Weekly spam summary on September 29th, 2007
This week, we:
- got 11,909 messages from 265 different IP addresses.
- handled 26,934 sessions from 2,995 different IP addresses.
- received 297,885 connections from at least 101,029 different IP addresses.
- hit a highwater of 16 connections being checked at once.
Volume is a bit up from last week. Looking at the numbers I am reminded of how striking the number of different IP addresses is; the average connection source made less than three connections to us, where the average session source made nine connections (and the average mail source probably did even better, since that is an average of about 44 messages per IP).
Apparently the spammers are back to abusing us on Wednesdays.
Kernel level packet filtering top ten:
Host/Mask Packets Bytes 220.127.116.11/26 19977 1096K otcpicknews.com 18.104.22.168/24 17928 1076K onet.pl 22.214.171.124 13567 814K 126.96.36.199/24 11478 551K adelphia.net 188.8.131.52/24 10808 648K centrum.cz 184.108.40.206 9019 422K 220.127.116.11/23 8400 408K cox.net 18.104.22.168 8287 421K 22.214.171.124 8082 388K 126.96.36.199 6257 375K
Volume is significantly up from last week.
- 188.8.131.52 returns from last week.
- 184.108.40.206 kept trying to send us bad
HELOs and returns from a previous appearance in Feburary.
- 220.127.116.11 is something we consider a dynamic IP.
- 18.104.22.168 is an APNIC IP address with broken reverse DNS.
- 22.214.171.124 kept trying with a bad
(It warms the black cockles of my heart to see that throwing otcpicknews.com's other netblock straight into our kernel filters was absolutely the right thing to do.)
Connection time rejection stats:
83117 total 41427 bad or no reverse DNS 35442 dynamic IP 4001 class bl-cbl 332 class bl-dsbl 291 acceleratebiz.com 261 class bl-pbl 255 class bl-sdul 188 class bl-sbl 125 qsnews.net 86 class bl-njabl 42 officepubs.com 24 verticalresponse.com
Perversely, volume is down here compared to last week. The highest source of SBL rejections this week was SBL58952 with 66 rejections (a recent listing for a spam source), followed by last week's leading contents of SBL53319 with 25 rejections and SBL48694 with 23 rejections. (Better luck next time, you two! Oh wait, what am I saying? Please drop off the Internet.)
Seventeen of the top 30 most rejected IP addresses were rejected
100 times or more this week; the leader is 126.96.36.199 (1,412
rejections), followed by 188.8.131.52 (1,375 rejections) and
184.108.40.206 (301 rejections). Five are currently in the CBL, two are
bl.spamcop.net, six are currently in the PBL, and a grand
total of (only) eight are zen.spamhaus.org. I don't know why these
numbers are so low.
(Locally, 20 were rejected for bad or missing reverse DNS, 8 for being dynamic IP addresses, one for being in the NJABL, one for being in the DSBL. Two of those have since changed their status and would not be blocked now.)
This week, Hotmail had:
- 4 messages accepted.
- no messages rejected because they came from non-Hotmail email addresses.
- 27 messages sent to our spamtraps.
- no messages refused because their sender addresses had already hit our spamtraps.
- 1 message refused due to its origin IP address being from the Cote d'Ivoire.
And the final numbers:
|what||# this week||(distinct IPs)||# last week||(distinct IPs)|
Ah. Well. That would explain a certain amount of everything; we seem to
have been forged as a spam origin in a big way, judging by how these
numbers have jumped so dramatically. The leading source of bad
this week was 220.127.116.11 (218 attempts), followed by 18.104.22.168
(89 attempts), 22.214.171.124 (83 attempts), and then a lot more.
Bad bounces were sent to 1,421 different bad usernames this week, with
the most popular one being
grabes with 19 attempts, followed by
NortonPinero with 10.
SHOUGEE returns from last week with 3
attempts, mixed in with all sorts of others that I am not going to try
to pick through, including ex-users.
My pick for the most ironic source of bad bounces this week has to be
AntiSpam.Awesome.net. (No and no, respectively.)