It has been a while since I visited my honeypot board. I decided to have a look today…

Our users have posted a total of 385789 articles
We have 43968 registered users

And when I logged in, I had 33 unread PMs as well.

Bots have been busy. I intend to go back and see what additional patterns I can get from the data. In light of one of my recent posts about gmail being the most abused email domain, here are some stats that speak for themselves. These are the top ten email domains in use on my honey pot board:

+-----------------+----------+
| email_domain    |  users   |
+-----------------+----------+
| gmail.com       |    11323 |
| mail.ru         |     6034 |
| meltmail.com    |     1179 |
| gawab.com       |      859 |
| getciallis.info |      855 |
| spambox.us      |      479 |
| serpdomains.com |      449 |
| atlantaclubs.cn |      282 |
| coolgwen.cn     |      274 |
| coolsanta.cn    |      255 |
+-----------------+----------+

It’s not just users either, here are the email address domains associated with posts since January 1 of 2009 on my honey pot board:

+--------------+-------------+
| email_domain | total_posts |
+--------------+-------------+
| gmail.com    |      169065 |
| other        |      161505 |
+--------------+-------------+

There was one particular user that was responsible for over 40,000 posts. (Yes, they used a gmail account.) Here is their posting history.

+------------+-------------+
| post_month | total_posts |
+------------+-------------+
| 2009-03    |        1042 |
| 2009-04    |        5770 |
| 2009-05    |        8544 |
| 2009-06    |        7201 |
| 2009-07    |        8009 |
| 2009-08    |        9747 |
| 2009-09    |        1778 |
+------------+-------------+

That user has posted from 840 different IP addresses. All of them are reportedly assigned to:

person:          Remiga Alexander
address:         JSC UKRTELECOM
address:         18, Shevchenko blvd
address:         Ukraine, Kiev
phone:           +380 (44) 230-9024

That’s all I have for now. I want to do more time analysis as well as go back and see if altering the flood control had any impact on posting frequency. At first glance it doesn’t seem like it.