Weekly spam summary on June 23rd, 2007
June 23, 2007
This week, we:
This is up a bit from last week in both connection volume and the number of different IPs trying to talk to us.
Kernel level packet filtering top ten:
Host/Mask Packets Bytes 188.8.131.52/23 32271 1566K cox.net 184.108.40.206 21370 1109K 220.127.116.11/24 21336 966K bellsouth.net 18.104.22.168/24 12143 581K adelphia.net 22.214.171.124/27 11948 662K 126.96.36.199 9476 528K 188.8.131.52 8723 519K 184.108.40.206 4182 217K 220.127.116.11 4062 190K 18.104.22.168/24 3511 169K tin.it
Volume is about the same as last week. The 22.214.171.124/27 netblock is blocked because of otcpicknews.com et al; I put them in the kernel blocks after I got tired of them hammering on us.
Connection time rejection stats:
65450 total 29813 dynamic IP 28601 bad or no reverse DNS 5249 class bl-cbl 315 qsnews.net 232 class bl-pbl 142 class bl-sbl 141 beaconresearchnews.com 125 class bl-dsbl 120 dartmail.net 85 class bl-sdul 43 126.96.36.199/24 aka IBS Hosting Corp 37 class bl-njabl
The highest source of SBL rejections this week was SBL55809 with 33 rejections, followed by SBL50728 with 26 and SBL49970 with 23 rejections. All of them are listed as spam sources, with various degrees of involvement in the spam imputed in the SBL listings.
Nine of the top 30 most rejected IP addresses were rejected 100 times
or more; the grand champion is 188.8.131.52 with 1,840 rejections
(for having no reverse DNS). Dishonorable mentions must also go to
184.108.40.206 (716 rejections, bad reverse DNS and in the CBL and PBL)
and 220.127.116.11 (360 rejections, bad reverse DNS, merely in the PBL).
Six of the top 30 are currently in the CBL, eleven are currently in
(Locally, 16 were rejected for bad or missing reverse DNS, 9 for being dynamic IPs, three for being people we didn't want to talk to, and one each for being in the PBL and the DSBL.)
This week, Hotmail had:
And the final numbers:
The leading source of bad
Bad bounces were sent to 262 different bad usernames, with the
most popular one being
* * *
Atom feeds are available; see the bottom of most pages.