Thanks,

 

Bill Turner

ITI Computers

During the day your SpamFilter received 232,954 connections. Of these, there was a whopping (high/huge) number of 102,926 individual/unique IPs that attempted connections to SpamFilter. So each IP on average made just over 2 connections. This pretty much eliminates any single IP from sending large quantities of spam toward your network.

In addition, a very large number of connection attempts (91,830) was stopped in its tracks by the greylist filter, which prevented those connections from even attempting to send an email.

Over 83% of the emails in the logs were indeed sent to the aps2000.com domain, but depending on the domain's history and number of users when compared against the other domains you host, that could be normal.

We do see however that you have configured SpamFilter to tag spam instead of blocking it. Tagging spam emails as such and delivering them forces SpamFilter to accept the emails from the senders. If the email is accepted, the sender believes that the email is going to be delivered. So for all the spam emails you receive, to the senders (keep in mind these are mostly automated emails), when the spammers go back and analyze the statistics of their spam campaign, they will all result as in "good" spam emails, meaning they were all delivered. This will likely cause them to give a high reliability to the addresses they are spamming, causing the spam to increase. If you had configured SpamFilter to block such emails instead of tagging them and delivering them, hundreds of thousands of spam emails addressed to that domain would be blocked each week, making it a bit less likely that spam will be delivered to them in the future.

Do note however that if you start to stop such emails now, the change I described above would be very, very, very slow, as it will take months/years for the email databases spammers acquire to be updated.