Weekly spam summary on August 20th, 2005
The overall SMTP connection rate has dropped from last week, down to 140,000 SMTP connections from at least 36,000 different IP addresses. The SMTP frontend hit a high-water of 16 simultaneous connections, I believe relatively early in the week, so I suspect we saw the spillover from last week's traffic burst last Sunday and maybe Monday and then a normal rest of the week.
Kernel level IP rejections:
Host/Mask Packets Bytes 184.108.40.206 10721 515K 220.127.116.11/24 7974 434K 18.104.22.168 7469 359K 22.214.171.124/10 6122 297K 126.96.36.199 6086 292K 188.8.131.52 5587 268K 184.108.40.206 5136 261K 220.127.116.11 3812 229K 18.104.22.168 3807 194K 22.214.171.124 3462 166K
This seems to have been a slow week for Chinese networks (our usual source of rejections from large netblocks); only one made it into the top ten. The individual hosts listed are the usual grab-bag assortment of dynamically added places, with some faces reappearing from last week (126.96.36.199 remaining listed in dnsbl.njabl.org).
Connection-time rejections run:
23940 total 11281 dynamic IP 8525 bad or no reverse DNS 1699 class bl-cbl 532 class bl-spews 434 class bl-ordb 424 class bl-dsbl 377 class bl-sbl 114 class bl-njabl 110 class bl-sdul 2 class bl-opm
(Embarrassingly, I only got around to automating this report via a script this week. When will I learn to take my own advice?)
No single IP address was a really big source of connection-time rejections.
HELO greetings are well down from last week but are up somewhat
over the week before that, which could be more signs of a
Sunday/Monday spillover effect.