Newsgroup: it.news.net-abuse
Titolo: [STATISTICHE] spam rifiutato da attila.bofh.it (aprile 2008)

Queste sono le statistiche aggregate dello spam rifiutato da
attila.bofh.it
 tra queste date:
Apr 13 06:53:17
May 11 06:56:53
Al momento della generazione di queste statistiche, il server era
protetto (nell'ordine) da queste DNSBL:
ip.private-dnsbl.bofh.it
zen.spamhaus.org
list.dsbl.org
combined.njabl.org
bhnc.njabl.org
dul.dnsbl.sorbs.net
4994229 79.83% Bad HELO
 967960 15.47% DNSBL pbl+
xbl.spamhaus.org
 213996  3.42% Client host rejected
  53007  0.85% DNSBL 
ip.private-dnsbl.bofh.it
   6001  0.10% Relay access denied
   5904  0.09% DNSBL 
dul.dnsbl.sorbs.net
   3947  0.06% DNSBL 
list.dsbl.org
   3664  0.06% header checks
   2305  0.04% DNSBL 
rhs.private-dnsbl.bofh.it
   1607  0.03% Recipient address rejected
    863  0.01% Bad pipelining (Client host)
    827  0.01% Sender address rejected
    477  0.01% DNSBL 
sbl.spamhaus.org
    381  0.01% Need FQDN address
    278  0.00% DNSBL 
bhnc.njabl.org
    255  0.00% DNSBL 
combined.njabl.org
    230  0.00% Bad pipelining (Helo command)
     16  0.00% body checks
      3  0.00% Bad pipelining (Data command)
      3  0.00% Multi-recipient bounce
6255953        TOTAL
Rejected headers:
   3445 94.02% spam 0x20970004
    104  2.84% Your mailer is not RFC 2047 compliant
     91  2.48% spam 0x20970005
     22  0.60% no executable attachments allowed
      2  0.05% keep your viruses for yourself (ZIP)
Rejected bodies:
     16 100.00% keep your viruses for yourself (hidden iframe)
Rejected HELO commands:
1658207 33.20% IP literal in HELO hostname
1593025 31.90% generic HELO hostname
1543287 30.90% unqualified HELO hostname
 112117  2.24% Invalid name
  76855  1.54% forged HELO hostname
  10344  0.21% fake IP literal in HELO hostname
    394  0.01% using my own HELO hostname
Popular DNSBL listings:
    150 31.45% SBL 49032
    142 29.77% SBL 64546
    185 38.78% others (25 different)
Popular local source-based rejections:
 111058 51.90% Too much spam from CHINANET
  71038 33.20% we do not accept mail from dynamically-assigned addresses
  20692  9.67% too much spam from this network
   8478  3.96% non accettiamo posta da IP dinamici
   2319  1.08% Too much spam from 
chinamobile.com
    253  0.12% Too much spam from China Railways
    158  0.07% Too much spam from 
gwbn.net.cn
Most rejected networks:
 172135  2.75% 
88.224.0.0/12
 168615  2.70% 
121.128.0.0/10
 120883  1.93% 
78.160.0.0/11
  80139  1.28% 
59.0.0.0/11
  75603  1.21% 
85.96.0.0/13
  72336  1.16% 
88.240.0.0/13
  50858  0.81% 
85.104.0.0/14
  48322  0.77% 
222.96.0.0/12
  47872  0.77% 
77.30.0.0/16
  43855  0.70% 
58.224.0.0/12
  39058  0.62% 
211.208.0.0/13
  38561  0.62% 
221.144.0.0/12
  37461  0.60% 
91.76.0.0/14
  36307  0.58% 
85.140.0.0/15
  36246  0.58% 
81.212.0.0/14
  35316  0.56% 
218.144.0.0/12
  34412  0.55% 
92.112.0.0/15
  32340  0.52% 
190.42.0.0/16
  31094  0.50% 
125.128.0.0/11
  28889  0.46% 
125.176.0.0/12
  28493  0.46% 
124.48.0.0/12
  28139  0.45% 
123.16.0.0/13
  27575  0.44% 
77.31.0.0/17
  26629  0.43% 
88.248.0.0/14
  25555  0.41% 
222.232.0.0/13
  23215  0.37% 
211.224.0.0/13
  23101  0.37% 
220.72.0.0/13
  22406  0.36% 
211.192.0.0/13
  21981  0.35% 
88.252.0.0/15
  21813  0.35% 
58.8.0.0/14
  21529  0.34% 
220.80.0.0/12
  21501  0.34% 
78.93.0.0/16
  21182  0.34% 
83.0.0.0/11
  19670  0.31% 
61.72.0.0/13
  19524  0.31% 
86.128.0.0/10
  18565  0.30% 
124.120.0.0/15
  18408  0.29% 
122.32.0.0/12
  17740  0.28% 
211.216.0.0/13
  17525  0.28% 
86.60.0.0/17
  16834  0.27% 
77.31.0.0/16
  16569  0.27% 
91.124.0.0/16
  16276  0.26% 
77.122.0.0/15
  16263  0.26% 
211.200.0.0/13
  15932  0.25% 
222.112.0.0/13
  15900  0.25% 
190.48.0.0/14
  15645  0.25% 
220.120.0.0/13
  15386  0.25% 
196.205.128.0/17
  15344  0.25% 
116.16.0.0/12
  14959  0.24% 
77.126.0.0/15
  14669  0.23% 
91.122.0.0/16
  14488  0.23% 
221.160.0.0/13
  13763  0.22% 
125.112.0.0/12
  13671  0.22% 
222.252.0.0/14
  13510  0.22% 
92.80.0.0/15
  13224  0.21% 
88.254.0.0/16
  13007  0.21% 
58.187.64.0/18
  12839  0.21% 
201.240.128.0/17
  12765  0.20% 
218.236.0.0/14
  12547  0.20% 
85.108.0.0/14
  12448  0.20% 
84.108.0.0/15
  12141  0.19% 
118.32.0.0/12
  11944  0.19% 
79.176.0.0/13
  11764  0.19% 
78.106.0.0/15
  11707  0.19% 
220.116.0.0/14
  11571  0.19% 
79.0.0.0/11
  11184  0.18% 
83.237.0.0/16
  10683  0.17% 
84.56.0.0/13
  10646  0.17% 
190.40.224.0/19
  10332  0.17% 
78.56.0.0/13
  10225  0.16% 
89.120.0.0/14
   9978  0.16% 
85.72.0.0/14
   9600  0.15% 
121.16.0.0/12
   9524  0.15% 
116.32.0.0/12
   9087  0.15% 
77.45.128.0/17
   8905  0.14% 
219.248.0.0/14
   8859  0.14% 
89.178.0.0/15
   8824  0.14% 
218.50.0.0/15
   8775  0.14% 
221.138.0.0/15
   8614  0.14% 
122.167.0.0/17
   8608  0.14% 
86.0.0.0/11
   8536  0.14% 
218.101.128.0/17
   8364  0.13% 
165.132.0.0/16
   8124  0.13% 
221.140.0.0/14
   8063  0.13% 
87.16.0.0/13
   7935  0.13% 
201.233.0.0/16
   7714  0.12% 
201.254.0.0/15
   7619  0.12% 
190.40.64.0/18
   7617  0.12% 
60.0.0.0/12
   7601  0.12% 
87.0.0.0/12
   7538  0.12% 
88.0.0.0/11
   7518  0.12% 
58.120.0.0/13
   7508  0.12% 
211.104.0.0/14
   7411  0.12% 
211.176.0.0/14
   7325  0.12% 
60.176.0.0/12
   7301  0.12% 
58.187.128.0/18
   7231  0.12% 
220.70.0.0/15
   7182  0.11% 
78.37.128.0/17
   7142  0.11% 
123.212.0.0/14
   7109  0.11% 
122.162.0.0/17
   7020  0.11% 
189.30.0.0/15
   6964  0.11% 
222.120.0.0/15
   6960  0.11% 
190.90.48.0/22
   6870  0.11% 
93.80.0.0/15
   6858  0.11% 
219.128.0.0/13
   6821  0.11% 
122.164.128.0/17
   6802  0.11% 
122.161.0.0/17
   6696  0.11% 
190.172.0.0/14
   6684  0.11% 
124.128.0.0/13
   6678  0.11% 
80.64.80.0/20
   6671  0.11% 
124.153.128.0/17
   6666  0.11% 
90.188.192.0/19
   6663  0.11% 
89.136.0.0/15
   6656  0.11% 
60.208.0.0/13
   6641  0.11% 
222.184.0.0/13
   6542  0.10% 
77.64.0.0/17
   6482  0.10% 
60.160.0.0/11
   6423  0.10% 
85.108.0.0/16
   6421  0.10% 
86.128.0.0/12
   6398  0.10% 
195.131.0.0/16
   6389  0.10% 
81.195.0.0/16
   6298  0.10% 
201.51.0.0/16
   6272  0.10% 
59.32.0.0/13
   6268  0.10% 
121.224.0.0/12
   6215  0.10% 
86.64.0.0/12
   6166  0.10% 
201.50.0.0/16
   6159  0.10% 
84.52.64.0/18
   6144  0.10% 
62.42.0.0/15
   6126  0.10% 
84.124.0.0/14
   6078  0.10% 
81.202.0.0/15
   6059  0.10% 
210.222.0.0/15
3741482 59.84% others (20650 different)
Most rejected AS:
 671258 10.74% 4766
 615367  9.84% 9121
 289485  4.63% 9318
 240994  3.85% 4134
 159473  2.55% 6147
 147330  2.36% 4837
 101362  1.62% 25019
  97610  1.56% 8359
  93342  1.49% 17858
  82466  1.32% 9498
  74817  1.20% 7738
  57660  0.92% 6849
  53633  0.86% 25233
  50319  0.80% 9829
  45318  0.72% 3269
  44315  0.71% 24863
  43014  0.69% 7643
  42642  0.68% 27699
  41595  0.67% 7470
  40705  0.65% 8167
  39404  0.63% 2856
  36987  0.59% 8402
  35773  0.57% 8997
  35678  0.57% 22927
  34122  0.55% 9198
  33186  0.53% 5089
  32506  0.52% 6739
  32301  0.52% 18403
  31637  0.51% 9050
  31379  0.50% 5617
  30264  0.48% 3216
  26785  0.43% 8551
  26480  0.42% 6830
  25708  0.41% 6713
  24805  0.40% 19262
  24649  0.39% 3352
  24419  0.39% 3786
  24128  0.39% 4755
  23124  0.37% 0
  22818  0.36% 7418
  22790  0.36% 4808
  22057  0.35% 16338
  21967  0.35% 28573
  21470  0.34% 3209
  21115  0.34% 19429
  21004  0.34% 3816
  20898  0.33% 25229
  20075  0.32% 6799
  20067  0.32% 4788
  19730  0.32% 10318
  18944  0.30% 3462
  18319  0.29% 9116
  18100  0.29% 4812
  17832  0.29% 22047
  17323  0.28% 15557
  16874  0.27% 6746
  16266  0.26% 1267
  16194  0.26% 18678
  15955  0.26% 9155
  15362  0.25% 5462
  15043  0.24% 12332
  14495  0.23% 8708
  14158  0.23% 8764
  14055  0.22% 12479
  13193  0.21% 12705
  13058  0.21% 17864
  12600  0.20% 8615
  12521  0.20% 10036
  12451  0.20% 8065
  12241  0.20% 25490
  11538  0.18% 3320
  11173  0.18% 3239
  11133  0.18% 8732
  11034  0.18% 4713
  10779  0.17% 5610
  10773  0.17% 18101
  10650  0.17% 6805
  10579  0.17% 8382
  10264  0.16% 28719
  10170  0.16% 25515
   9990  0.16% 3215
   9833  0.16% 17488
   9772  0.16% 21017
   9686  0.15% 4230
   9669  0.15% 8151
   9513  0.15% 38951
   9500  0.15% 9689
   9451  0.15% 10620
   9270  0.15% 6828
   9224  0.15% 35154
   9161  0.15% 5391
   9157  0.15% 20632
   9069  0.15% 31094
   9013  0.14% 9299
   8977  0.14% 6690
   8903  0.14% 10481
   8868  0.14% 17813
   8816  0.14% 19090
   8686  0.14% 7132
   8603  0.14% 9105
   8486  0.14% 18310
   8473  0.14% 28812
   8426  0.13% 16287
   8364  0.13% 4665
   8321  0.13% 9943
   8246  0.13% 6400
   8182  0.13% 9694
   8120  0.13% 8345
   8102  0.13% 21502
   8095  0.13% 1680
   8024  0.13% 3249
   8014  0.13% 25405
1755151 28.07% others (5026 different)
-- 
ciao,
Marco


ix.dnsbl.manitu.net
, no ?
Non l'ho mai sentita, e immagino che ci sia un motivo.
-- 
ciao, |
Marco |  The Italian Usenet Cabal, Abuse Department (TINC)
"It's about damn time that all of us who actually give a damn about Usenet
stand up and tell the people who don't to fuck off and die." -- Russ Allbery

 
ix.dnsbl.manitu.net
, no ?
non conosco.
c'č da fidarsi?
falsi positivi?
chi la usa?
Si seguito alcune mie stats
Gerolamo
from    ['May', '4', '06:49:50']
to      ['May', '11', '06:50:51']
  80444 DNSBL 
pbl.spamhaus.org
;
  41536 Need FQDN address (recipient)
  35065 DNSBL 
xbl.spamhaus.org
;
  20078 Sender address rejected
   5624 Relay access denied
   2980 Recipient address rejected
   1557 Helo command rejected
    734 DNSBL 
list.dsbl.org
;
    404 DNSBL 
dul.dnsbl.sorbs.net
;
    227 DNSBL 
bl.spamcop.net
;
    207 DNSBL 
sbl.spamhaus.org
;
     75 DNSBL 
bhnc.njabl.org
;
     20 DNSBL 
dnsbl.njabl.org
;
     10 Server configuration problem
      3 Message size exceeds fixed limit
      1 attachment type not allowed
 188965 TOTAL FILTERED MAIL
 117176 TOTAL DNSBL FILTERED MAIL (62.01 %)
   7904 TOTAL GREYLISTING DELAYS
  17508 TOTAL POSTED MAIL ON 206473 ATTEMPTS (8.48 %)
  17508 TOTAL POSTED MAIL ON 214377 ATTEMPTS (INCLUDE GREYLISTING) (8.17 %)
** Most Blocked Sender IPs - Top 15 **
   2509  1.274%    195.94.179.220
   2305  1.171%    82.141.233.52
   2029  1.031%    202.175.244.202
   1274  0.647%    196.12.181.26
   1228  0.624%    67.105.40.34
    734  0.373%    83.220.199.73
    538  0.273%    218.55.16.21
    484  0.246%    211.187.54.123
    443  0.225%    80.67.102.118
    434  0.220%    117.13.15.145
    431  0.219%    222.127.53.153
    392  0.199%    12.154.97.254
    390  0.198%    208.13.131.211
    384  0.195%    62.20.104.130
    335  0.170%    79.202.218.157
** Most Blocked Mail by Sender Domain - Top 20 **
   4145  2.105%    
agenziebancaroma.it
   2896  1.471%    
aol.com
   2671  1.357%    
hotmail.com
   2629  1.335%    
icqmail.com
   2614  1.328%    
yahoo.com
   2541  1.291%    
gmail.com
   2509  1.274%    
easymail3.molecole.com
   2470  1.255%    
free.fr
   2445  1.242%    
ebay.com.it
   2330  1.184%    
libero.it
   2305  1.171%    xserve.xserve
   2294  1.165%    
msn.com
   2290  1.163%    
wanadoo.fr
   2266  1.151%    
online.fr
   2264  1.150%    
ebay.com
   2256  1.146%    
yahoo.com.tw
   2248  1.142%    
wanadoo.nl
   2244  1.140%    
iwon.com
   2234  1.135%    
excite.com
   2215  1.125%    
yahoo.de
** Most Blocked Mail by Sender Country > 0.1% **
  19121  9.713%    TURKEY
  15399  7.822%    RUSSIAN FEDERATION
  14290  7.259%    CHINA
  13634  6.925%    UNITED STATES
  12189  6.191%    KOREA REPUBLIC OF
   8773  4.456%    ITALY
   8540  4.338%    GERMANY
   8052  4.090%    BRAZIL
   7126  3.620%    SPAIN
   6013  3.054%    UNITED KINGDOM
   5137  2.609%    POLAND
   5094  2.588%    INDIA
   4306  2.187%    ROMANIA
   3645  1.851%    ARGENTINA
   3625  1.841%    UKRAINE
   3095  1.572%    FRANCE
   3048  1.548%    NETHERLANDS
   2709  1.376%    PERU
   2526  1.283%    YEMEN
   2381  1.209%    COLOMBIA
   2347  1.192%    EUROPEAN UNION
   2217  1.126%    CHILE
   2205  1.120%    SWEDEN
   2064  1.048%    ISRAEL
   2053  1.043%    MACAU
   1795  0.912%    GREECE
   1568  0.796%    THAILAND
   1517  0.771%    MEXICO
   1448  0.736%    TAIWAN PROVINCE OF CHINA
   1418  0.720%    PUERTO RICO
   1192  0.605%    PHILIPPINES
   1185  0.602%    PORTUGAL
   1114  0.566%    JAPAN
   1109  0.563%    SWITZERLAND
   1089  0.553%    CZECH REPUBLIC
   1085  0.551%    KAZAKHSTAN
    916  0.465%    MALAYSIA
    863  0.438%    no country detected
    849  0.431%    NORWAY
    831  0.422%    BULGARIA
    828  0.421%    AUSTRALIA
    827  0.420%    VIET NAM
    816  0.414%    LATVIA
    809  0.411%    CROATIA (local name: Hrvatska)
    773  0.393%    HUNGARY
    767  0.390%    MOROCCO
    748  0.380%    DENMARK
    733  0.372%    SAUDI ARABIA
    720  0.366%    IRAN (ISLAMIC REPUBLIC OF)
    679  0.345%    AUSTRIA
    673  0.342%    CANADA
    501  0.254%    VENEZUELA
    498  0.253%    SLOVAKIA (Slovak Republic)
    488  0.248%    EGYPT
    453  0.230%    MACEDONIA THE FORMER YUGOSLAV REPUBLIC OF
    428  0.217%    BELGIUM
    417  0.212%    FINLAND
    398  0.202%    INDONESIA
    393  0.200%    LITHUANIA
    345  0.175%    HONG KONG
    337  0.171%    SOUTH AFRICA
    326  0.166%    RESERVED
    311  0.158%    IRELAND
    298  0.151%    SINGAPORE
    280  0.142%    PALESTINIAN TERRITORY OCCUPIED
    275  0.140%    UNITED ARAB EMIRATES
    266  0.135%    ESTONIA
    261  0.133%    GEORGIA
    240  0.122%    SYRIAN ARAB REPUBLIC
    212  0.108%    SLOVENIA
    207  0.105%    Serbia and Montenegro
    205  0.104%    NEW ZEALAND
    203  0.103%    URUGUAY


La usi ? sai che IP spammanti potrebbe contenere che non siano in ZEN,
list.dsbl.org
, 
dnsbl.njabl.org
 ?
Ho letto la descrizione in home page, ma non ho capito se funziona
tipo SpamCop in base a spamtrap e sottomissione di campioni di spam da
parte degli utenti, o come.
Gabriele

automaticamente dalla lista
Inusabile se non amatorialmente.


 
mah.. mi ha fatto un falso positivo su una 60 di controlli.. cosa succede se:
-io mi iscrivo a una newsletter mettendo come email una di quelle utilizzate 
come spamtrap
-il server manda la richiesta di conferma a tale email
?
Il server finisce difilato in blacklist (anche se solo per 3 giorni)?
-- 
Roberto Tagliaferri-Linux user #30785 <-> r.tagliaferri@(forse)
tosnet.it
Writing about music is like dancing about architecture.
		-- Frank Zappa

 Il server finisce difilato in blacklist (anche se solo per 3 giorni)?
Dovrebbe rientrare in "And in most cases our filter has to detect more
than one unwanted email from the same IP...", spero :)
Il tuo falso positivo cosa riguardava ?
E comunque dovresti sapere le spamtraps per finirci per errore, o per
farci finire qualcuno.
A proposito di gestione newsletter, noto che sono un sistema utile per
beccare al volo indirizzi fasulli usati per phishing. In pratica, mi
trovo errori di deliverability per bots che hanno memorizzato da web
indirizzi usati per le iscrizioni e mettono come from roba tipo
"clienti*
poste.it
* e simili :)
Gabriele

 Gabriele
-- 
Roberto Tagliaferri-Linux user #30785 <-> r.tagliaferri@(forse)
tosnet.it
If you think last Tuesday was a drag, wait till you see what happens
tomorrow!

 farci finire qualcuno.
Già, ma il "qualcuno" può anche essere un qualsiasi autoresponder, per 
dire...

 
ok, grazie.. senza google traslator sarebbe una pratica inutile
-- 
Roberto Tagliaferri-Linux user #30785 <-> r.tagliaferri@(forse)
tosnet.it
When asked by an anthropologist what the Indians called America before
the white men came, an Indian said simply "Ours."
		-- Vine Deloria, Jr.

mail servers that can't make it on the list even if they 
Sospetto che non siano abbastanza.


 non avere ancora un campione significativo
Allora continua il test e poi facci sapere :)
tnx,
Gabriele
--
Uno spammer/flooder mi ha querelato:
http://www.gabrielepolidori.eu/raccoltafondi.html

 
Oopppsss
Latest spam received via 
mail.ixlab.de
 at Mon, 12 May 2008 09:03:22 +0200
-- 
Roberto Tagliaferri-Linux user #30785 <-> r.tagliaferri@(forse)
tosnet.it
Bank error in your favor.  Collect $200.