Weekly spam summary on December 9th, 2006
Our SMTP frontend crashed and restarted three times this week, twice on Wednesday around 6pm and the third time today at 3:16pm, so some of our stats are really fragmentary. Still, this week we:
- got 15,036 messages from 272 different IP addresses.
- handled 20,984 sessions from 1,243 different IP addresses.
- received 114,833 connections from at least 33,061 different IP addresses up to Wednesday at 4am, received 92,925 connections from at least 27,804 different IP addresses from Wednesday at 6pm until Saturday at 4am, and received 11,972 connections from at least 5,107 different IP addresses since 3:16pm today.
This appears to make connection volume around the same as last week. For the days that we have decent per-day stats, connections are running around 38,000 to 40,000 connections a day, with around 10,000 to 11,000 different IP addresses added per day.
Kernel level packet filtering top ten:
Host/Mask Packets Bytes 188.8.131.52/24 28527 1712K 184.108.40.206 16263 846K 220.127.116.11 15633 938K 18.104.22.168 12648 607K 22.214.171.124 6435 386K 126.96.36.199 4551 273K 188.8.131.52 4357 261K 184.108.40.206 4176 200K 220.127.116.11 3892 187K 18.104.22.168 3480 209K
Things are up from last week overall.
- 22.214.171.124/24 is the centrum.cz mail servers, justifying their new permanent block.
- 126.96.36.199 is terra.es, returning from October and many, many previous appearances.
- 188.8.131.52 and 184.108.40.206 kept trying bad
- 220.127.116.11 is still a PacBell DSL line.
- 18.104.22.168 and 22.214.171.124 both kept trying to send us stuff that had already tripped spamtraps.
- 126.96.36.199 is in the CBL.
- 188.8.131.52 has invalid reverse DNS and is in APNIC space; we require APNIC IP addresses to have valid reverse DNS.
- 184.108.40.206 is a wanadoo.co.uk machine, which has wound up being in SPEWS again and has appeared here before.
Connection time rejection stats:
58045 total 33557 dynamic IP 19569 bad or no reverse DNS 3319 class bl-cbl 210 class bl-sdul 190 class bl-dsbl 104 class bl-spews 89 class bl-njabl 76 cuttingedgemedia.com 42 class bl-ordb 27 class bl-sbl
This week saw some really prolific connection time rejection sources. 13 of the top 30 most rejected IP addresses were rejected 100 times or more, with the champion being 220.127.116.11 (1,124 times, all in a few minutes around 6pm on December 3rd, with enough activity that it triggered our per IP address maximum connection limits). After that we drop to 18.104.22.168 (201 times), 22.214.171.124 (172 times), and so on.
In other stats, 22 of the top 30 are currently in the CBL, and 5 are
Here's a table of the SBL hits:
|9||SBL45324||a /24 ROKSO listing for Expedite Media|
|5||SBL39631||a spam source in
|4||SBL47687||a spam source (listed October 27th)|
|2||SBL48728||reasonably long-term spam source|
|2||SBL48020||a /27 ROKSO listing for Howard Minsky (listed November 3rd)|
|1||SBL48694||a /24 of spammers|
|1||SBL48348||a /24 ROKSO listing for 'livemercial.com' (listed November 17th)|
|1||SBL46756||A ROKSO listing for William Stanley; apparently it is an open squid proxy being used by this spammer (listed September 18th)|
|1||SBL41737||a spammer's mail sending machine (listed May 10th)|
|1||SBL41344||a /21 listing for a spammer's web hosting (listed May 17th)|
It's interesting that this time around there's not a single advance fee fraud spam source on the list. If I'm really lucky, this means that (SBL-listed) advance fee fraud spam sources are cleaning up their act, but I suspect that it is more likely that spammers are learning to not bother using SBL-listed free webmail systems.
This week, Hotmail had:
- 1 message accepted.
- No messages rejected because they came from non-Hotmail email addresses.
- 27 messages sent to our spamtraps.
- 1 message refused because its sender address had already hit our spamtraps.
- 3 messages refused due to their origin IP address (one from Nigeria, one from the Cote d'Ivoire, and one from Burkina Faso)
And the final numbers:
|what||# this week||(distinct IPs)||# last week||(distinct IPs)|
The first_last female Slavic names staged a huge comeback this week, although they don't quite make up a majority of the bad bounces; it looks like that honor is captured by the random alphanumeric jumble login names.
(One amusement in all of these stats is watching a single first name be associated with a run of last names, for example 'alisa petrova', then polkyakova, then osipova. I suspect that this is just brute force table merging of first names and last names.)