Weekly spam summary on September 8th, 2007
This week, we:
- got 10,541 messages from 243 different IP addresses.
- handled 22,006 sessions from 1,956 different IP addresses.
- received 515,114 connections from at least 130,401 different IP addresses.
- hit a highwater of 10 connections being checked at once.
Connection volume has jumped significantly from last week and session volume is up, which suggests that our simplistic greylisting stuff is no longer working quite as well as it used to.
If I want to be optimistic I could see the Saturday figure as the spammers behind the onslaught deciding to give up on it for now, but I'm not sure that I'm that optimistic.
Kernel level packet filtering top ten:
Host/Mask Packets Bytes 18.104.22.168/23 24358 1183K cox.net 22.214.171.124/24 24110 1108K hinet.net 126.96.36.199/24 19951 1197K 188.8.131.52/27 19181 1054K otcpicknews.com 184.108.40.206 12028 660K 220.127.116.11/24 8064 379K coxmail.com 18.104.22.168/24 6751 324K adelphia.net 22.214.171.124/24 6508 390K centrum.cz 126.96.36.199 5824 319K 188.8.131.52 4802 237K
This is up significantly from last week, probably partly because I was aggressive about throwing webmail advance fee fraud spam /24s into the kernel blocks.
- 184.108.40.206/24 is the home of abovev.com, as mentioned last week, along with some fluteu.com hosts.
- 220.127.116.11 returns from last week and several weeks before. The odds of them getting the hint appear to be low.
- 18.104.22.168 kept trying with what appears to have been phish spam.
- 22.214.171.124 returns from last week.
Connection time rejection stats:
245556 total 159938 bad or no reverse DNS 74505 dynamic IP 7569 class bl-cbl 784 class bl-pbl 726 class bl-sbl 255 class bl-sdul 228 class bl-dsbl 14 class bl-njabl
This is up a heck of a lot from last week, which doesn't really surprise me. The highest source of SBL rejections this week is the same as last week: SBL57946, with 536 rejections. Following them is SBL44331, a /24 of the ROKSO-listed Expedite Media Group, with 52 rejections, SBL51995, a machine that seems to have been spamming since March 5th 2007, with 30 rejections, and SBL48694 with 20 rejections.
All thirty of the top 30 most rejected IP addresses this week were
rejected 100 times or more. The leader is 126.96.36.199 (1,588
rejections), followed by 188.8.131.52 (913 rejections), 184.108.40.206
(760 rejections), and 220.127.116.11 (608 rejections). Fourteen
of the top 30 are currently in the CBL, fifteen are currently in
bl.spamcop.net, twenty one are in the PBL, and a grand total of 28 are
in zen.spamhaus.org. One of the two IP addresses not in zen.spamhaus.org
bl.spamcop.net; the other one is a Chinese IP address with no
reverse DNS that seems to be running a Microsoft mailer.
(Locally, 29 were rejected for having bad or missing reverse DNS and 1 for being a dynamic IP.)
This week Hotmail had:
- 3 messages accepted.
- no messages rejected because they came from non-Hotmail email addresses.
- 31 messages sent to our spamtraps.
- 12 messages refused because their sender addresses had already hit our spamtraps.
- 1 messages refused due to its origin IP address being in the CBL.
And the final numbers:
|what||# this week||(distinct IPs)||# last week||(distinct IPs)|
The leading source of bad
HELOs this week is 18.104.22.168 (81
attempts), followed by 22.214.171.124 (72 attempts), 126.96.36.199 (65
attempts), and 188.8.131.52 (62 attempts). The latter is one of
netcabo.pt's outgoing mail servers, and I suspect that we wouldn't want
to talk to them even if they could get their
HELO names to look good.
Bad bounces were sent to 388 different bad usernames this week, with
the most popular one being
ShaunStanton with 39 attempts, closely
bhikhu_Dagastino with 36 attempts. Other representative
bad usernames include
bad bounce was sent to an all-numeric username this week,
The leading source of bad bounces this week was 184.108.40.206, followed by 220.127.116.11; other contributions came from the usual suspects, including ezweb.ne.jp and softbank.ne.jp. Several came from Google machines, to my disappointment.