netsecurity database

Just take a nearly ununsed vhost and place an old version of a guestbook without captcha in it. Make shure that the subdir is guestbook or gbook :) Enter a few dummy entries with different IPs it it and ......... wait.

They will fill up your 'guestbook' and flood it with cheap cigarettes, pillz and whatever - process the logfile and parse everthing that PUT's in it.

After a while copy database table to table_spam and restore the active one with the 3 dummy entries again.

Now you can look forward parsing your logfiles against database table_spam and collect your webspammer's IPs ;)

205.234.136.187 US HOSTFORWEB-9 NET-205-234-128-0-1 205.234.136.0 - 205.234.139.255 205.234.136.0/22 2004-09-20 HOSTF-1

as webspammer

This is how a proper contact-form mail looks like:

22/09/2008 10:07:16: [qSheff] QUEUE, queue=q1222070832-263782-22809, recvfrom=127.0.0.1, from=`claus@marxmeier.de', to=`webmaster@fg-reloaded.de', subj=`Kontakttest sauber von my ip', size=1021,,

and this is how webspamming looks like:

59.99.17.23 IN BSNLNET 59.88.0.0 - 59.99.255.255 59.64.0.0/10 2004-09-06 NIB (National Internet Backbone

59.99.17.23 - - [08/Sep/2008:14:43:50 +0200] "POST /mod.php HTTP/1.1" 404 1266 "http://jugend.cologne-crocodiles.de/mod.php?mod=guestbook&entry=8730" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"

upgraded from spammer, sniffer to hacker

62.149.67.49 SA SAUDINET-INFRASTRUCTURE 62.149.67.48 - 62.149.67.55 62.149.67.48/29 2008-06-24 Saudi net infrastructo

descr: Saudi net infrastructor
country: sa
admin-c: STCR1-RIPE
tech-c: STCR2-RIPE
status: ASSIGNED PA
mnt-by: SAUDINET-STC

spamming non existing guestbooks:

62.149.67.49 - - [23/Aug/2008:00:39:25 +0200] "POST /mod.php HTTP/1.1" 404 1266 "http://jugend.cologne-crocodiles.de/mod.php?mod=guestbook&entry=8730" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"

"Not only they are a leader in the Web hosting and domain name industry today, they were the first domain name registration service ever established in 1993."

You're right - it's 'internet veteran' network solutions.

What does this have in common with network security?

205.178.184.0/21 registered to and web-spammed another private police-board in germany with porn-images and links.

abuse report was sent out to noc@networksolutions.com with no reply after 1 hour.
and none after 2 hours, 8 hours