Weekly spam summary on August 20th, 2005
The overall SMTP connection rate has dropped from last week, down to 140,000 SMTP connections from at least 36,000 different IP addresses. The SMTP frontend hit a high-water of 16 simultaneous connections, I believe relatively early in the week, so I suspect we saw the spillover from last week's traffic burst last Sunday and maybe Monday and then a normal rest of the week.
Kernel level IP rejections:
Host/Mask Packets Bytes 22.214.171.124 10721 515K 126.96.36.199/24 7974 434K 188.8.131.52 7469 359K 184.108.40.206/10 6122 297K 220.127.116.11 6086 292K 18.104.22.168 5587 268K 22.214.171.124 5136 261K 126.96.36.199 3812 229K 188.8.131.52 3807 194K 184.108.40.206 3462 166K
This seems to have been a slow week for Chinese networks (our usual source of rejections from large netblocks); only one made it into the top ten. The individual hosts listed are the usual grab-bag assortment of dynamically added places, with some faces reappearing from last week (220.127.116.11 remaining listed in dnsbl.njabl.org).
Connection-time rejections run:
23940 total 11281 dynamic IP 8525 bad or no reverse DNS 1699 class bl-cbl 532 class bl-spews 434 class bl-ordb 424 class bl-dsbl 377 class bl-sbl 114 class bl-njabl 110 class bl-sdul 2 class bl-opm
(Embarrassingly, I only got around to automating this report via a script this week. When will I learn to take my own advice?)
No single IP address was a really big source of connection-time rejections.
HELO greetings are well down from last week but are up somewhat
over the week before that, which could be more signs of a
Sunday/Monday spillover effect.