[info] spam bomba google.com vo svete od 1.1

[Miro Bobovsky]

zdravim.

skusim inu temu ako intel ... ;-)

Predpokladam ze aj u vas od 1.1. registrujete zvyseny pocet pokusov o spam z 
akychkolvek adries zo sveta ..
Predpokladma preto lebo ja to vidim na roznych servroch co su navzajom 
nezavisle a v roznych kutoch sveta.

Najviac ale na jednom kde ma statistiky ze bezne nan pride tak 30 000 
spojeni denne z ktorych mail filter prefiltruje tak 15000 co pusti dalej.
No a od 1.1. je pocet spojeni 300 000 ci vcera 650 000 co je teda "mierny" 
narast. no nastastie dalej prejde stale len do 15000 a teda zlvadame 
filtrovat.

grep ": from=" /var/log/mail.log.1 | wc -l
656327

a ako tie spojenia zvatsa vyzeraju ?
Jan  3 06:25:19 sm-mta[3688]: s035OxeD003688: from=<choppedbp9 na google.com>, 
size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA-v4, 
relay=abo-65-1-69.bdx.modulonet.fr [85.69.1.65]
Jan  3 06:25:19 sm-mta[3756]: s035P2a7003756: from=<although85 na google.com>, 
size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA-v4, 
relay=85-250-43-142.bb.netvision.net.il [85.250.43.142]
Jan  3 06:25:19 sm-mta[4134]: s035PFjW004134: from=<sincerest4 na google.com>, 
size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA-v4, 
relay=200-115-22-206.colinanet.com [200.115.22.206] (may be forged)
Jan  3 06:25:19 sm-mta[3675]: s035OvBM003675: from=<woodsmen97 na google.com>, 
size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA-v4, 
relay=[199.83.193.209]
Jan  3 06:25:19 sm-mta[3696]: s035P1p3003696: from=<yipsgl0 na google.com>, 
size=1678, class=0, nrcpts=1, 
msgid=<201401030525.s035P1p3003696 na krivan.vs.sk>, proto=ESMTP, 
daemon=MTA-v4, relay=[181.66.174.225]

Teda niekto sa "hneva" na google ? ;-) Zrejme ano.

A co u Vas ?
A aby ste otazku pochopili spravne .. Nepytam sa na to ci aj k vam chodi 
vela spamu .. ale nechodia aj prave od Vas ?? Skontrolujte si to .. dakujem 
;-).

Preco tato otazka:
kolko spamov bolo z cz domeny ? ( za vcera)
grep ": from=" /var/log/mail.log.1 | grep nrcpts=0 | grep google.com | grep 
".cz \[" | wc
    536
Napr
Jan  2 11:03:10 sm-mta[25889]: s02A2kqN025889: from=<nelliez55 na google.com>, 
size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA-v4, 
relay=ip-86-49-76-8.net.upcbroadband.cz [86.49.76.8]
Jan  2 11:03:21 sm-mta[26009]: s02A2xXB026009: 
from=<annabellehjw83 na google.com>, size=0, class=0, nrcpts=0, proto=ESMTP, 
daemon=MTA-v4, relay=131.131.broadband12.iol.cz [90.179.131.131]
Jan  3 01:25:46 sm-mta[6965]: s030PiIa006965: from=<rebusesj76 na google.com>, 
size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA-v4, relay=101-82-13-46.
tmcz.cz [46.13.82.101]
Jan  2 19:32:31 sm-mta[14420]: s02IWU2P014420: from=<crepesj4 na google.com>, 
size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA-v4, relay=go-net.cz 
[212.96.160.53] (may be forged)
Jan  2 21:40:37 sm-mta[18220]: s02KeIj8018220: 
from=<arbitratetew178 na google.com>, size=0, class=0, nrcpts=0, proto=ESMTP, 
daemon=MTA-v4, relay=178-253-131-98.3pp.slovanet.sk [178.253.131.98]


Moj tip bude ze virus .. no mozno sa niekto nakazil aj u vas a proste mozno 
o tom ze je teraz chripkove obdobie neviete ;-) tak preto ten mail.

bbo