# bulkdetect - spot owners/lists bulk adding lots of subscribers
+# taggart 2019-06
+
+$log='/var/log/sympa/wwsympa.log';
+
+open(LOG, "$log") or die "cannot open log\n";
+
+while (<LOG>) {
+  chomp;
+  if ( m/.*\[user (.*)\] \[list (.*)\] main::do_add\(\) do_add:(.+)/ ) {
+    #print "$1 $2 $3\n"; 
+    # hash key is owner:list, value is number of attempts to add
+    $result{"$1:$2"}++;
+  }
+}
+
+format Foo =
+@<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<  @<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< @>>>>>>
+$owner,                                         $list                                       $count
+.
+
+# set output format
+$~= 'Foo';
+
+# print header
+$owner = 'Owner adding';
+$list = 'List';
+$count = 'Add';
+write;
+
+foreach $key ( sort { $result{$b} <=> $result{$a} } keys %result) {
+  ($owner,$list) = split /:/,$key;
+  $count = $result{$key}; 
+  write;
+}
+
+## Notes
+#if ( m/.*\[user (.*)\] \[list (.*)\] main::do_add\(\) do_add: (.*)/ ) {
+# do_add sometimes returns the following things, might be interesting to look for
+# already subscriber
+# no email
+# incorrect email
+# may not add
+