Newsgroup: it.news.net-abuse
Titolo: [STATISTICHE] spam rifiutato da attila.bofh.it (maggio 2008)

Queste sono le statistiche aggregate dello spam rifiutato da
attila.bofh.it
 tra queste date:
May 4 06:56:02
Jun 1 06:57:10
Al momento della generazione di queste statistiche, il server era
protetto (nell'ordine) da queste DNSBL:
ip.private-dnsbl.bofh.it
zen.spamhaus.org
list.dsbl.org
combined.njabl.org
bhnc.njabl.org
dul.dnsbl.sorbs.net
5694740 80.00% Bad HELO
1150246 16.16% DNSBL pbl+
xbl.spamhaus.org
 193411  2.72% Client host rejected
  54078  0.76% DNSBL 
ip.private-dnsbl.bofh.it
   6682  0.09% Relay access denied
   4496  0.06% DNSBL 
dul.dnsbl.sorbs.net
   3325  0.05% header checks
   2134  0.03% Bad pipelining (Client host)
   1982  0.03% Recipient address rejected
   1928  0.03% DNSBL 
sbl.spamhaus.org
   1598  0.02% DNSBL 
list.dsbl.org
   1374  0.02% DNSBL 
bhnc.njabl.org
   1213  0.02% DNSBL 
rhs.private-dnsbl.bofh.it
    528  0.01% DNSBL 
combined.njabl.org
    413  0.01% Sender address rejected
    329  0.00% Need FQDN address
    286  0.00% Bad pipelining (Helo command)
     41  0.00% Bad pipelining (Data command)
     15  0.00% body checks
      2  0.00% Multi-recipient bounce
7118821        TOTAL
Rejected headers:
   3183 95.73% spam 0x20970004
    106  3.19% Your mailer is not RFC 2047 compliant
     27  0.81% no executable attachments allowed
      4  0.12% keep your viruses for yourself (ZIP)
      2  0.06% spam 0x20970005
      2  0.06% X-SA-Do-Not-Rej
      1  0.03% message content rejected
Rejected bodies:
     15 100.00% keep your viruses for yourself (hidden iframe)
Rejected HELO commands:
2031756 35.68% generic HELO hostname
1874745 32.92% unqualified HELO hostname
1616955 28.39% IP literal in HELO hostname
  95648  1.68% forged HELO hostname
  57121  1.00% Invalid name
  18214  0.32% fake IP literal in HELO hostname
    301  0.01% using my own HELO hostname
Popular DNSBL listings:
    880 45.64% SBL 64156
    321 16.65% SBL 64155
    200 10.37% SBL 64741
    150  7.78% SBL 49032
    110  5.71% SBL 60223
    101  5.24% SBL 57412
    166  8.61% others (22 different)
Popular local source-based rejections:
  91013 47.06% we do not accept mail from dynamically-assigned addresses
  45962 23.76% Too much spam from CHINANET
  30723 15.88% non accettiamo posta da IP dinamici
  24819 12.83% too much spam from this network
    707  0.37% Too much spam from 
chinamobile.com
    149  0.08% Too much spam from China Railways
     38  0.02% Too much spam from 
gwbn.net.cn
Most rejected networks:
 204247  2.87% 
88.224.0.0/12
 166874  2.35% 
78.160.0.0/11
  83070  1.17% 
88.240.0.0/13
  67248  0.95% 
85.96.0.0/13
  58920  0.83% 
92.112.0.0/15
  53290  0.75% 
85.104.0.0/14
  48976  0.69% 
88.248.0.0/14
  44271  0.62% 
91.76.0.0/14
  42880  0.60% 
81.212.0.0/14
  37401  0.53% 
190.42.0.0/16
  36109  0.51% 
85.140.0.0/15
  35275  0.50% 
77.122.0.0/15
  34110  0.48% 
121.128.0.0/10
  31284  0.44% 
83.0.0.0/11
  30837  0.43% 
91.124.0.0/16
  29469  0.41% 
88.252.0.0/15
  26726  0.38% 
77.30.0.0/16
  25360  0.36% 
85.108.0.0/14
  23871  0.34% 
124.120.0.0/15
  22408  0.31% 
58.8.0.0/14
  21955  0.31% 
89.120.0.0/14
  21559  0.30% 
79.0.0.0/11
  21379  0.30% 
92.80.0.0/15
  20984  0.29% 
77.126.0.0/15
  20851  0.29% 
41.249.0.0/16
  20694  0.29% 
77.121.0.0/16
  19883  0.28% 
79.176.0.0/13
  19250  0.27% 
86.128.0.0/10
  19014  0.27% 
77.192.0.0/12
  18373  0.26% 
78.106.0.0/15
  18221  0.26% 
85.72.0.0/14
  17641  0.25% 
78.0.0.0/14
  17305  0.24% 
89.178.0.0/15
  17186  0.24% 
59.0.0.0/11
  16632  0.23% 
86.128.0.0/12
  16460  0.23% 
84.124.0.0/14
  16417  0.23% 
190.48.0.0/14
  16020  0.23% 
87.0.0.0/12
  16008  0.22% 
84.108.0.0/15
  15808  0.22% 
84.56.0.0/13
  15504  0.22% 
88.0.0.0/11
  15501  0.22% 
77.31.0.0/17
  15171  0.21% 
91.122.0.0/16
  14604  0.21% 
86.0.0.0/11
  14512  0.20% 
78.56.0.0/13
  14030  0.20% 
88.254.0.0/16
  13790  0.19% 
88.64.0.0/12
  13577  0.19% 
82.0.0.0/13
  13525  0.19% 
93.80.0.0/15
  13513  0.19% 
89.136.0.0/15
  13437  0.19% 
217.132.0.0/16
  13263  0.19% 
85.136.0.0/15
  12611  0.18% 
79.128.0.0/14
  12573  0.18% 
83.237.0.0/16
  12517  0.18% 
201.250.0.0/15
  12235  0.17% 
87.16.0.0/13
  12185  0.17% 
77.31.0.0/16
  12151  0.17% 
86.64.0.0/12
  11547  0.16% 
212.33.224.0/19
  11501  0.16% 
78.36.0.0/15
  11403  0.16% 
79.164.0.0/15
  11010  0.15% 
201.254.0.0/15
  10948  0.15% 
201.50.0.0/16
  10882  0.15% 
84.121.0.0/16
  10698  0.15% 
77.28.0.0/15
  10388  0.15% 
82.76.0.0/14
  10113  0.14% 
82.207.0.0/17
  10073  0.14% 
77.0.0.0/12
  10065  0.14% 
89.138.0.0/15
  10056  0.14% 
190.172.0.0/14
   9973  0.14% 
41.251.0.0/16
   9888  0.14% 
85.108.0.0/16
   9718  0.14% 
201.240.128.0/17
   9531  0.13% 
79.144.0.0/14
   9491  0.13% 
189.70.0.0/16
   9462  0.13% 
77.241.32.0/21
   9279  0.13% 
80.32.0.0/13
   9115  0.13% 
124.104.0.0/14
   9106  0.13% 
123.16.0.0/13
   9075  0.13% 
222.252.0.0/14
   8875  0.12% 
84.122.0.0/15
   8778  0.12% 
71.160.0.0/12
   8778  0.12% 
189.30.0.0/15
   8741  0.12% 
196.205.128.0/17
   8692  0.12% 
201.51.0.0/16
   8599  0.12% 
116.16.0.0/12
   8594  0.12% 
89.218.0.0/16
   8500  0.12% 
87.202.0.0/15
   8491  0.12% 
190.40.64.0/18
   8438  0.12% 
92.46.0.0/15
   8395  0.12% 
189.13.0.0/16
   8383  0.12% 
189.18.0.0/15
   8372  0.12% 
41.250.0.0/16
   8272  0.12% 
78.96.0.0/15
   8239  0.12% 
125.128.0.0/11
   8218  0.12% 
92.0.0.0/12
   8215  0.12% 
79.80.0.0/12
   8176  0.11% 
217.216.0.0/15
   8124  0.11% 
190.43.0.0/17
   8035  0.11% 
89.64.0.0/12
   7999  0.11% 
84.96.0.0/13
   7974  0.11% 
201.58.0.0/16
   7923  0.11% 
86.102.0.0/16
   7744  0.11% 
41.248.0.0/16
   7699  0.11% 
89.128.0.0/14
   7563  0.11% 
86.57.128.0/17
   7423  0.10% 
62.42.0.0/15
   7363  0.10% 
61.72.0.0/13
   7303  0.10% 
200.180.0.0/15
   7232  0.10% 
84.76.0.0/14
   7232  0.10% 
122.164.128.0/17
   7205  0.10% 
122.32.0.0/12
   7127  0.10% 
81.202.0.0/15
   7118  0.10% 
201.223.0.0/16
   7108  0.10% 
78.132.128.0/17
   7089  0.10% 
81.192.0.0/17
   6939  0.10% 
77.248.0.0/14
   6938  0.10% 
89.28.0.0/17
   6921  0.10% 
62.221.64.0/18
   6884  0.10% 
212.233.64.0/18
   6880  0.10% 
190.20.0.0/15
   6814  0.10% 
189.81.0.0/16
   6774  0.10% 
78.93.0.0/16
   6626  0.09% 
59.112.0.0/12
   6572  0.09% 
77.51.64.0/18
   6547  0.09% 
89.190.224.0/19
   6524  0.09% 
86.60.0.0/17
   6434  0.09% 
79.139.128.0/17
   6359  0.09% 
122.163.128.0/17
   6352  0.09% 
122.167.0.0/17
   6326  0.09% 
125.112.0.0/12
   6321  0.09% 
89.216.64.0/18
   6292  0.09% 
58.224.0.0/12
   6290  0.09% 
89.31.88.0/21
   6258  0.09% 
78.37.128.0/17
   6234  0.09% 
151.48.0.0/13
   6160  0.09% 
87.237.112.0/21
   6138  0.09% 
92.83.0.0/16
   6135  0.09% 
201.233.0.0/16
   6124  0.09% 
87.220.0.0/15
   6067  0.09% 
203.124.56.0/21
   6052  0.09% 
221.144.0.0/12
   6040  0.08% 
201.66.0.0/15
   6009  0.08% 
82.24.0.0/13
   6006  0.08% 
88.104.0.0/13
4699161 66.04% others (23589 different)
Most rejected AS:
 754969 10.61% 9121
 146032  2.05% 6147
 138127  1.94% 7738
 136521  1.92% 4766
 120370  1.69% 4134
 106113  1.49% 8359
 102273  1.44% 6849
  89097  1.25% 3269
  76601  1.08% 6713
  75228  1.06% 8167
  73996  1.04% 9498
  72093  1.01% 27699
  71271  1.00% 9829
  66552  0.94% 25019
  66443  0.93% 4837
  66307  0.93% 9050
  65741  0.92% 3352
  64248  0.90% 19262
  59750  0.84% 6739
  59197  0.83% 8402
  56663  0.80% 25229
  54727  0.77% 5089
  52996  0.74% 0
  50966  0.72% 22927
  50634  0.71% 7470
  48829  0.69% 2856
  48509  0.68% 9198
  47726  0.67% 15557
  46124  0.65% 8997
  45600  0.64% 8551
  44878  0.63% 3209
  44042  0.62% 9318
  43590  0.61% 5617
  42461  0.60% 16338
  41700  0.59% 6799
  41222  0.58% 28573
  40445  0.57% 6830
  37179  0.52% 6746
  35597  0.50% 9116
  34231  0.48% 4755
  33976  0.48% 7418
  30384  0.43% 4788
  29885  0.42% 17974
  29621  0.42% 9299
  29470  0.41% 1680
  27957  0.39% 10318
  27296  0.38% 24863
  26635  0.37% 22047
  25978  0.37% 5391
  25798  0.36% 3215
  25617  0.36% 17858
  24960  0.35% 3216
  24379  0.34% 4230
  24142  0.34% 16010
  23601  0.33% 3462
  23599  0.33% 18101
  23167  0.33% 6805
  23094  0.32% 8615
  23066  0.32% 5462
  22934  0.32% 12332
  22485  0.32% 1267
  21582  0.30% 8708
  20019  0.28% 4713
  19906  0.28% 25233
  19638  0.28% 25405
  19569  0.28% 7643
  18986  0.27% 9143
  18763  0.26% 3320
  18752  0.26% 8151
  17905  0.25% 31042
  17673  0.25% 7132
  17440  0.25% 38951
  17288  0.24% 8764
  17144  0.24% 18403
  17069  0.24% 19090
  16450  0.23% 19429
  16248  0.23% 12479
  16167  0.23% 12683
  16027  0.23% 5610
  15572  0.22% 9583
  15466  0.22% 12880
  15261  0.21% 20485
  15216  0.21% 6703
  15110  0.21% 6821
  14931  0.21% 20838
  14793  0.21% 6697
  14658  0.21% 6400
  14344  0.20% 10481
  14012  0.20% 25515
  13913  0.20% 3292
  13623  0.19% 4812
  13329  0.19% 31252
  13223  0.19% 28812
  13167  0.19% 8065
  13068  0.18% 25490
  12889  0.18% 6828
  12367  0.17% 9141
  12286  0.17% 9105
  12236  0.17% 33774
  12228  0.17% 8732
  12202  0.17% 21479
  12012  0.17% 12705
  11982  0.17% 21021
  11760  0.17% 10620
  11665  0.16% 12876
  11641  0.16% 20115
  11628  0.16% 4808
  11547  0.16% 12768
  11251  0.16% 9155
  11239  0.16% 7303
  11225  0.16% 3816
  11167  0.16% 3239
  11122  0.16% 21502
  11037  0.16% 6057
  10887  0.15% 12741
  10886  0.15% 12715
  10860  0.15% 3786
  10851  0.15% 8584
  10445  0.15% 18881
  10423  0.15% 4775
  10406  0.15% 28719
   9612  0.14% 8342
   9592  0.13% 21453
   9556  0.13% 17488
   9439  0.13% 8048
   9356  0.13% 6332
   9320  0.13% 15500
   9182  0.13% 12334
   9171  0.13% 1547
   9095  0.13% 36947
   9043  0.13% 21017
   9024  0.13% 16287
   8963  0.13% 13184
   8870  0.12% 35154
   8788  0.12% 8866
   8761  0.12% 44038
   8539  0.12% 5384
   8351  0.12% 20852
   8218  0.12% 43234
   8128  0.11% 12714
   8042  0.11% 3249
2214785 31.13% others (5385 different)
-- 
ciao,
Marco

 Queste sono le statistiche aggregate dello spam rifiutato 
ma quanto pesa sul totale?
Sul mio personalissimo traffico ho notato un crollo negli ultimi due mesi.
Sugli stessi account il traffico legittimo è pressoché costante (lista 
bianca+non spam), mentre lo spam verificato ha avuto questo andamento:
gennaio 74.5%, febbraio 77.1%, marzo 76.5%, aprile 30.8%, maggio 33.3%
Altri hanno avuto la stessa variazione?
Siccome non ho notizia di particolari rivoluzioni, propendo per l'ipotesi 
che i provider, su cui sono ospitati quei miei account che da contratto 
non hanno filtri antispam, abbiano comunque applicato un filtro di primo 
livello per lo spam più evidente, a monte degli account.
-- 
Sans