Wow. Seeing is believing. After nearly three days, my catchall account in the Google Domain Appliancehas caught 67,930 messages; and has 3,185 messages in the Inbox. The amazing stat is at the bottom of the mailbox: “You are currently using 864 MB (42%) of your 2048 MB.” Looking through the messages, it looks like the attachments on the spam are using a giant hunk of the space. It looks like I’ll need to clean out the Spam box much sooner than 30 days, or mail coming in will start to bounce.

I wonder if there’s an easy way to chart the mail volume coming into a Gmail account? I could download the mail with POP, but that seems like a waste, and an uphill battle.I thought about turning this mailbox into an automagically updating WordPress blog, but I’m not sure why. Would making all this data be useful to anyone? I see mostly true non-existent user error messages, but there are a few vacation messages, spam complaints, and other backscatter. Thoughts?

If I tag the Inbox messages as spam, will that affect other users of Google’s mail appliances, or just this one account? I don’t want to mess up any one else’s email.

(Now up to 68,123 spam, 3,187 Inbox, 866MB used)

If you're new here, you may want to subscribe to my RSS feed. This allows you to read my newer articles without having to visit the site again. Thanks for visiting! Mike

I just logged into the catchall account for the domain I added to Google’s Web appliance. Spam to the old box in my office has slowed to a trickle (only 61 messages last hour, down from 1,237 for the same hour yesterday). In the Google Web Appliance, there are 2,596 spam messages caught, 12 missed that ended up in the Inbox. In 3.4 hours, that’s a rate of 649 spam per hour, 12.7 per minute, or roughly one spam every 5 seconds.

I’m using 10MB of space. So far. So extrapolate that out, I’ll be at 2,160MB in 30 days. The size limit appears to be 2,048MB. So I’ve got a shot to fill the box up.

Back in May (see Gmail Collection) I detailed my results in sending a spam-only domain’s email to a new account at Gmail. I just logged into that Gmail account, there are 55,460 messages in the inbox, using 402MB. All but three messages are from January to May 2006 when I stopped forwarding mail. In the spam mailbox are 353 spam messages that came in over the last 30 days. And then there are three messages that came in after May 11 that were missed by the filters at Gmail.

So I’ve just decided a more accurate test is called for, and one that won’t cause my local server’s hard drive to fill up every month or so is to move the domain over to Google Apps for Your Domain. Once I updated the DNS, it looks like things are working. It’ll be interesting to see how the spam traffic changes as the DNS update propagates. I’ll keep you informed.

In the process of cleaning up after the comment spam bomb yesterday, I noticed that my Akismet plugin is a little out of date. I was running 1.15, and the Akismet download page says they now have version 1.21. After downloading and installing, I see it is actually reported as version 1.81. I’ve asked Akismet what the correct most recent version is. Regardless, I’ve upgraded.

The only new option in the Akismet Configuration panel is a checkbox “Automatically discard spam comments on posts older than a month.” That makes sense, I generally allow Akismet tagged messages to disappear after 15 days anyway. Right now there are 3,682 messages waiting to be purged in my queue. Hopefully half a month from now the queue will be mostly empty. I think I’ve only ever had one message that was incorrectly tagged as spam by Akismet. Not bad, out of 14,093 messages.

I do wish that the Manage Akismet spam page was easier to load. It attempts to show all the messages that have been tagged. It usually kills my browser. It would be nice to browse it by post that was commented on. Or by date. Grouped by X number of messages at a time? Or if I could automatically discard certain messages (e.g. if the message contains keywords like viagra, insurance, poker, etc…).

Yesterday afternoon I renamed the default comments post file from wp-comments-post.php since I was being hit hard by comment spammers. The new filename started getting hit softly about 10 hours later, although the old filename is still being hit. So unless you change the comment post filename regularly, it doesn’t do much good.

I wrote a quick shell script to collect the IP addresses of the comment spammers. And then I’m adding them to a DENY blocklist in apache. Should I use iptables via killroute? Time to do some learning.

The rate of oncoming spam attempts has slowed a bit, 233 attempts blocked by the renamed comment script; 123 blocked via the blocklist. So it’s helping.

(Comments re-enabled after tweaking my theme)

Over the last few months the web/mail server running PlanetMike.com has locked up randomly, although usually at night. It always resulted in needing a hard reboot. My web host says it was simply running out of RAM. So I’ll be moving to an upgraded server shortly. Just now I noticed my site was coming up slowly, so I logged in quickly (or as quickly as I could). Everything looked ok, no funny or unknown processes in ps or top. For some reason, I checked the status of apache. httpd (pid 21358 21357 21355 21352 21351 21348 21329 21328 21327 21326 21322 21321 21318 21313 21312 21310 21305 21304 21303 21302 21299 21298 21296 21265 21264 21263 21262 21260 21259 21255 21244 21243 21240 21231 21230 21228 21226 21225 21224 21221 21220 21218 21211 21210 21207 21203 21148 21145 21142 21130 21114 21113 21112 21111 21100 21099 21089 21058 20870 20869 20867 20866 20864 20788 20787 20785 20780 20779 20777 20763 20762 20761 20757 20756 20726 20723 20576 20568 20428 20286 20223 20213 20190 20189 20186 20025 20024 20023 20022 20021 20020 20018 19987 19254 19215 19203 18190 18120 18119 18118 17926 17925 17924 17923 17310 17291 15245 15229 15191 14150 8091 7837 7832 7829 7769 5524 4181 1870 1860 1790 1437 1374 1295 1186 847 835 724) is running…

Whoa! What is all that? netstat showed a ton of connections. I stopped apache and looked through the web logs. It’s freaking tons of attempts to post comments to my blog. I renamed the wp-comments-post.php file to something else, restarted apache, and five minutes later, I already have 160 404 errors. (now up to 164). Idiot spammers.

What was happening is a DOS attack on myself via Akismet I would guess. I guess the next step in the comment battle was is to rename the comment submission page, and tweak WordPress to look for the new file name. Urgh!!!!

Now I’m up to 229 attempts.

Wow, only 37 minutes into 2007, and the penny stock spam has already started.

WE WANT TO REPRESENT YOU ANDROS ISLE DEVELOPM (AVPJ.PK)!
BUY AVPJ JUST AFTER NEW YEAR. THE ALARM IS STARTED!!! AND IT IS GOING TO BURT!
WE REPRESENT FOR YOU THE NEXT PRICES:
TARGET PRICE IN 1 WEEK: 0.72$.BUY IT NOW!
USE YOUR BROKERAGE SITE KNOW THE HOT INFORMATION ON THIS UNBELIEVABLE COMPANY.
IT’S GETTING GROWTH ALMOST EVERY HOUR! MORE THAN 85% DAILY FROM STARTING COST.
THIS IS YOUR GREAT CHANCE TO DOUBLE YOUR INVESTMENT FOR SHORT PERIOD.

Remember, this stock is going to Burt! Mr. Reynolds, hold onto your money tight.