Weekly spam summary on October 6th, 2007
October 6, 2007
Unfortunately, our SMTP frontend died Thursday afternoon, so some of our usual stats are approximations or partial stats. Having said that, this week we:
In specific, we got 184,251 connections from at least 73,605 different IP addresses through Thursday morning at 4am, and then 133,145 connections from at least 52,709 different IP addresses since 2:40pm Thursday. Connection volume is up a bit from last week.
Kernel level packet filtering top ten:
Host/Mask Packets Bytes 220.127.116.11/26 36754 2016K otcpicknews.com 18.104.22.168/24 27166 1630K onet.pl 22.214.171.124/24 9983 599K centrum.cz 126.96.36.199/23 7805 379K cox.net 188.8.131.52/24 6797 326K adelphia.net 184.108.40.206 6369 298K 220.127.116.11/24 6077 389K comcast.net 18.104.22.168/24 5737 367K comcast.net 22.214.171.124 5008 240K 126.96.36.199/16 4897 235K CHINANET
Total volume is slightly up from last week. Strikingly, only two of the top ten this week are individual IP addresses, although this is the first time in a while that a large netblock has made the top ten.
Connection time rejection stats:
114152 total 52897 dynamic IP 52569 bad or no reverse DNS 5520 class bl-cbl 1119 class bl-pbl 309 class bl-sdul 309 class bl-dsbl 161 acceleratebiz.com 87 qsnews.net 85 class bl-sbl 75 class bl-njabl 53 officepubs.com
Volume is up significantly from last week. The highest source of SBL rejections this week was the same as last week; SBL58952, with 22 rejections, followed by SBL39831 with 20 rejections (spam emitters since 23 May 2006) and SBL48694 with 10 rejections (also returning from last week).
Nine of the top 30 most rejected IP addresses were rejected 100 times or
more this week; the leader is 188.8.131.52 (527 rejections), followed
by 184.108.40.206 (241 rejections) and 220.127.116.11 (230 rejections).
Fifteen of the top 30 are currently in the CBL, two are currently in
(Locally, 23 were rejected for bad or missing reverse DNS, 4 for being something we considered a dynamic IP address, 1 for being qsnews.net, 1 for being in AccelerateBiz space, and one for being in the DSBL.)
This week, Hotmail had:
And the final numbers:
There is no particularly big source of bad
Bad bounces were sent to 83 different bad usernames this week, with the
most popular one being
The leading single source of bad bounces this week is actually a
German site, but ezweb.ne.jp and softbank.ne.jp are up near the
top plugging away. Google seems to have given us a miss this week,
although various .edu sites that should really know better made
up for them. My pick for the most amusingly named source this
* * *
Atom feeds are available; see the bottom of most pages.