Weekly spam summary on September 8th, 2007
This week, we:
- got 10,541 messages from 243 different IP addresses.
- handled 22,006 sessions from 1,956 different IP addresses.
- received 515,114 connections from at least 130,401 different IP addresses.
- hit a highwater of 10 connections being checked at once.
Connection volume has jumped significantly from last week and session volume is up, which suggests that our simplistic greylisting stuff is no longer working quite as well as it used to.
If I want to be optimistic I could see the Saturday figure as the spammers behind the onslaught deciding to give up on it for now, but I'm not sure that I'm that optimistic.
Kernel level packet filtering top ten:
Host/Mask Packets Bytes 22.214.171.124/23 24358 1183K cox.net 126.96.36.199/24 24110 1108K hinet.net 188.8.131.52/24 19951 1197K 184.108.40.206/27 19181 1054K otcpicknews.com 220.127.116.11 12028 660K 18.104.22.168/24 8064 379K coxmail.com 22.214.171.124/24 6751 324K adelphia.net 126.96.36.199/24 6508 390K centrum.cz 188.8.131.52 5824 319K 184.108.40.206 4802 237K
This is up significantly from last week, probably partly because I was aggressive about throwing webmail advance fee fraud spam /24s into the kernel blocks.
- 220.127.116.11/24 is the home of abovev.com, as mentioned last week, along with some fluteu.com hosts.
- 18.104.22.168 returns from last week and several weeks before. The odds of them getting the hint appear to be low.
- 22.214.171.124 kept trying with what appears to have been phish spam.
- 126.96.36.199 returns from last week.
Connection time rejection stats:
245556 total 159938 bad or no reverse DNS 74505 dynamic IP 7569 class bl-cbl 784 class bl-pbl 726 class bl-sbl 255 class bl-sdul 228 class bl-dsbl 14 class bl-njabl
This is up a heck of a lot from last week, which doesn't really surprise me. The highest source of SBL rejections this week is the same as last week: SBL57946, with 536 rejections. Following them is SBL44331, a /24 of the ROKSO-listed Expedite Media Group, with 52 rejections, SBL51995, a machine that seems to have been spamming since March 5th 2007, with 30 rejections, and SBL48694 with 20 rejections.
All thirty of the top 30 most rejected IP addresses this week were
rejected 100 times or more. The leader is 188.8.131.52 (1,588
rejections), followed by 184.108.40.206 (913 rejections), 220.127.116.11
(760 rejections), and 18.104.22.168 (608 rejections). Fourteen
of the top 30 are currently in the CBL, fifteen are currently in
bl.spamcop.net, twenty one are in the PBL, and a grand total of 28 are
in zen.spamhaus.org. One of the two IP addresses not in zen.spamhaus.org
bl.spamcop.net; the other one is a Chinese IP address with no
reverse DNS that seems to be running a Microsoft mailer.
(Locally, 29 were rejected for having bad or missing reverse DNS and 1 for being a dynamic IP.)
This week Hotmail had:
- 3 messages accepted.
- no messages rejected because they came from non-Hotmail email addresses.
- 31 messages sent to our spamtraps.
- 12 messages refused because their sender addresses had already hit our spamtraps.
- 1 messages refused due to its origin IP address being in the CBL.
And the final numbers:
|what||# this week||(distinct IPs)||# last week||(distinct IPs)|
The leading source of bad
HELOs this week is 22.214.171.124 (81
attempts), followed by 126.96.36.199 (72 attempts), 188.8.131.52 (65
attempts), and 184.108.40.206 (62 attempts). The latter is one of
netcabo.pt's outgoing mail servers, and I suspect that we wouldn't want
to talk to them even if they could get their
HELO names to look good.
Bad bounces were sent to 388 different bad usernames this week, with
the most popular one being
ShaunStanton with 39 attempts, closely
bhikhu_Dagastino with 36 attempts. Other representative
bad usernames include
bad bounce was sent to an all-numeric username this week,
The leading source of bad bounces this week was 220.127.116.11, followed by 18.104.22.168; other contributions came from the usual suspects, including ezweb.ne.jp and softbank.ne.jp. Several came from Google machines, to my disappointment.