Newsgroup: it.news.net-abuse
Titolo: [STATISTICHE] spam rifiutato da attila.bofh.it (marzo 2007)

Queste sono le statistiche aggregate dello spam rifiutato da
attila.bofh.it
 tra queste date:
Mar 4 06:49:10
Apr 1 06:48:58
Al momento della generazione di queste statistiche, il server era
protetto (nell'ordine) da queste DNSBL:
ip.private-dnsbl.bofh.it
zen.spamhaus.org
list.dsbl.org
combined.njabl.org
dul.dnsbl.sorbs.net
 228863 65.48% Bad HELO
  61113 17.49% Client host rejected
  39331 11.25% DNSBL 
xbl.spamhaus.org
   5325  1.52% DNSBL 
ip.private-dnsbl.bofh.it
   3900  1.12% header checks
   3489  1.00% Relay access denied
   3171  0.91% DNSBL 
dul.dnsbl.sorbs.net
   1367  0.39% Bad pipelining (Client host)
    714  0.20% DNSBL 
list.dsbl.org
    631  0.18% DNSBL 
rhs.private-dnsbl.bofh.it
    574  0.16% Recipient address rejected
    326  0.09% Bad pipelining (Helo command)
    298  0.09% DNSBL 
sbl.spamhaus.org
    120  0.03% Sender address rejected
    116  0.03% DNSBL 
combined.njabl.org
    111  0.03% Need FQDN address
     25  0.01% body checks
      9  0.00% Need FQDN address (recipient)
      6  0.00% Bad pipelining (Data command)
      4  0.00% Multi-recipient bounce
 349493        TOTAL
Rejected headers:
   2619 67.15% keep your viruses for yourself (ZIP)
   1036 26.56% no executable attachments allowed
    200  5.13% Your mailer is not RFC 2047 compliant
     26  0.67% Gibe-F/Swen.A worm
      8  0.21% troppo spam dalla webmail di TIN
      6  0.15% message content rejected
      4  0.10% do not send stupid bounces
      1  0.03% suspicious attachment
Rejected bodies:
     25 100.00% keep your viruses for yourself (hidden iframe)
Rejected HELO commands:
 116702 50.99% unqualified HELO hostname
  62673 27.38% generic HELO hostname
  21996  9.61% IP literal in HELO hostname
  13684  5.98% using my own HELO hostname
  11271  4.92% fake IP literal in HELO hostname
   2036  0.89% forged HELO hostname
    501  0.22% Invalid name
Popular DNSBL listings:
     81 27.18% SBL 43951
    217 72.82% others (45 different)
Popular local source-based rejections:
  50196 82.14% we do not accept mail from dynamically-assigned addresses
   4368  7.15% too much spam from this network
   3334  5.46% Too much spam from CHINANET
   3134  5.13% non accettiamo posta da IP dinamici
     61  0.10% Too much spam from China Railways
     14  0.02% Too much spam from 
chinamobile.com
      6  0.01% Too much spam from 
gwbn.net.cn
Most rejected networks:
   9355  2.71% 
83.0.0.0/11
 336213 97.29% others (12167 different)
Most rejected AS:
  19415  5.62% 19262
  13432  3.89% 3269
  10635  3.08% 5617
 302086 87.42% others (2876 different)
-- 
ciao,
Marco

    298  0.09% DNSBL 
sbl.spamhaus.org
e 
pbl.spamhaus.org
?
a me blocca circa il doppio di xbl
sarei curioso di sapere che fa su un server più "grosso"...
-- 
Gerolamo 

Gerolamo ha scritto:

queste sono 4 settimane del mio server:
  476774 68.47% DNSBL 
xbl.spamhaus.org
  139865 20.09% Bad HELO
   44896  6.45% Recipient address rejected
   17337  2.49% DNSBL 
safe.dnsbl.sorbs.net
    9788  1.41% Relay access denied
    4669  0.67% DNSBL 
sbl.spamhaus.org
    1581  0.23% DNSBL 
list.dsbl.org
     744  0.11% DNSBL 
dnsbl.njabl.org
     491  0.07% body checks
     196  0.03% header checks
      13  0.00% DNSBL hosts.blocked.rbl
       4  0.00% Other
  696358        TOTAL
con queste rbl:
zen.spamhaus.org
,
safe.dnsbl.sorbs.net
,
list.dsbl.org
,
dnsbl.njabl.org
-- 
Roberto Tagliaferri-Linux user #30785 <-> r.tagliaferri@(forse)
tosnet.it
Ci sedemmo dalla parte del torto, visto che tutti gli altri posti
erano occupati.
		-- Bertold Brecht

 
zen.spamhaus.org
,
e vabbè... ma allora fate apposta :)
e pbl?
Consiglio di variare lo script (se è ancora quello che avevo visto io) da:
#  if ($bl eq '
sbl-xbl.spamhaus.org
') {
#  $bl = m#/SBL/# ? '
sbl.spamhaus.org
' : '
xbl.spamhaus.org
';
a:
if ($bl eq '
zen.spamhaus.org
') {
 $bl = m#/XBL/# ? '
xbl.spamhaus.org
' : ($bl = m#/SBL/# ? '
sbl.spamhaus.org
': 
'
pbl.spamhaus.org
');
(nota: l'ho scritto al volo e NON so il perl! Dateci un occhio per vedere se 
è giusto..)
-- 
Gerolamo 

e 
pbl.spamhaus.org
?
È compresa in Zen, non sono distinguibili guardando solo il record TXT
(che è l'unica cosa che postfix mette nel log).
-- 
ciao, |
Marco |  The Italian Usenet Cabal, Abuse Department (TINC)
"It's about damn time that all of us who actually give a damn about Usenet
stand up and tell the people who don't to fuck off and die." -- Russ Allbery

 (che è l'unica cosa che postfix mette nel log).
mmm... mi sa che hai ragione.
In effetti io ho messo separatamente nel 
main.cf
:
reject_rbl_client 
pbl.spamhaus.org
,
reject_rbl_client 
xbl.spamhaus.org
,
reject_rbl_client 
sbl.spamhaus.org
,
così nelle statistiche li distinguo.
Ma in effetti nei grossi volumi, una query sarebbe meglio di tre...
Già che ci sono, le mie statistiche (relative alla sola ultima settimana, 
sorry)
  21812 DNSBL 
pbl.spamhaus.org
;
  17879 Relay access denied
  14838 Recipient address rejected
  11229 Need FQDN address (recipient)
   9888 DNSBL 
xbl.spamhaus.org
;
   5169 Sender address rejected
   1799 DNSBL 
dul.dnsbl.sorbs.net
;
    412 Bad HELO
    335 DNSBL 
list.dsbl.org
;
    309 DNSBL 
sbl.spamhaus.org
;
     75 DNSBL 
dnsbl.njabl.org
;
      9 attachment type not allowed
      1 Message size exceeds fixed limit
      1 Other
  83756 TOTAL FILTERED MAIL
  34218 TOTAL DNSBL FILTERED MAIL (40.85 %)
   5946 TOTAL POSTED MAIL ON 89702 ATTEMPTS (6.63 %)
BL utilizzate (nell'ordine):
pbl.spamhaus.org
,
xbl.spamhaus.org
,
sbl.spamhaus.org
,
list.dsbl.org
,
dul.dnsbl.sorbs.net
,
dnsbl.njabl.org
,
-- 
Gerolamo