[LINK] spam stats

Adam Todd link at todd.inoz.com
Sun Oct 29 20:34:25 AEDT 2006

Gee, my spam statistics for my own personal email account, which I've had 
since the early 1990s rejects just over 30,000 "attempted" messages from 
blocked/RBL/access denied servers.

I still get over 3000 messages in seven days caught in my 
Challenge/Response system - rarely when I look do I find anything legit 

I get about 150 a week through the RBL's and Block Lists and Challenge 
Response process but they get filtered to HTML-SPAM most of the time.

My server itself on the whole, rejects about 150,000 server connections a 
day (over the last 90 days).

This is what gets through each month.

  M   msgsfr  bytes_from   msgsto    bytes_to  msgsrej msgsdis  Mailer
  0        0          0K   141048  368152103K        0       0  prog
  1        0          0K   142639     831559K        0       0  *file*
  3   744748  372397597K   992808   10649126K     7546       0  local
  5   757552   10501071K   419015    3329941K   733498       0  esmtp
  T  1502300  382898668K  1695510  382962729K   741044       0

Pretty scary really.

On my new server which I've only today in the last 2 hours cut over the 
ah.net domain (which is really my wife, myself and a few other people)

  M   msgsfr  bytes_from   msgsto    bytes_to  msgsrej msgsdis  Mailer
  3       87       9109K       83       9086K      240       0  local
  5       44        350K       39        442K    45401       0  esmtp
  8     1168       8953K     1172       8926K      161       0  relay
  T     1299      18412K     1294      18454K    45802       0
  C   176997                 1248                45802

Will be interesting to see what happens as I add more domains to the 
transfer!  The old server is still taking the majority of the load as MX 
records slowly expire around the world which will take (according to 
DNSSTUFF) about 23 hours with an average of 18 hours.

I have other tools that break down daily and monthly stats per user 
account, domain, IP address, sender etc.  Can be boggling at times!

But the SPAM - best ignored :)

Oh and how much time a week do I spend on SPAM?   Well since the beginning 
of the year, less than an hour now, if that.  HTML-SPAM folder catches 
most, when I look in there I can immediately see anything that is 
legitimate and clear it, normally one or two a day but it only takes about 
2 minutes each time I collect mail.

I rarely now check TMDA for quarantine mail, people are smart enough to use 
it properly, or they don't get a reply!

At 03:12 PM 29/10/2006, Craig Sanders wrote:
>i just checked ran my spam-stats script on last week's mail log file.
>this is on my small home server, which handles mail for about half a
>dozen users (friends and family) in 4 domains.
>in one week, 49225 spams were blocked. that's 168 per hour.  4.9 per
>minute. or about one spam every 12 seconds. a further 94 got through my
>postfix smtp-level filtering to be tagged by spamassassin and diverted
>to a spam-trap folder. about half a dozen got through both postfix and
>spamassasin rules and were delivered to a real mailbox.
>all this to deliver just under 900 legit messages to half a dozen mail
>users on my system.
>i estimate that i spend at least 4 or 5 hours per week examining my
>spam-traps, creating and updating anti-spam rules, monitoring log files
>- all so that email remains usable, and not buried under the deluge of
>spam. i've been doing this for over 10 years, sometimes more than 5
>hours, sometimes less...but it's a constant drain on my time and energy.
>this is outrageous. i'm sick of it. unfortunately, i've got no choice
>but to continue doing it because i don't want to give up email. and
>there's no other way to do it, anti-spam laws are basically ineffectual
>and always will be - even with spammers like Mansfield in Perth being
>fined millions, he isn't and wasn't even a significant part of the
>problem. he was a big spammer here in australia, but insignificant
>compared to some of the american spammers.
>ps: one of the worst things about this is having to examine the
>spam-traps. that means i have to scan the spam captured by spamassassin
>(anywhere from 3 to a dozen messages per day...fortunately, the vast
>majority is rejected during the smtp session and i don't have to see it)
>in order to construct new rules to block the new spammer techniques.
>the kind of filth i have to read is sickening. it's vile, repulsive
>stuff highlighting the worst things about humans - stupidity, greed,
>ignorance, and obsessions with nasty, degrading porn-film style sex.
>pps: actual stats:
>ganesh:/etc/postfix# spam-stats.pl /var/log/mail.log.0
>       1 Unwanted Virus Notification
>       2 Recipient address rejected
>       3 RBL bogusmx.rfc-ignorant.org
>       3 RBL hongkong.blackholes.us
>      11 strict 7-bit headers
>      13 RBL bhnc.njabl.org
>      27 RBL taiwan.blackholes.us
>      37 RBL brazil.blackholes.us
>      89 RBL dul.dnsbl.sorbs.net
>     197 Local address forgery
>     220 RBL list.dsbl.org
>     232 Relay access denied
>     278 RBL cn-kr.blackholes.us
>     288 Greylisted delivery attempt
>     299 RBL combined.njabl.org
>     384 Local access rule: Helo command rejected
>     443 header checks (Spam)
>     518 body checks (Spam)
>     650 RBL sbl-xbl.spamhaus.org
>    1091 Dynamic IP Trespass
>    1246 Sender Domain Not Found
>    2148 Local access rule: Client host rejected
>    5262 Recipient Domain Not Found
>    6816 Local access rule: Sender address rejected
>    7789 User unknown
>   10243 Bad HELO
>   10935 Need FQDN address
>   49225 TOTAL
>Spamassassin stats:
>      94 spam
>     873 clean
>     967 TOTAL
>spam ratio      (49319/50192) 98.26%
>tagged messages (94/967) 9.72%
>rejected spam   (49225/49319) 99.81%
>pps: my mail log file is rotated weekly at about 7am on a sunday.  so far
>today, 2119 spams have been rejected.  that's 264 per hour.
>craig sanders <cas at taz.net.au>           (part time cyborg)
>Link mailing list
>Link at mailman.anu.edu.au

More information about the Link mailing list