Weekly spam summary on February 25th, 2006
Here's how Hotmail stacks up this week:
- 4 messages accepted; unfortunately, one of them was definitely spam and at least two more probably were.
- 21 messages rejected because they came from non-Hotmail email addresses.
- 49 messages sent to our spamtraps.
- 4 messages refused because their sender addresses had already hit our spamtraps.
- 6 messages refused due to their origin IP address, all for being in the SBL; four from SBL17935, one from SBL27471, and one from SBL33955.
Pretty much everything is down compared to last week. Amazingly, Hotmail may actually be dealing with their whole spam problem.
Next, the basic stats:
- got 14,001 messages from 235 different IP addresses.
- handled 19,476 sessions from 968 different IP addresses.
- received 132,936 connections from at least 46,917 different IP addresses.
- a highwater of only 6 connections being checked at once.
In short, things are down from last week. The per-day stats are basically flat at ~18,000 connections a day, but jump to ~22,000 on Sunday and Friday.
Kernel level packet filtering top ten:
Host/Mask Packets Bytes 126.96.36.199 7213 433K 188.8.131.52/24 4791 242K 184.108.40.206 3743 225K 220.127.116.11/10 3206 166K 18.104.22.168 2994 170K 22.214.171.124 2181 105K 126.96.36.199 2174 100K 188.8.131.52/12 2015 103K 184.108.40.206/11 1916 98292 220.127.116.11 1654 84104
While the most active contestant is higher, overall I'd have to say that this is quieter than last week. All of the top individual IP addresses are new.
- 18.104.22.168 and 22.214.171.124 don't have IP to name information.
- 126.96.36.199 and 188.8.131.52 smelled like DSL or cablemodem dynamic IP addresses to us.
- 184.108.40.206 tripped our spamtraps and then kept trying to send us
tainted stuff, and is currently listed in bl.spamcop.net and in
spamzone for hitting their spamtraps.
- 220.127.116.11 is, whoops, a telus.com mail server that
HELO'd with a bogus name a lot. Apparently it's running Microsoft Exchange. We may have to exempt it from the bad
Connection time rejection stats:
28453 total 13771 dynamic IP 10160 bad or no reverse DNS 3066 class bl-cbl 325 class bl-ordb 285 class bl-sbl 222 class bl-spews 120 class bl-sdul 117 class bl-njabl 86 class bl-dsbl 4 class bl-opm
Bad reverse DNS is up this week compared to last week, but that's
about it. For individual IPs, things are even more evenly distributed
this week, with only one IP address being refused more than 100 times
(18.104.22.168, 177 times). Eight of the top 30 most refused IPs are
currently in the CBL and three are currently
bl.spamcop.net; repeating last week, none are in the SBL.
And the final numbers:
|what||# this week||(distinct IPs)||# last week||(distinct IPs)|
These numbers aren't yet down to the old low numbers, but at least they're dropping from last
week's levels. There are no really 'outstanding' sources; only one IP
address tried a bad
HELO more than a hundred times, for example.
The hassle of email (as compared to RSS)
In my recent 'give me RSS feeds' entry I wrote in passing '[...] these days email is just too much of a hassle'. Which it is. Let me illustrate how.
To subscribe to new mailing lists these days I need to:
- figure out how to subscribe
- make up a new email address to give the list
- go through a multi-stage subscription dance
- make sure our antispam filters won't eat the list messages
- adjust my filters to put the messages somewhere distinct
- remember to check and read wherever I dumped it
In short, a hassle. Add bonus hassle if I ever want to unsubscribe to the list; often it's simpler to just kill the address. (Sometimes it's the only way out.)
A lot of this is due to spam. Some of it is due to vendor abuses of trust (leading to spam). Some of it is just because I no longer have any interest in sorting my inbox by hand; the volume is too high and my time is too short.
Compare this to RSS:
- feed readers are good at showing me just updated feeds.
- feeds come pre-sorted from each other.
- subscribing to an RSS feed is easy.
- unsubscribing from an RSS feed is equally easy.
- I don't have to give you any information to subscribe.
It's sad to offhandedly write things like 'email is just too much of a hassle', and then realize that I mean it. It shouldn't be like this; it didn't used to be like this. But it is like this now. Sic transit gloria mundi.