spam/SpamSummary-2005-08-27 written at 02:55:18; Add Comment
Weekly spam summary on August 27th, 2005
The overall SMTP connection rate is up from
last week, as we hit 213,000 SMTP
connections from at least 36,000 different IP addresses.
The SMTP frontend hit a new highwater of 22 simultaneous connections
being checked at once. It's possible that a lot of this is from spammers
forging our domains as the
Top 10 kernel level SMTP rejections:
Host/Mask Packets Bytes 184.108.40.206 16370 736K [dns] 220.127.116.11 12959 660K [trap] 18.104.22.168/24 10593 553K 22.214.171.124/12 6472 311K 126.96.36.199 5752 284K [trap] 188.8.131.52 4621 222K [dyn] 184.108.40.206/10 4219 211K 220.127.116.11 4127 198K [dyn] 18.104.22.168 4049 206K [dns] 22.214.171.124 3706 163K [helo]
Clearly we've had some very persistent callers this week; however, most of the individual machines are new on the list (the only exception is 126.96.36.199, appearing in SpamSummary-2005-07-23).
Connection-time rejection stats:
27462 total 13178 dynamic IP 7721 bad or no reverse DNS 1668 class bl-cbl 1195 class bl-spews 1032 class bl-sbl 880 class bl-dsbl 775 class bl-ordb 189 class bl-sdul 83 class bl-njabl 27 class bl-opm
SBL-based rejections are up significantly, and break down like this for the top five:
SBL20671 is a /19 ROKSO listing for OC3 Networks. SBL27384
SPEWS rejections have no specific bad source, although 188.8.131.52
kept retrying a lot (it looks like it's a Microsoft mailer, and
those tend to do that in my experience). Big SPEWS contributions
(I am seriously considering specific connection-time rejections for all of the widely abused free email providers that I don't want to bother talking to. It would probably make these reports more streamlined and it might get the message through to their operators. Or at least any real users trying to email our users.)
Bad HELOs and SMTP bounces to nonexistent local addresses are up quite a lot over last week. The numbers:
Much of the increase in the bad
* * *
Atom feeds are available; see the bottom of most pages.