This week we received 12,079 email messages from 226 different IP addresses. Our SMTP server handled 44,167 sessions from 4,794 different IP addresses. Session volume is up a bit compared to last week , but well within what I now consider normal fluctuations.

Because we rebooted this machine Monday evening, we're about 36 hours short on kernel-level and total connection volume stats (and I'm not going to bother with per-day breakdowns). We had 190,650 connections since Monday evening, from at least 30,420 different IP addresses; from Sunday to just before the reboot, we had 30,190 connections. A straightforward total would make this a fairly ordinary week.

Kernel level packet filtering top ten:

Host/Mask           Packets   Bytes
66.154.124.9          13678    766K
64.52.16.234          11451    535K
85.214.22.252          9863    473K
212.216.176.0/24       9416    478K
66.147.35.53           5457    255K
202.96.0.0/12          4856    263K
80.169.152.25          4443    213K
217.57.113.212         4401    264K
218.102.53.0/24        4327    200K
66.179.44.52           4232    203K

This week, chinanet.cn.net has clawed its way back into the top ten and 66.154.124.9 finishes out its third week in first place, earning 66.154.124.0/28, aka SBL24721 , an entry in the permanent blocklist. So much for Surge Media.

• 66.179.44.52 is the only other IP address returning from last week or indeed any previous week; it's been blocked for repeated bad HELO names.
• 85.214.22.252 is on the ORDB.
• 217.57.113.212 is an interbusiness.it 'dialup' address; we don't talk to interbusiness.it anyways, but we especially don't talk to anything that has a generic interbusiness.it hostname.
• everyone else got blocked for repeated bad HELO names.

Connection-time rejection stats:

  26507 total
  11429 dynamic IP
   7076 bad or no reverse DNS
   2179 class bl-cbl
   1516 class bl-ordb
   1400 class bl-spews
    675 class bl-sbl
    651 class bl-dsbl
    533 Chinese spam involvement
    199 class bl-njabl
    128 class bl-sdul
     14 class bl-opm

Several machines made outstanding contributions to these stats this week. 85.214.22.252, already featured in the kernel level stats, added 405 to the ORDB count, along with 196.1.211.35's 260; 210.51.25.177 gave 444 to the 'bad rDNS' count, with 203.167.99.194 assisting for 207. Several machines in SBL24721 gave the SBL stats a nice assist, as you might guess, but no one really stands out for SPEWS.

Interestingly, bad HELO s are up from last week but bounces are once again down. 64.52.16.234 HELO 'd with a bad name 872 times this week before we blocked it (and then it made the top ten kernel filters list), but there aren't any other really big contributors.

Since I enjoy depressing myself, here are more Hotmail statistics :

• one actual email accepted all week.
• five Hotmail messages refused due to their originating IP addresses (three listed in the SBL, one from Gilat-Satcom, one from Nigeria).
• 257 messages from Hotmail refused because they came from non-Hotmail email addresses.

Apparently our first set of Hotmail stats from two weeks ago were gathered during a slow week; Hotmail is now running only 0.4% 'email traffic we actually wish to accept'. If that.