Weekly spam summary on July 22nd, 2006
We rebooted this server Monday around 6:50pm, so a number of the stats are truncated this week. Having said that, this week, we:
- got 11,369 messages from 257 different IP addresses.
- handled 15,931 sessions from 851 different IP addresses.
- received 87,698 connections from at least 31,657 different IP addresses since Monday evening.
- hit a highwater of 6 connections being checked at once since Monday evening.
It appears as if this week's connection volume is down significantly from last week. I have no particularly good explanation why, but I like it.
Kernel level packet filtering top ten since Monday evening:
Host/Mask Packets Bytes 184.108.40.206 9132 475K 220.127.116.11 7796 428K 18.104.22.168/11 6990 340K 22.214.171.124/24 4960 248K 126.96.36.199/24 4303 207K 188.8.131.52/10 3196 168K 184.108.40.206 2969 129K 220.127.116.11 2488 116K 18.104.22.168 2318 114K 22.214.171.124 2145 109K
- 126.96.36.199 returns from last week.
- 188.8.131.52 is mailupnet.it aka mailup.info aka people we have no interest in ever accepting email from again.
- 184.108.40.206 and 220.127.116.11 both hit our spamtraps and kept on sending, likely with phish spam in both cases.
- 18.104.22.168 is something we consider a covad.net 'dialup' machine.
- 22.214.171.124 is on the NJABL.
Connection time rejection stats, from Monday evening:
27275 total 11820 dynamic IP 11820 bad or no reverse DNS 1696 class bl-cbl 591 mailup.info 243 class bl-njabl 207 dartmail.net 118 class bl-sdul 108 class bl-dsbl 92 class bl-sbl 58 class bl-spews 42 class bl-ordb
Five of the top 30 most rejected IP addresses were rejected more than
100 times; the winner is 126.96.36.199, rejected 591 times. 13 of the
top 30 are currently in the CBL, six are currently in
and one, 188.8.131.52, is in the SBL as part of SBL21129. It's an advance
fee fraud spam source, of course.
Hotmail is backsliding. This week, it had:
- no messages accepted.
- 2 messages rejected because they came from non-Hotmail email addresses.
- 14 messages sent to our spamtraps.
- no messages refused because their sender addresses had already hit our spamtraps.
- 3 messages refused due to their origin IP address being in the SBL. All three came from 184.108.40.206, in SBL27471, which has been listed since February 7th. Worse, the SBL page shows evidence of spam through Hotmail as far back as September 10th 2005.
I especially displeased by the 'rejected for being in the SBL' messages.
And the final numbers:
|what||# this week||(distinct IPs)||# last week||(distinct IPs)|
I'm pleased to see this drop; evidently last week was just exceptional.
For the first time in a while, none of the various 38-character hex strings got any bounces. Instead, everything went to all of the other usual suspects.
(I am short on sleep, so this summary is more uninspired than usual.)