Virus and Spam Storms

Caught an interesting little thing in my mail logs the other day.

Take note of the two sudden and sustained peaks. The graph shows incoming SMTP connections. Now the next graph shows messages delivered.

The increased number of incoming SMTP connections seems to have no impact on the number of messages delivered locally and remotely. So what is it? The peaks are a few thousand of Zafi.B viriis being directed at the server. With Qmail-Scanner installed the SMTP connections are dropped, and my users can sleep well.

Still, quite interesting to see how these viruses seemingly attack using address lists sorted by domain.

Posted by ludvig at February 23, 2005 11:59 PM | TrackBack