Weekly spam summary on January 14th, 2006

January 15, 2006

This week we received 12,785 email messages from 208 different IP addresses. Our SMTP server handled 17,958 sessions from 984 different IP addresses. Session volume is dramatically down from the levels of last week.

Connection volume is also down: 122,600 connections from at least 44,760 different IP addresses. However, we hit a highwater mark of 50 connections being processed at once on Tuesday, so we have had some significant traffic bursts. Broken down by day:

Day Connections different IPs
Sunday 22,540 +8,110
Monday 17,460 +6,920
Tuesday 21,190 +7,770
Wednesday 15,490 +5,730
Thursday 17,130 +6,220
Friday 14,600 +5,230
Saturday 14,200 +4,770

Kernel level packet filtering top ten:

Host/Mask           Packets   Bytes [Why]         16976   1019K [rdns]           8108    486K [trap]          6576    342K [dyn]         5664    324K       5483    274K           4981    239K [rdns]           4606    263K            3834    230K [sbl]           3306    198K         3093    157K [rdns]

(Key: dyn for dynamic IP/dialup machines, rdns for having bad reverse DNS, sbl for being listed in the SBL, trap for hitting spamtrap addresses and then keeping trying to send us mail with the same MAIL FROM.)

These are down from last week overall, and there's no one blocked for being a source of bad HELO names, for the first time in a while.

  • got blocked for reasons covered in HowNotToDoDNSVII.
  • is a centrum.cz machine, and we don't talk to them due to previously being spammed by them.
  • and reappear from last week.
  • reappears from earlier, still listed in SBL34212. Maybe they'll give up sometime, but I'm not going to count on it.

Connection time rejection stats:

  24153 total
  13837 dynamic IP
   6700 bad or no reverse DNS
   2421 class bl-cbl
    248 class bl-sbl
    189 class bl-sdul
    158 class bl-dsbl
    112 class bl-spews
     90 class bl-ordb
     44 class bl-njabl
      7 class bl-opm

Nothing particularly stands out, although 10 of the top 30 most connecting IPs were on the CBL this time around.

Other stats:

what # this week (distinct IPs) # last week (distinct IPs)
Bad HELOs 880 97 8120 406
Bad bounces 308 83 4349 1629

This week is clearly a quiet one for backscatter: these numbers are a major drop from last week; in fact, they're pretty close to the casual nuisance level.

Hotmail spam volume is up from last week:

  • one email accepted, probably spam.
  • 371 messages rejected because they came from non-Hotmail email addresses.
  • 87 messages sent to our spamtraps.
  • 12 messages refused because their sender addresses had already hit our spamtraps.
  • 4 messages refused due to their origin IP address (two for being in the SBL, one for being in the CBL, and one for being in the XBL).

Hotmail continues to fail to control their major spam problem.

Written on 15 January 2006.
« Writing HTML considered harmful
How not to set up your DNS (part 8) »

Page tools: View Source, Add Comment.
Login: Password:
Atom Syndication: Recent Comments.

Last modified: Sun Jan 15 01:49:04 2006
This dinky wiki is brought to you by the Insane Hackers Guild, Python sub-branch.