Weekly spam summary on January 14th, 2006
This week we received 12,785 email messages from 208 different IP addresses. Our SMTP server handled 17,958 sessions from 984 different IP addresses. Session volume is dramatically down from the levels of last week.
Connection volume is also down: 122,600 connections from at least 44,760 different IP addresses. However, we hit a highwater mark of 50 connections being processed at once on Tuesday, so we have had some significant traffic bursts. Broken down by day:
Kernel level packet filtering top ten:
Host/Mask Packets Bytes [Why] 188.8.131.52 16976 1019K [rdns] 184.108.40.206 8108 486K [trap] 220.127.116.11 6576 342K [dyn] 18.104.22.168 5664 324K 22.214.171.124/24 5483 274K 126.96.36.199 4981 239K [rdns] 188.8.131.52/11 4606 263K 184.108.40.206 3834 230K [sbl] 220.127.116.11 3306 198K 18.104.22.168 3093 157K [rdns]
dyn for dynamic IP/dialup machines,
rdns for having bad
sbl for being listed in the
trap for hitting spamtrap
addresses and then keeping trying to send us mail with the same
These are down from last week overall, and there's no one blocked for
being a source of bad
HELO names, for the first time in a while.
- 22.214.171.124 got blocked for reasons covered in HowNotToDoDNSVII.
- 126.96.36.199 is a centrum.cz machine, and we don't talk to them due to previously being spammed by them.
- 188.8.131.52 and 184.108.40.206 reappear from last week.
- 220.127.116.11 reappears from earlier, still listed in SBL34212. Maybe they'll give up sometime, but I'm not going to count on it.
Connection time rejection stats:
24153 total 13837 dynamic IP 6700 bad or no reverse DNS 2421 class bl-cbl 248 class bl-sbl 189 class bl-sdul 158 class bl-dsbl 112 class bl-spews 90 class bl-ordb 44 class bl-njabl 7 class bl-opm
Nothing particularly stands out, although 10 of the top 30 most connecting IPs were on the CBL this time around.
|what||# this week||(distinct IPs)||# last week||(distinct IPs)|
This week is clearly a quiet one for backscatter: these numbers are a major drop from last week; in fact, they're pretty close to the casual nuisance level.
Hotmail spam volume is up from last week:
- one email accepted, probably spam.
- 371 messages rejected because they came from non-Hotmail email addresses.
- 87 messages sent to our spamtraps.
- 12 messages refused because their sender addresses had already hit our spamtraps.
- 4 messages refused due to their origin IP address (two for being in the SBL, one for being in the CBL, and one for being in the XBL).
Hotmail continues to fail to control their major spam problem.