Weekly spam summary on September 24th, 2005
As time goes by, more and more of these weekly spam summaries are getting automated. Which just goes to show that sooner or later, I can learn from experience and do things right.
This week we received 11,900 email messages from 245 different IP addresses, and our SMTP server handled 63,600 sessions from 7,400 different IP addresses. Email volume is a tiny bit down from last week, but session volume is up; we're probably getting hammered more than usual by spam bounce backscatter.
Our SMTP connection count and kernel level block statistics are missing about 36 hours this week because we rebooted the server Monday night; both stats reset each reboot (normally once a week, early Sunday morning). Having said that, they're still pretty strikingly up.
Overall connections since Monday the 19th at 5:30pm Eastern or so: 234,000, from at least 30,000 different IP addresses. Much of these came early in the week; at 3:40 pm on the 21st, we had already seen 111,200 connections from at least 13,900 different IP addresses and had reached the week's highwater mark of 17 simultaneous connections.
Kernel level SMTP blocks:
Host/Mask Packets Bytes 220.127.116.11/12 17429 1011K 18.104.22.168/24 11495 531K 22.214.171.124 11375 532K 126.96.36.199 10345 461K 188.8.131.52 9591 412K 184.108.40.206/24 9050 444K 220.127.116.11 8809 503K 18.104.22.168 7034 338K 22.214.171.124 5807 279K 126.96.36.199 5452 255K
Vaulting into first place is a longterm block of a large portion of Chinanet address space. Second place goes to Netvigator, bringing the Far East's contribution up this week. Of the rest, only 188.8.131.52 (mx.terra.es, frequently on this list) and 184.108.40.206 (another terra.es machine, first seen last week) are repeat visitors.
220.127.116.11 is yet another terra.es machine, rejected for not having
good reverse DNS. All the other ones banged on our doors too often
Connection-time rejection stats:
25692 total 12178 dynamic IP 6811 bad or no reverse DNS 1973 class bl-spews 1323 class bl-dsbl 1272 class bl-cbl 458 class bl-ordb 416 class bl-sbl 105 class bl-njabl 84 class bl-sdul 10 class bl-opm
There are no particularly prominent single sources of connection time rejections this week, certainly not for the DNS blocklists; their larger numbers this week seem to be natural fluctuation.
|what||# this week||(distinct IPs)||# last week||(distinct IPs)|
This makes it pretty probably that our increased volume this week was spam bounce backscatter.