netsecurity database

These spams passed clamav virus filters before it's regular database updates made the engine discover them properly:

That's a ratio of 25.911(total) to 97.

q1249048003-64262-32089/mesg: Email.Phishing.Webmail-36 FOUND
q1250497248-173589-12753/mesg: Email.Trojan.GZC FOUND
q1251069631-345244-23779/mesg: Email.Phishing.DblDom-69 FOUND
q1252441055-471186-1641/mesg: Email.Trojan.GZC FOUND
q1252524446-358261-16477/mesg: Email.Trojan-108 FOUND
q1252681130-139520-27989/mesg: Email.Trojan-107 FOUND
q1252681135-577693-28002/mesg: Email.Trojan-107 FOUND

Netsecdb now contents more than 7 million IPv4 network records from all over the world.

Netsecdb now contents more than 6 million IPv4 network records from all over the world.

Netsecdb now contents more than 5 million IPv4 network records from all over the world.

Sum:

unsuccessfully closed: 73823
successfully closed: 11584
waiting: 20436

of total: 105885

count on Mon Jan 4 06:16:30 CET 2010 showed 302.395 blocked smtp/s since 2009/09/22

spam-blocks from customer nets don't get counted.
srv01 hosts less than 50 active domains

just to show relations from values in netsecdb stats:

Total: 49.902
successfully closed: 9856
unsuccessfully closed: 27.433

Total: 26.224
successfully closed: 8.359

current ticket stats

total: 9390
open: 5172

checking for number of expolit attacks with external URL counted 67.199 for this single vhost.

current ticket stats

Just checked the number of exploit attacks to this vhost with external URL's and counted a number of 42.120 from weblogs.

4.761 in total, 2800 still open
1.441 directly closed (netrange blocked)
44 closed after ISP response

reached number of 2600 waiting tickets

1278 directly closed because we blocked non-customer netrange

ISP's: 39 closed - 2563 still open waiting for status.

3451 total - 2116 waiting for ISP's response

current statistics attached

Instead of blocked connections from spammer nets we counted exploit attacks to this vhost where external URL's were used.

The logs contain 14.191 unsuccessful tries.

2880 tickets created - 1737 waiting for response from ISP's

count on Wed Oct 8 17:07:15 CEST 2008 showed 2.431.406 blocked smtp/s since 2008/07/07

spam-blocks from customer nets don't get counted.
srv01 hosts less than 50 active domains

all mails came in without provoking:

- no newsletter subscriptions or similar
- it's the ordinary traffic from this server
- and the spammers trying to bring system down by mail overload and hacking