== Weekly spam summary on May 27th, 2006 This week, we: * got 11,513 messages from 227 different IP addresses. * handled 18,277 sessions from 912 different IP addresses. * received 133,583 connections from at least 42,540 different IP addresses. * hit a highwater of 8 connections being checked at once. This is about the same as [[last week SpamSummary-2006-05-20]]. Tuesday, Wednesday, and Thursday were the busiest days this week for connections; I suppose that's not too surprising. (Interesting, email received peaked on Tuesday but connections peaked on Wednesday.) Kernel level packet filtering top ten: Host/Mask Packets Bytes 218.254.83.47 9190 441K 66.58.176.187 8320 423K 199.239.233.177 8173 403K 204.202.2.104 7246 357K 198.66.222.140 5729 283K 216.59.145.150 4480 215K 61.128.0.0/10 4443 221K 213.180.130.36 4321 259K 198.187.200.0/24 3905 234K 195.34.32.101 3768 241K Overall this is significantly up from [[last week]], although the leader is lower this time around; maybe they've finally given up hammering on us after several weeks. * 218.254.83.47 and 66.58.176.187 return from [[last week]]; the former is now on the CBL, among other places. * 199.239.233.177, 204.202.2.104, and 198.66.222.140 all tried to shovel phish spam at us to an extent that we blocked them. Since all of them used the same _MAIL FROM_ of 'administrative@desjardins.com', they may all be being exploited by the same spammer. * 216.59.145.150 is in [[NJABL http://www.njabl.org/]]. * 213.180.130.36 is a poczta.onet.pl mail sending machine; we have blocked all of poczta.onet.pl here due to advance fee fraud spam email. * 195.34.32.101 is in SPEWS as part of a [[Rostelecom listing http://spews.org/html/S1761.html]]. Connection time rejection stats: 37733 total 17223 bad or no reverse DNS 15812 dynamic IP 2497 class bl-cbl 560 class bl-njabl 493 class bl-dsbl 235 class bl-sdul 146 class bl-spews 79 class bl-ordb 72 class bl-sbl Fourteen out of the top 30 most rejected IP addresses were rejected more than 100 times; the champion is of course 218.254.83.47 (622 times before it wound up back in the kernel IP filters), with 218.62.89.61 next (265 times, for not having any reverse DNS and being in a pile of {{AB:DNSBls:DNS Blocklists}}). 19 of the top 30 are currently in the CBS, and seven are currently in _bl.spamcop.net_. Hotmail has probably improved compared to [[last week]]; the numbers are: * 2 messages accepted. * 3 messages rejected because they came from non-Hotmail email addresses. * 5 messages sent to our spamtraps. * no messages refused because their sender addresses had already hit our spamtraps. * 2 messages refused due to their origin IP address being in the CBL. This is less overall spam than last week, but a more diverse set of reasons for it being rejected. And the last set of numbers: | what | # this week | (distinct IPs) | # last week | (distinct IPs) | Bad _HELO_s | 462 | 64 | 597 | 48 | Bad bounces | 18 | 16 | 30 | 26 Unlike last week, there's nothing from btconnect.com; either they've stopped mailing us for now or they've fixed the problem (I know which option I'm betting on). The most frequent target of bad bounces was the 38-digit hex string from [[before SpamSummary-2006-05-13]], at 5 bounces (all from Demon Internet machines). Apart from that it was almost all to usernames here that used to exist, apart from one to _costauvqaagmlp_ and one to _d45hvwejzd_.