Home

Your premium source for custom modification services for phpBB

  logo

HomeForumsBlogMOD ManagerFAQSearchRegisterLogin

Comments September 8, 2009

Honey Pot Board Update

Filed under: Anti-spam, phpBB — Dave Rathbun @ 6:27 am CommentsComments (1) 

It has been a while since I visited my honeypot board. I decided to have a look today… :shock:

Our users have posted a total of 385789 articles
We have 43968 registered users

And when I logged in, I had 33 unread PMs as well.

Bots have been busy. :) I intend to go back and see what additional patterns I can get from the data. In light of one of my recent posts about gmail being the most abused email domain, here are some stats that speak for themselves. These are the top ten email domains in use on my honey pot board:

+-----------------+----------+
| email_domain    |  users   |
+-----------------+----------+
| gmail.com       |    11323 |
| mail.ru         |     6034 |
| meltmail.com    |     1179 |
| gawab.com       |      859 |
| getciallis.info |      855 |
| spambox.us      |      479 |
| serpdomains.com |      449 |
| atlantaclubs.cn |      282 |
| coolgwen.cn     |      274 |
| coolsanta.cn    |      255 |
+-----------------+----------+

It’s not just users either, here are the email address domains associated with posts since January 1 of 2009 on my honey pot board:

+--------------+-------------+
| email_domain | total_posts |
+--------------+-------------+
| gmail.com    |      169065 |
| other        |      161505 |
+--------------+-------------+

There was one particular user that was responsible for over 40,000 posts. (Yes, they used a gmail account.) Here is their posting history.

+------------+-------------+
| post_month | total_posts |
+------------+-------------+
| 2009-03    |        1042 |
| 2009-04    |        5770 |
| 2009-05    |        8544 |
| 2009-06    |        7201 |
| 2009-07    |        8009 |
| 2009-08    |        9747 |
| 2009-09    |        1778 |
+------------+-------------+

That user has posted from 840 different IP addresses. All of them are reportedly assigned to:

person:          Remiga Alexander
address:         JSC UKRTELECOM
address:         18, Shevchenko blvd
address:         Ukraine, Kiev
phone:           +380 (44) 230-9024

That’s all I have for now. I want to do more time analysis as well as go back and see if altering the flood control had any impact on posting frequency. At first glance it doesn’t seem like it.

1 Comment

  1. That’s the problem, isn’t it? The fact that so many people use Gmail, and that so many spammers (who are not people :p) use it as well! What to do?

    On my site, 454 users out of 1,445 total are using a gmail.com address.

    Comment by Dog Cow — September 8, 2009 @ 10:41 am

RSS feed for comments on this post.

Sorry, the comment form is closed at this time.

Powered by WordPress