I decided to generate a list of the worst spam email offenders.  You can find the dynamic list of the computers that have attempted to send me spam email over 99 times here http://security.pigstye.net/staticpages/index.php/spam.  Feel free to add these ips to your blacklist.

There are numerous exploits involving parameters not being checked with index.php.  These continue to be popular with the hackers.  I have gathered up these exploits and the computers most often serving the exploit code for them.  You can find this exploit attempt at http://security.pigstye.net/staticpages/index.php/index.

Back in 2004 Mambo/Joomla had a sql injection exploit with the mosConfig variable.  Since them the hackers have been trying to find servers running the software they can exploit.  I see many such attempts on the Pigstye computers and created a nice updating list of these attempts.  You can find it at http://security.pigstye.net/staticpages/index.php/mambomosconfig.  It lists the last 50 attempts and also the top 50 computers used to host the exploit code.

My estimates are that I get about 25 spams for every legitimate email. Someday I will do an analysis. Not today.

Today I am setting up an email account meant only as a spam trap.  It will be used nowhere and only available as a link on the web page.  So any mail coming to it will be spam.  I will of course keep track of the emails and where they came from. Here is the email address for all you spam harvesters black493@pigstye.net. How long before the first spam comes?

The last few days I have been experiencing a spam comment and trackback flood on The Iraq Page.  Apparently some spammer has hired a botnet to distribute his spam.  Today I have recieved over 600 trackback spam attempts and almost 600 comment spam attempts.  That is over one attempt a minute all day long.  A partial list of the ips in the botnet follow.  You can look at the lamer list and all got caught by bad behavior because they did not have a user agent.

Today I was looking over my server logs and discovered something I wouldn't have guessed.  Other than hits from banned people the major attack vector was dictionary attacks against ssh.  This year there have been  2839110 firewall hits and 1601863 illegal ssh user attempts.  The importance of a good password is most obvious.  Stats Follow

The number of attempted shell exploits amazes me everyday.  Below I have listed the attempts made on 4/11/07 on my servers.  Keep in mind that this only includes computers that have not already been banned from my systems because of previous hack attempts.  Many of the attempts are exploits for know holes, but many are just guesses.  All of the attempts to scripts in my error directory will fail because none of them accept direct input -  all of them compare the input to a predefined list of  acceptable answers.  Many of the requests will fail because they are poorly formed.  This just shows that they are the result of an automated bot probably controlled by an irc bot.