Weekly spam summary on March 25th, 2006
The basic volume numbers for this week are that we:
- got 19,744 messages from 236 different IP addresses.
- handled 19,083 sessions from 955 different IP addresses.
- received 139,156 connections from at least 43,459 different IP addresses.
- hit a highwater of 31 connections being checked at once.
We got more emails this week than usual mostly because of a small mail loop explosion during the week that added several thousand extra to the usual tally. The connection count is down significantly from last week, but the other numbers are up somewhat. The per-day stats:
I suspect that a spammer has started up a significant spam run on Friday, partly from other evidence (like spam that has gotten through to me).
Kernel level packet filtering top ten:
Host/Mask Packets Bytes 126.96.36.199/24 5646 283K 188.8.131.52/24 5094 230K 184.108.40.206 4623 216K 220.127.116.11/10 2728 137K 18.104.22.168 2111 116K 22.214.171.124/13 2090 99940 126.96.36.199/11 1991 101K 188.8.131.52 1764 86992 184.108.40.206/11 1599 81308 220.127.116.11 1580 94800
This is down overall from last week, mirroring the connection
numbers. The top two /24 subnets are
iol.it these days, apparently) outgoing mailer subnets; of the rest:
- 18.104.22.168 keeps turning up like bad penny, most recently
the week before last. Despite that,
I'm honestly not sure what we blocked it for this week.
(For what it's worth, it's in
- 22.214.171.124 returns from last week.
- 126.96.36.199 is part of Digital Impact, which we haven't talked to for years.
- 188.8.131.52 seems to be a tpnet.pl 'dialup' customer machine; pass.
Connection time rejection stats:
28919 total 15451 dynamic IP 8976 bad or no reverse DNS 2973 class bl-cbl 254 class bl-dsbl 213 class bl-ordb 142 class bl-sdul 134 class bl-spews 125 fairgamemail.us 184.108.40.206/24 116 SKYLIST INC 220.127.116.11/18 66 class bl-sbl 38 class bl-njabl 18 class bl-opm
Good old Skylist, still banging on the door despite not having
had any success for weeks. I blocked the
by hand a while back, but they're also in the SBL as
see also the fairgamemail.us ROKSO index
and the fairgamemail.us ROKSO listing.
This was a slow week for the top 30 most refused IP addresses,
with only two over 100 rejections (18.104.22.168, at 106, and
22.214.171.124 at 104). Ten of the top 30 are currently in the CBL, three are currently in
and two are in the SBL:
- 126.96.36.199 is 'SilverCarrot' aka 'Recipe4Living' aka 'milesource-mail.com', listed in both SBL36447 and SBL39201. They're part of the SKYLIST 188.8.131.52/18 subnet that we already block, but now they have their own entry.
- 184.108.40.206 is an random Chinese spam source (with no reverse DNS, why am I not surprised?) that is SBL39201.
|what||# this week||(distinct IPs)||# last week||(distinct IPs)|
As you can see, this hardly budged from last week.
And finally the Hotmail numbers:
- 5 messages accepted but unfortunately four of these were almost
certainly spam, since they came from users like
- 4 messages rejected because they came from non-Hotmail email addresses.
- 35 messages sent to our spamtraps.
- 19 messages refused because their sender addresses had already hit our spamtraps.
- No messages refused due to their origin IP address.
I am not enthused that Hotmail seems to be having a serious spam problem with sympatico.ca email addresses. Hopefully this is temporary. (Yes, I am an optimist.)
Update: I made a mistake when putting the numbers together; it turns out there were actually 11 messages refused due to their origin IP address. See HotmailStatsRevised for more details.