Weekly spam summary on January 7th, 2006
January 8, 2006
It's time for the first weekly spam summary of the new year, so let's see what sort of a start 2006 is off to.
This week we received 14,639 email messages from 198 different IP addresses. Our SMTP server handled 30,023 sessions from 3,122 different IP addresses. Message volume is up some since last week (not surprising with people coming back to work) and session volume is holding steady.
Connection volume is down from last week: 201,000 connections from at least 58,500 different IP addresses, although with a highwater of 20 connections being checked at once. By day we get:
I have no explanation for the day to day numbers, although we do have the traditional Thursday jump. It's wierd to see the different IP address count spike so sharply without a connection spike to go with it.
Kernel level packet filtering top ten:
Host/Mask Packets Bytes 22.214.171.124 17983 1079K 126.96.36.199 12414 745K 188.8.131.52 10004 509K 184.108.40.206 9387 411K 220.127.116.11 8249 396K 18.104.22.168 6840 356K 22.214.171.124 6579 335K 126.96.36.199 6449 297K 188.8.131.52/24 5956 275K 184.108.40.206 5454 251K
Connection time rejection stats:
36555 total 18969 dynamic IP 10916 bad or no reverse DNS 4114 class bl-cbl 528 class bl-spews 467 class bl-sbl 310 class bl-dsbl 272 class bl-sdul 52 class bl-ordb 30 class bl-njabl 14 class bl-opm
Given the overall volume drop from last week, I think that these stats are not particularly surprising. There are no really aggressive single IP addresses, and the CBL doesn't stand out as much as it did last week; only 7 of the top 30 most connecting IP addresses are on it.
It looks like we're still getting forged as the
The Hotmail spammers seem to have ended their holidays too, judging from the Hotmail stats for this week:
This is broadly consistent with the volume from the week before last. So much for any hope that Hotmail was doing something to deal with their spam problem over the Christmas to New Years break.
(In fact they were doing something last week: they were making it more difficult to report spam to Hotmail. Now you have to use firstname.lastname@example.org instead of email@example.com if you want them to take any action, or so their autoreply now says.)
Written on 08 January 2006.
* * *
Atom feeds are available; see the bottom of most pages.