Weekly spam summary on March 25th, 2006
The basic volume numbers for this week are that we:
- got 19,744 messages from 236 different IP addresses.
- handled 19,083 sessions from 955 different IP addresses.
- received 139,156 connections from at least 43,459 different IP addresses.
- hit a highwater of 31 connections being checked at once.
We got more emails this week than usual mostly because of a small mail loop explosion during the week that added several thousand extra to the usual tally. The connection count is down significantly from last week, but the other numbers are up somewhat. The per-day stats:
I suspect that a spammer has started up a significant spam run on Friday, partly from other evidence (like spam that has gotten through to me).
Kernel level packet filtering top ten:
Host/Mask Packets Bytes 188.8.131.52/24 5646 283K 184.108.40.206/24 5094 230K 220.127.116.11 4623 216K 18.104.22.168/10 2728 137K 22.214.171.124 2111 116K 126.96.36.199/13 2090 99940 188.8.131.52/11 1991 101K 184.108.40.206 1764 86992 220.127.116.11/11 1599 81308 18.104.22.168 1580 94800
This is down overall from last week, mirroring the connection
numbers. The top two /24 subnets are
iol.it these days, apparently) outgoing mailer subnets; of the rest:
- 22.214.171.124 keeps turning up like bad penny, most recently
the week before last. Despite that,
I'm honestly not sure what we blocked it for this week.
(For what it's worth, it's in
- 126.96.36.199 returns from last week.
- 188.8.131.52 is part of Digital Impact, which we haven't talked to for years.
- 184.108.40.206 seems to be a tpnet.pl 'dialup' customer machine; pass.
Connection time rejection stats:
28919 total 15451 dynamic IP 8976 bad or no reverse DNS 2973 class bl-cbl 254 class bl-dsbl 213 class bl-ordb 142 class bl-sdul 134 class bl-spews 125 fairgamemail.us 220.127.116.11/24 116 SKYLIST INC 18.104.22.168/18 66 class bl-sbl 38 class bl-njabl 18 class bl-opm
Good old Skylist, still banging on the door despite not having
had any success for weeks. I blocked the
by hand a while back, but they're also in the SBL as
see also the fairgamemail.us ROKSO index
and the fairgamemail.us ROKSO listing.
This was a slow week for the top 30 most refused IP addresses,
with only two over 100 rejections (22.214.171.124, at 106, and
126.96.36.199 at 104). Ten of the top 30 are currently in the CBL, three are currently in
and two are in the SBL:
- 188.8.131.52 is 'SilverCarrot' aka 'Recipe4Living' aka 'milesource-mail.com', listed in both SBL36447 and SBL39201. They're part of the SKYLIST 184.108.40.206/18 subnet that we already block, but now they have their own entry.
- 220.127.116.11 is an random Chinese spam source (with no reverse DNS, why am I not surprised?) that is SBL39201.
|what||# this week||(distinct IPs)||# last week||(distinct IPs)|
As you can see, this hardly budged from last week.
And finally the Hotmail numbers:
- 5 messages accepted but unfortunately four of these were almost
certainly spam, since they came from users like
- 4 messages rejected because they came from non-Hotmail email addresses.
- 35 messages sent to our spamtraps.
- 19 messages refused because their sender addresses had already hit our spamtraps.
- No messages refused due to their origin IP address.
I am not enthused that Hotmail seems to be having a serious spam problem with sympatico.ca email addresses. Hopefully this is temporary. (Yes, I am an optimist.)
Update: I made a mistake when putting the numbers together; it turns out there were actually 11 messages refused due to their origin IP address. See HotmailStatsRevised for more details.