[edward hamilton]

I'm still getting a few spam registrations but they have definitely slowed way down.

To see what I'm missing, I wrote this to take a look occasionally, while I sip a beer in my new free time.

I used http://www.maxmind.com/app/csv to help determine the countries from the ip addresses


added spamlog table with fields id_spamlog, ip, viewdate, num_spam
added geoip_data table with fields country_full, ip32_start, ip32_end
http://www.maxmind.com/app/csv

PHP Code:

<?php
session_start();
include '/admin/config.php'; // connect to database

foreach ($_POST as $key => $value) {  $$key = $value; }
?>
 <table><tr><td colspan="4">
<form action="" method="post" name="theform"  >
 
  Find the last <input type="text" name="lastspam"  value=" "> 
    <input type="submit" name="action"  value="bots"> 
     
        </form></td></tr> 
<?php

if(isset($lastspam)){  


$sql = "SELECT id_spamlog  
           FROM spamlog 
          ORDER by id_spamlog DESC LIMIT 1";  
          $result = mysql_query($sql)  
          or die(mysql_error()); 

  list($num) = mysql_fetch_row($result); 
//   echo "num $num";
 
$id =($num - $lastspam); 
 
    while($num > $id)        {
    $sql = "SELECT id_spamlog, ip, viewdate, num_spam 
            FROM spamlog 
            WHERE id_spamlog = '$num' "; 
            $result = mysql_query($sql) 
            or die(mysql_error()); 
            
            list($id_spamlog, $ip, $viewdate, $num_spam) = mysql_fetch_row($result); 
            
            if(!empty($id_spamlog)){
echo "<tr><td> id </td><td></td><td>ip </td><td>Country</td><td>Date</td><td></td> <td>Attempts</td></tr>";

/*<td>ip32_start / ip_spam / ip32_end</td> */

//break ip address into four section 
// 404232216 = 16777216*24 + 65536*24 + 256*24 + 24

 $ip32 = explode(".", $ip);  

 $ip32_spam = (16777216*$ip32[0] + 65536*$ip32[1] + 256*$ip32[2] + $ip32[3]);
 
// echo "16777216*$ip32[0] + 65536*$ip32[1] + 256*$ip32[2] + $ip32[3]<br>";
// echo "ipspam - $ip32_spam<br> ";

$ip32_spam = str_replace(' ', '', $ip32_spam);

$ip32_spam = abs($ip32_spam);       
 
 $sql = "SELECT  country_full, ip32_start, ip32_end 
            FROM geoip_data 
            WHERE '$ip32_spam' between ABS(ip32_start) AND ABS(ip32_end) ";
            $result = mysql_query($sql) 
            or die(mysql_error()); 

list($country, $ip32_start, $ip32_end) = mysql_fetch_row($result); 

 
echo "<tr><td> $id_spamlog</td><td width=\"10\"></td><td>$ip </td><td>$country</td><td>$viewdate</td><td width=\"20\"><td>$num_spam</td> </tr>
<tr><td height = \"20\"></td></tr>";
}
    $num--; 
     }
echo "</table>";
}
?>

Further down in this spam log some bots try as many as 8 times a day.
Yesterday there were 78 different ip addresses trying to register.