Spam Attacks

[Glenn Steen]

On 13 September 2011 20:10, Jason Ede <J.Ede at birchenallhowden.co.uk> wrote:
> Just pulled up the stats for the incoming postfix instance on one of our servers for yesterday, although not quite at the levels you have it still seems to show the same pattern.
>
> I've not looked too deeply at what makes up the rejections yet if it is xen or the other rbls or invalid addresses etc...
>
> Per-Hour Traffic Summary
>    time          received  delivered   deferred    bounced     rejected
>    --------------------------------------------------------------------
>    0000-0100          79         80          0          0        273
>    0100-0200          74         75          0          0        261
>    0200-0300         101        101          0          0        297
>    0300-0400         115        115          0          0        510
>    0400-0500          91         91          0          0        327
>    0500-0600         125        125          0          0        325
>    0600-0700         103        103          0          0        510
>    0700-0800         151        154          0          0        597
>    0800-0900         326        337          0          0        760
>    0900-1000         443        455          0          0        970
>    1000-1100         628        644          0          0       1272
>    1100-1200         655        680          0          0        774
>    1200-1300         711        724          0          0       2597
>    1300-1400         630        665          0          0       7021
>    1400-1500         630        665          0          0       3998
>    1500-1600         657        674          0          0        946
>    1600-1700         584        602          0          0       4129
>    1700-1800         450        459          0          0       6995
>    1800-1900         264        268          0          0       2401
>    1900-2000         215        214          0          0        502
>    2000-2100         200        205          0          0        425
>    2100-2200         184        191          0          0        477
>    2200-2300         149         51          4          0        271
>    2300-2400         137        139        111          0        171
>
> Jason

I've got pflogsumm daily reports stored since August -08, and apart
from natural differences (layoffs making the total volume drop,
temporarily driving up the "no such address"-rejections back in -09) a
cursory comparision of a semi-random selection show no real difference
during the last months (well, there's always a lull during the
summer/vacation period:-).

But that  might only show quirks of my particular setup, volume and
usage patterns of my userbase etc. I suspect an ISP-type organization
would be more likely to ... attract ... badness:-).

(snip)
Cheers!
-- 
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se