Newsgroup: it.news.net-abuse
Titolo: [STATISTICHE] spam rifiutato da attila.bofh.it (agosto 2008)

Queste sono le statistiche aggregate dello spam rifiutato da
attila.bofh.it
 tra queste date:
Aug 10 06:53:14
Sep 7 06:52:31
Al momento della generazione di queste statistiche, il server era
protetto (nell'ordine) da queste DNSBL:
ip.private-dnsbl.bofh.it
zen.spamhaus.org
combined.njabl.org
bhnc.njabl.org
dul.dnsbl.sorbs.net
2662741 74.90% Bad HELO
 640072 18.01% DNSBL 
xbl.spamhaus.org
 190393  5.36% Client host rejected
  29189  0.82% DNSBL 
ip.private-dnsbl.bofh.it
   7460  0.21% Bad pipelining (Client host)
   5436  0.15% DNSBL 
dul.dnsbl.sorbs.net
   4923  0.14% header checks
   4296  0.12% Relay access denied
   3065  0.09% Recipient address rejected
   2581  0.07% Sender address rejected
   1857  0.05% DNSBL 
sbl.spamhaus.org
   1158  0.03% DNSBL 
combined.njabl.org
    689  0.02% DNSBL 
rhs.private-dnsbl.bofh.it
    613  0.02% DNSBL 
bhnc.njabl.org
    239  0.01% Need FQDN address
    210  0.01% Bad pipelining (Helo command)
     12  0.00% Bad pipelining (Data command)
      5  0.00% body checks
      2  0.00% Need FQDN address (recipient)
3554941        TOTAL
Rejected headers:
   4836 98.23% spam 0x20970004
     72  1.46% Your mailer is not RFC 2047 compliant
      9  0.18% no executable attachments allowed
      4  0.08% keep your viruses for yourself (ZIP)
      1  0.02% message content rejected
      1  0.02% X-SA-Do-Not-Rej
Rejected bodies:
      5 100.00% keep your viruses for yourself (hidden iframe)
Rejected HELO commands:
1228507 46.14% generic HELO hostname
 761155 28.59% unqualified HELO hostname
 596328 22.40% IP literal in HELO hostname
  35834  1.35% forged HELO hostname
  33099  1.24% Invalid name
   7430  0.28% fake IP literal in HELO hostname
    376  0.01% using my own HELO hostname
     12  0.00% invalid ip address
Popular DNSBL listings:
   1057 56.92% SBL 64156
    237 12.76% SBL 64155
    178  9.59% SBL 66108
    145  7.81% SBL 65302
     96  5.17% SBL 65468
    144  7.75% others (29 different)
Popular local source-based rejections:
  85823 45.08% we do not accept mail from dynamically-assigned addresses
  78378 41.17% non accettiamo posta da IP dinamici
  17949  9.43% too much spam from this network
   8195  4.30% Too much spam from CHINANET
     24  0.01% Too much spam from 
chinamobile.com
     14  0.01% Too much spam from 
gwbn.net.cn
     10  0.01% Too much spam from China Railways
Most rejected networks:
  65120  1.83% 
88.224.0.0/12
  53032  1.49% 
78.160.0.0/11
  51314  1.45% 
79.0.0.0/11
  43136  1.22% 
87.0.0.0/12
  32249  0.91% 
86.128.0.0/10
  30947  0.87% 
86.128.0.0/12
  23412  0.66% 
81.128.0.0/11
  21526  0.61% 
87.16.0.0/13
  21306  0.60% 
91.76.0.0/14
  21293  0.60% 
85.96.0.0/13
  20187  0.57% 
88.240.0.0/13
3166491 89.20% others (21215 different)
Most rejected AS:
 228152  6.43% 9121
 204798  5.77% 3269
 125635  3.54% 2856
  66509  1.87% 19262
  51814  1.46% 4766
  45079  1.27% 8359
  43781  1.23% 8997
  43186  1.22% 7132
  41781  1.18% 6849
  41424  1.17% 7738
2657854 74.87% others (5513 different)
-- 
ciao,
Marco

    4836 98.23% spam 0x20970004
Cosa intendi per "spam 0x20970004" ?

from    ['Aug', '31', '06:49:47']
to      ['Sep', '7', '06:49:43']
 142409 DNSBL 
pbl.spamhaus.org
;
  92693 DNSBL 
xbl.spamhaus.org
;
  51562 Need FQDN address (recipient)
  17293 Relay access denied
   6834 Sender address rejected
   3913 Recipient address rejected
   2054 Helo command rejected
   1758 DNSBL 
dul.dnsbl.sorbs.net
;
    740 DNSBL 
bl.spamcop.net
;
    241 DNSBL 
bhnc.njabl.org
;
     91 DNSBL 
sbl.spamhaus.org
;
     76 DNSBL 
dnsbl.njabl.org
;
      8 Server configuration problem
      5 attachment type not allowed
      3 Message size exceeds fixed limit
 319680 TOTAL FILTERED MAIL
 238008 TOTAL DNSBL FILTERED MAIL (74.45 %)
  32940 TOTAL GREYLISTING DELAYS
  16401 TOTAL POSTED MAIL ON 336081 ATTEMPTS (4.88 %)
  16401 TOTAL POSTED MAIL ON 369021 ATTEMPTS (INCLUDE GREYLISTING) (4.44 %)
** Most Blocked Sender IPs - Top 19 **
    720  0.204%    64.61.23.234
    496  0.141%    62.154.212.218
    455  0.129%    89.251.72.25
    432  0.123%    170.51.26.52
    386  0.109%    189.104.16.197
    351  0.100%    208.131.141.10
    349  0.099%    213.164.231.66
    338  0.096%    212.178.123.120
    331  0.094%    79.186.155.85
    328  0.093%    62.23.218.174
    309  0.088%    83.147.72.50
    292  0.083%    207.11.53.76
    280  0.079%    79.152.115.24
    270  0.077%    77.24.200.212
    246  0.070%    65.173.76.16
    244  0.069%    203.30.248.118
    230  0.065%    82.38.147.91
    221  0.063%    65.197.188.196
    217  0.062%    81.103.67.161
** Most Blocked Mail by Sender Domain - Top 20 **
   5924  1.680%    --empty_source_address_found--
   5644  1.601%    
hotmail.com
   3715  1.054%    
icqmail.com
   2124  0.602%    
yahoo.com
    935  0.265%    
3bay.it
    810  0.230%    
alphaquad.com
    773  0.219%    
gmail.com
    761  0.216%    
bezeqint.net
    716  0.203%    
poste.it
    712  0.202%    QUlUBl.lT
    680  0.193%    
qui-ubi.com
    656  0.186%    
quark.com
    645  0.183%    
qq.com
    574  0.163%    
quick.cz
    569  0.161%    
yahoo.es
    542  0.154%    
ubi.banca.it
    438  0.124%    
btopenworld.com
    398  0.113%    
teccart.qc.ca
    378  0.107%    
quiubi.it
    363  0.103%    
bancopostaonline.poste.it
** Most Blocked Mail by Sender Country > 0.9% **
  49271  13.973%    UNITED STATES
  43234  12.261%    UNITED KINGDOM
  22716  6.442%    RUSSIAN FEDERATION
  21754  6.169%    ITALY
  14897  4.225%    TURKEY
  13405  3.802%    CHINA
  12936  3.669%    KOREA REPUBLIC OF
  12146  3.445%    VIET NAM
  12068  3.422%    GERMANY
   9462  2.683%    SPAIN
   9387  2.662%    BRAZIL
   6870  1.948%    NETHERLANDS
   6428  1.823%    POLAND
   6382  1.810%    UKRAINE
   6305  1.788%    FRANCE
   6137  1.740%    INDIA
   5602  1.589%    THAILAND
   5054  1.433%    EUROPEAN UNION
   4848  1.375%    ARGENTINA
   4455  1.263%    no country detected
   4452  1.263%    AUSTRALIA
   4364  1.238%    CANADA
   3739  1.060%    COLOMBIA
   3710  1.052%    SWITZERLAND
   3680  1.044%    ROMANIA
   3197  0.907%    JAPAN
 
-- 
Gerolamo

Cosa intendi per "spam 0x20970004" ?
Un certo tipo di header molto popolare tra i phisher.
-- 
ciao, |
Marco |  The Italian Usenet Cabal, Abuse Department (TINC)
"It's about damn time that all of us who actually give a damn about Usenet
stand up and tell the people who don't to fuck off and die." -- Russ Allbery