(reformatting from previous mails to make the list of numbers easier to compare)
Dates: 20240928, 20241004, 20241014, 20241021 Total sources: 332’000, 353’000, 353’000, 353'000 Overuser total sources: 13’100, 15’000, 16’000, 16'000 Total queries (* 10^9): 273, 287, 336, 312 Overuser total queries (* 10^9): 200, 224, 252, 232 As of 20241021, we also have split between IPv4/6 for the total sources, since the number of queries over IPv6 seems to grow faster than IPv4: ipfamily: 20241021 ipv4: 292'609 ipv6: 60'410 The mag data was added starting on 20241010: mag 20241004 20241014 20241021 500 18 20 23 250 76 84 65 100 161 175 179 50 494 564 507 25 1'011 1'120 1'041 10 3'133 3'333 3'111 5 4'513 5'032 4'625 3 5'621 6'048 5'628 1 337'992 336'643 337'840 Comment 20241021: The number of fextremely high overusers has dropped by about 5% (> 100: 279 to 267), while their total queries dropped a bit more with ca 8%. The overall query rate dropped by about 7%. The distribution of IPv4 vs IPv6 is roughly the same for all categories of overusers and regular users (ca 20%). A number of high overusers who seemed to have stopped / reduce are: some within googleusercontent.com and copmute.amazonaws.com (whoever is hiding behind), a service called „Activeguard“, . Significant increase from opendns.com and from IP ranges without PTR where whois shows „Google EU metro frontend“. Still going strong: Sendgrid (*outbound-mail.sendgrid.net, which still puzzles me), as250.net, Cloudfront (large missing PTR…). The drop in overall query rate can mostly be attributed to a few high overusers who seem to have acted. No unusual rate of new subscribers to the rsync service observed, but we have a handful of subscriptions for suspiciiously low numbers of users (which we do not strongly control - after all we’re not a professional sales organisation…). — Matthias
