Weekly spam summary on August 20th, 2005

August 21, 2005

The overall SMTP connection rate has dropped from last week, down to 140,000 SMTP connections from at least 36,000 different IP addresses. The SMTP frontend hit a high-water of 16 simultaneous connections, I believe relatively early in the week, so I suspect we saw the spillover from last week's traffic burst last Sunday and maybe Monday and then a normal rest of the week.

Kernel level IP rejections:

Host/Mask           Packets   Bytes         10721    515K       7974    434K          7469    359K          6122    297K           6086    292K         5587    268K          5136    261K            3812    229K           3807    194K           3462    166K

This seems to have been a slow week for Chinese networks (our usual source of rejections from large netblocks); only one made it into the top ten. The individual hosts listed are the usual grab-bag assortment of dynamically added places, with some faces reappearing from last week ( remaining listed in dnsbl.njabl.org).

Connection-time rejections run:

  23940 total
  11281 dynamic IP
   8525 bad or no reverse DNS
   1699 class bl-cbl
    532 class bl-spews
    434 class bl-ordb
    424 class bl-dsbl
    377 class bl-sbl
    114 class bl-njabl
    110 class bl-sdul
      2 class bl-opm

(Embarrassingly, I only got around to automating this report via a script this week. When will I learn to take my own advice?)

No single IP address was a really big source of connection-time rejections.

Bad HELO greetings are well down from last week but are up somewhat over the week before that, which could be more signs of a Sunday/Monday spillover effect.

Written on 21 August 2005.
« Mutating Referer Spammers
On being nibbled to death by moths »

Page tools: View Source, Add Comment.
Login: Password:
Atom Syndication: Recent Comments.

Last modified: Sun Aug 21 01:37:24 2005
This dinky wiki is brought to you by the Insane Hackers Guild, Python sub-branch.