spam/SpamSummary-2007-09-22 written at 23:44:46; Add Comment
Weekly spam summary on September 22nd, 2007
This week, we:
I'm pleased to see connection volume drop significantly from last week. This week's per-day statistics look almost normal, too:
Kernel level packet filtering top ten:
Host/Mask Packets Bytes 126.96.36.199 16851 809K 188.8.131.52/24 12063 724K onet.pl 184.108.40.206/23 9770 475K cox.net 220.127.116.11/24 7424 445K centrum.cz 18.104.22.168/27 6497 358K otcpicknews.com 22.214.171.124 5531 332K 126.96.36.199 5026 248K 188.8.131.52 4812 231K 184.108.40.206 4446 244K 220.127.116.11 3675 176K
Volume is once again down from last week. To make up for it, we have another top ten problem source subnet, in this case onet.l (specifically poczta.onet.pl).
Connection time rejection stats:
92546 total 48536 bad or no reverse DNS 38122 dynamic IP 3872 class bl-cbl 421 class bl-pbl 359 class bl-dsbl 156 qsnews.net 99 class bl-sdul 77 class bl-sbl 22 class bl-njabl
The highest source of SBL rejections this week was a tie: SBL48694 (returning from last week) and SBL30718 each had 13 rejections each. Third place goes to SBL53319 (a /20 listing from May 1st 2007), with 10 rejections.
Seven of the top 30 most rejected IP addresses were rejected 100 times
or more this week; the leader is 18.104.22.168 (510 rejections),
followed by 22.214.171.124 (482 rejections), 126.96.36.199
(389 rejections), and 188.8.131.52 (328 rejections). Eleven of the
top 30 are currently in the CBL, eight are currently in
(Locally, 22 were rejected for bad or missing reverse DNS, 6 for being dynamic IP addresses, and 2 for being qsnews.net.)
This week, Hotmail had:
I find it depressing that the two SBL listings above both have example Hotmail-based spam from back then. Almost two years and Hotmail still doesn't seem to give a damn.
And the final numbers:
The leading source of bad
Bad bounces were sent to 268 different bad usernames this week,
with the most popular one being
My pick for the most amusingly named source of bad bounces this week is
* * *
Atom feeds are available; see the bottom of most pages.