Weekly spam summary on July 22nd, 2006
We rebooted this server Monday around 6:50pm, so a number of the stats are truncated this week. Having said that, this week, we:
- got 11,369 messages from 257 different IP addresses.
- handled 15,931 sessions from 851 different IP addresses.
- received 87,698 connections from at least 31,657 different IP addresses since Monday evening.
- hit a highwater of 6 connections being checked at once since Monday evening.
It appears as if this week's connection volume is down significantly from last week. I have no particularly good explanation why, but I like it.
Kernel level packet filtering top ten since Monday evening:
Host/Mask Packets Bytes 126.96.36.199 9132 475K 188.8.131.52 7796 428K 184.108.40.206/11 6990 340K 220.127.116.11/24 4960 248K 18.104.22.168/24 4303 207K 22.214.171.124/10 3196 168K 126.96.36.199 2969 129K 188.8.131.52 2488 116K 184.108.40.206 2318 114K 220.127.116.11 2145 109K
- 18.104.22.168 returns from last week.
- 22.214.171.124 is mailupnet.it aka mailup.info aka people we have no interest in ever accepting email from again.
- 126.96.36.199 and 188.8.131.52 both hit our spamtraps and kept on sending, likely with phish spam in both cases.
- 184.108.40.206 is something we consider a covad.net 'dialup' machine.
- 220.127.116.11 is on the NJABL.
Connection time rejection stats, from Monday evening:
27275 total 11820 dynamic IP 11820 bad or no reverse DNS 1696 class bl-cbl 591 mailup.info 243 class bl-njabl 207 dartmail.net 118 class bl-sdul 108 class bl-dsbl 92 class bl-sbl 58 class bl-spews 42 class bl-ordb
Five of the top 30 most rejected IP addresses were rejected more than
100 times; the winner is 18.104.22.168, rejected 591 times. 13 of the
top 30 are currently in the CBL, six are currently in
and one, 22.214.171.124, is in the SBL as part of SBL21129. It's an advance
fee fraud spam source, of course.
Hotmail is backsliding. This week, it had:
- no messages accepted.
- 2 messages rejected because they came from non-Hotmail email addresses.
- 14 messages sent to our spamtraps.
- no messages refused because their sender addresses had already hit our spamtraps.
- 3 messages refused due to their origin IP address being in the SBL. All three came from 126.96.36.199, in SBL27471, which has been listed since February 7th. Worse, the SBL page shows evidence of spam through Hotmail as far back as September 10th 2005.
I especially displeased by the 'rejected for being in the SBL' messages.
And the final numbers:
|what||# this week||(distinct IPs)||# last week||(distinct IPs)|
I'm pleased to see this drop; evidently last week was just exceptional.
For the first time in a while, none of the various 38-character hex strings got any bounces. Instead, everything went to all of the other usual suspects.
(I am short on sleep, so this summary is more uninspired than usual.)