Spam Attacks

[Paul Kelly :: Blacknight]

Hi All,

Thanks for your replies. As of today I've pointed 10 domains to a new gateway and here are some stats.

http://dominion.blacknight.ie/~paul/postfix.txt

It's a bit crazy.

Paul


Paul Kelly
Technical Director
Microsoft Certified Partner
Blacknight Internet Solutions ltd
Hosting, Colocation, Dedicated servers
IP Transit Services
Tel: +353(0)599183072
Lo-call: 1850 929 929
DDI: +353 (0) 59 9183091
 
e-mail: paul at blacknight.com
web: http://www.blacknight.com
 
Blacknight Internet Solutions Ltd,
Unit 12A,Barrowside Business Park,
Sleaty Road,
Graiguecullen,
Carlow,
Ireland
 
Company No.: 370845

On 12 Sep 2011, at 17:43, Sergio Rabellino wrote:

> I've got some numbers about my main mailserver :
> from 3.00 am to 18.00 pm TODAY (italian hours, GMT+2) we refused 30798 incoming messages from dnsbl listed hosts, 2410 greylist entry timed out (spammers trying to send mail once) and delivered 7658 (possibly) legal messages to our (150) recipients.
> 
> Bye.
> 
> Il 12/09/2011 10:03, Jason Ede ha scritto:
>> We're seeing similar, although not at those levels, at around 1pm and 6pm each day.
>> 
>> Jason
>> 
>> 
>>> -----Original Message-----
>>> From: 
>>> mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner
>>> -
>>> 
>>> bounces at lists.mailscanner.info
>>> ] On Behalf Of Paul Kelly :: Blacknight
>>> Sent: 11 September 2011 21:59
>>> To: MailScanner discussion
>>> Subject: Spam Attacks
>>> 
>>> Hi Guys,
>>> 
>>> Has anyone noticed a huge increase in smtp slamming recently?
>>> 
>>> We have a busy mail cluster that has about 80k users. In the last 10 days or so
>>> we've seen a huge increase in IPs slamming the mail servers. The really odd
>>> thing is that it happens a few times a day and it's really intensive. Mostly the
>>> traffic hops off of RBL lookups. As an experiment today I moved 8 domains
>>> MX records to a stand alone Postfix box with just zen.spamhaus.org
>>> configured on it.
>>> 
>>> The results are _insane_, a snippet from just today.
>>> 
>>> Per-Hour Traffic Summary
>>> ------------------------
>>>     time          received  delivered   deferred    bounced     rejected
>>>     --------------------------------------------------------------------
>>> 
>>>     1000-1100          12          0          0         19       1776
>>>     1100-1200          26          1          0        112       2851
>>>     1200-1300          25          5          0         54       3256
>>>     1300-1400          66          1          0        200      13509
>>>     1400-1500         241          0          0        501      61974
>>>     1500-1600         229          3          0        520      55902
>>>     1600-1700          38          1          0         74       3750
>>>     1700-1800         197          2          0        441      47213
>>>     1800-1900         302          3          0        638      77602
>>>     1900-2000         134          6          0        248      38728
>>>     2000-2100          23          1          0         63       4482
>>>     2100-2200         169          4          0        216       2786
>>> 
>>> Is anyone else seeing this?
>>> 
>>> Cheers,
>>> 
>>> Paul
>>> 
>>> Paul Kelly
>>> Technical Director
>>> Microsoft Certified Partner
>>> Blacknight Internet Solutions ltd
>>> Hosting, Colocation, Dedicated servers
>>> IP Transit Services
>>> Tel: +353(0)599183072
>>> Lo-call: 1850 929 929
>>> DDI: +353 (0) 59 9183091
>>> 
>>> e-mail: 
>>> paul at blacknight.com
>>> 
>>> web: 
>>> http://www.blacknight.com
>>> 
>>> 
>>> Blacknight Internet Solutions Ltd,
>>> Unit 12A,Barrowside Business Park,
>>> Sleaty Road,
>>> Graiguecullen,
>>> Carlow,
>>> Ireland
>>> 
>>> Company No.: 370845
>>> 
>>> --
>>> MailScanner mailing list
>>> 
>>> mailscanner at lists.mailscanner.info
>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>>> 
>>> 
>>> Before posting, read 
>>> http://wiki.mailscanner.info/posting
>>> 
>>> 
>>> Support MailScanner development - buy the book off the website!
>>> 
> 
> -- 
> Ing. Sergio Rabellino
> 
> Università degli Studi di Torino
> Dipartimento di Informatica
> ICT Services Director
> Tel +39-0116706701  Fax +39-011751603
> C.so Svizzera , 185 - 10149 - Torino
> 
> <logo.jpg>
> -- 
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> 
> Before posting, read http://wiki.mailscanner.info/posting
> 
> Support MailScanner development - buy the book off the website!