Spam Attacks

[Jason Ede]

We're seeing similar, although not at those levels, at around 1pm and 6pm each day.

Jason

> -----Original Message-----
> From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-
> bounces at lists.mailscanner.info] On Behalf Of Paul Kelly :: Blacknight
> Sent: 11 September 2011 21:59
> To: MailScanner discussion
> Subject: Spam Attacks
> 
> Hi Guys,
> 
> Has anyone noticed a huge increase in smtp slamming recently?
> 
> We have a busy mail cluster that has about 80k users. In the last 10 days or so
> we've seen a huge increase in IPs slamming the mail servers. The really odd
> thing is that it happens a few times a day and it's really intensive. Mostly the
> traffic hops off of RBL lookups. As an experiment today I moved 8 domains
> MX records to a stand alone Postfix box with just zen.spamhaus.org
> configured on it.
> 
> The results are _insane_, a snippet from just today.
> 
> Per-Hour Traffic Summary
> ------------------------
>     time          received  delivered   deferred    bounced     rejected
>     --------------------------------------------------------------------
> 
>     1000-1100          12          0          0         19       1776
>     1100-1200          26          1          0        112       2851
>     1200-1300          25          5          0         54       3256
>     1300-1400          66          1          0        200      13509
>     1400-1500         241          0          0        501      61974
>     1500-1600         229          3          0        520      55902
>     1600-1700          38          1          0         74       3750
>     1700-1800         197          2          0        441      47213
>     1800-1900         302          3          0        638      77602
>     1900-2000         134          6          0        248      38728
>     2000-2100          23          1          0         63       4482
>     2100-2200         169          4          0        216       2786
> 
> Is anyone else seeing this?
> 
> Cheers,
> 
> Paul
> 
> Paul Kelly
> Technical Director
> Microsoft Certified Partner
> Blacknight Internet Solutions ltd
> Hosting, Colocation, Dedicated servers
> IP Transit Services
> Tel: +353(0)599183072
> Lo-call: 1850 929 929
> DDI: +353 (0) 59 9183091
> 
> e-mail: paul at blacknight.com
> web: http://www.blacknight.com
> 
> Blacknight Internet Solutions Ltd,
> Unit 12A,Barrowside Business Park,
> Sleaty Road,
> Graiguecullen,
> Carlow,
> Ireland
> 
> Company No.: 370845
> 
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> 
> Before posting, read http://wiki.mailscanner.info/posting
> 
> Support MailScanner development - buy the book off the website!