SMTP IP firewall stats at June 18th, 2005
We maintain a filter list of bad hosts and network areas that can't talk to our SMTP port at all; their SMTP packets are silently discarded. The filter list is reinitialized each time the server reboots, currently once a week. During the week we add various spam sources and high volume sources of other rejections to the filters on a dynamic basis.
As the server does its weekly reboot at 6 AM Sunday morning, right now is a great time to pull a top-N summary from the kernel's firewall statistics. So, here are the top 20 sources of rejected packets to this server over the past nearly 7 days:
Host/Mask Packets Bytes 184.108.40.206 7768 356K [a] [njabl] 220.127.116.11 4539 218K [a] [bad-helo] 18.104.22.168/10 4356 215K 22.214.171.124 4169 200K [a] [bad-helo] 126.96.36.199/11 3313 161K 188.8.131.52 2955 177K [a] [baddns] 184.108.40.206 2696 129K [a] [cbl] 220.127.116.11 2683 129K [a] [dialup] [cbl] 18.104.22.168/11 2577 126K 22.214.171.124 2492 150K [a] [njabl] 126.96.36.199/12 2435 123K 188.8.131.52 2425 116K 184.108.40.206 2359 142K [a] [spews] 220.127.116.11 2088 125K [a] [flushot] 18.104.22.168 1949 93552 [a] [dialup] [cbl] 22.214.171.124/24 1893 85360 126.96.36.199 1824 109K [a] [flushot] 188.8.131.52 1719 82512 [a] [bad-helo] 184.108.40.206/24 1654 86576 220.127.116.11/13 1584 78068
[a]: entry was added during the week as a high-count rejection source.
[baddns]: IP lacks a good PTR record.
[bad-helo]: tried to say hi with a bad SMTP
[cbl]: IP in
[dialup]: IP seems to be in a dynamic/dialup address range.
[flushot]: IP address sent email to our spamtraps.
[njabl]: IP in
[spews]: IP in the SPEWS DNSbl.
This isn't a particularly active server for mail in general; we usually get about 1,000 to 2,000 incoming real mail messages a day (mostly from mailing lists).
I believe that 18.104.22.168 (smtpout.terra.es), 22.214.171.124 (mail1002.centrum.cz), and 126.96.36.199 (mailout06.infosat.net) are all involved in providing free email. And apparently doing a bad job of stopping spammers from using it. Both 188.8.131.52 and 184.108.40.206 would have been rejected by later blocks as well, blocks we set up due to them sending us spam.
Due to a long-term spam problem, we have a number of Chinese netblocks that we aren't interested in accepting email from. In this listing, that's 220.127.116.11/10, 18.104.22.168/11, 22.214.171.124/11, 126.96.36.199/12, and 188.8.131.52/13.
tin.it, an Italian ISP that had yet to get
HELO greetings correct by the time I gave up and firewalled them.
liberato.it, another Italian ISP with a
significant spam problem that we've just stopped talking to. (On a
quick spot check it seems to also be
iol.it; they may have merged,
been bought out, or renamed since I put them in our filter list.)
184.108.40.206 kept trying to send us email from the blocked origin address of 'firstname.lastname@example.org', week after week after week. At some point I just put them in our core filter list instead of adding them every week. I don't consider their continued attempts to send us email despite everything bouncing for months to be a good sign.
Note: because we drop incoming packets from these IP addresses on the floor and don't reply to them in any way, this is not an accurate count of even SMTP connection attempts. (One SMTP connection attempt will produce a number of packets to our SMTP port, depending on how much their OS retries TCP connection attempts.)
By the time you read this, some of these IP addresses may no longer be in the DNSbls listed. Because this is IP level firewalling, we can't say anything definite about whether what these places are trying to send us is spam; we've just decided that we don't want to talk to them at all.
(Some of the SMTP connection attempts are probably for bounce
backscatter from spammers forging our domain as the
MAIL FROM of
their spam runs.)