Hotmail seems to be shuffling its numbers around significantly this week, to my surprise. I'm not sure the result is really better, but it's certainly different:

• 4 email messages accepted from Hotmail, although 3 of them look a lot like typical advance fee fraud spam Hotmail addresses.
• only 79 messages rejected because they came from non-Hotmail email addresses.
• 138 messages sent to our spamtraps.
• 27 messages refused because their sender addresses had already hit our spamtraps.
• 20 messages refused due to their origin IP address (9 for being in the SBL, then a wide assortment I'm too lazy to break down in detail).

Everything is up except the non-Hotmail email address rejections, which have cratered. Maybe spammers have decided to give up on them and restrict themselves to strictly Hotmail addresses? Who knows.

The basic stats:

• got 14,233 email messages from 230 different IP addresses.
• handled 17,694 SMTP sessions from 941 different IP addresses.
• received 130,000 connections from at least 52,159 different IP addresses.
• only a highwater of 7 pending connections being processed at once.

All of this is just about the same as last week . The per-day table has no interesting fluctuations, so I'm skipping it.

Kernel level packet filtering top ten:

Host/Mask           Packets   Bytes
65.109.239.171         6062    364K
212.216.176.0/24       5540    273K
69.105.51.114          4317    202K
209.9.147.162          3939    236K
218.0.0.0/11           3637    180K
61.128.0.0/10          3598    187K
213.29.7.134           3491    209K
62.69.162.133          2913    163K
209.11.168.39          2582    127K
213.29.7.174           2414    145K

Overall, I'd say the kernel level blocks were a little quieter than last week.

• 65.109.239.171 and 213.29.7.174 reappear from last week
• 69.105.51.114 reappears from December 2005 , still with an unresolvable HELO name.
• 209.9.147.162 is in SBL37385 .
• 209.11.168.39 used an unresolvable HELO name.
• 213.29.7.134 is yet another centrum.cz machine.
• 62.69.162.133 repeatedly tried to send more mail from something that had tripped our spamtraps.

Connection time rejection stats:

  26458 total
  13291 dynamic IP
   8813 bad or no reverse DNS
   3267 class bl-cbl
    308 class bl-sbl
    133 class bl-dsbl
     70 class bl-njabl
     67 class bl-sdul
     66 class bl-spews
     35 class bl-ordb
      5 class bl-opm

Only one machine really hammered on the frontend this week; 209.9.147.173 made 202 connection attempts before we blocked it harder for being in SBL37385 . 17 of the top 30 rejected source IPs are in the CBL this week, three in the SBL (209.9.147.173, plus 222.253.123.194 in SBL36455 and 222.65.153.197 in SBL19307 ), and 6 are currently in bl.spamcop.net .

Other stats:

There's no really big single source of bad HELO s, unlike last week ; 69.105.51.114, at 74 before it went into the kernel blocks, is the highest. At least the numbers are relatively low.