Monday, August 11, 2008
Stupid server stats
So I took the IP address mapping program (it can lookup 10,000,000 entries per second on a dual-core 2.6GHz Pentium—5,000,000 per second per CPU) and decided to check some of the server logs—to see where I'm getting most of my network activity, excluding web requests.
Basically, I'm checking sources for spam and ssh
attempts.
First up, sources for email (which includes legitimate emails as well as spam attempts) for the past 28 days:
| Count | Country |
|---|---|
| Count | Country |
| 5057 | UNITED STATES |
| 2413 | RUSSIAN FEDERATION |
| 2413 | CHINA |
| 2005 | BRAZIL |
| 1380 | ARGENTINA |
| 1336 | COLOMBIA |
| 1173 | TURKEY |
| 1035 | REPUBLIC OF KOREA |
| 1033 | SPAIN |
| 897 | INDIA |
| 843 | CHILE |
| 738 | POLAND |
| 721 | UNITED KINGDOM |
| 721 | GERMANY |
| 614 | ITALY |
| 604 | UKRAINE |
| 573 | ROMANIA |
| 554 | PERU |
| 466 | ISRAEL |
| 459 | FRANCE |
| 399 | MEXICO |
| 395 | THAILAND |
| 385 | (no associated country) |
| 309 | TAIWAN |
| 231 | VIET |
| 190 | CANADA |
| 188 | HUNGARY |
| 146 | PORTUGAL |
| 142 | VENEZUELA |
| 140 | CZECH REPUBLIC |
| 136 | JAPAN |
| 130 | NETHERLANDS |
| 127 | LATVIA |
| 124 | KAZAKHSTAN |
| 123 | SAUDI |
| 120 | BULGARIA |
| 116 | INDONESIA |
| 111 | DOMINICAN REPUBLIC |
| 107 | PHILIPPINES |
| 104 | GREECE |
| 102 | SINGAPORE |
Here, I excluded results less than 100. There really aren't any surprises here, except for the “no associated country” bit—I'm guessing here the mapping data I have is somewhat incomplete. It's also amusing to see 38 emails from Iran (marketing to the Great Satan? Unexpected, to say the least) and 1 from the Lao People's Democratic Republic (they have the Internet there?).
Next up, ssh attempts for the past 28 days (all results,
since it's a smaller data set):
| Count | Country |
|---|---|
| Count | Country |
| 43541 | SPAIN |
| 30397 | (no associated country) |
| 21643 | CHINA |
| 17741 | UNITED STATES |
| 5483 | REPUBLIC OF KOREA |
| 4941 | INDIA |
| 4745 | LITHUANIA |
| 4636 | SINGAPORE |
| 3085 | RUSSIAN FEDERATION |
| 2361 | TAIWAN |
| 1688 | SWEDEN |
| 1412 | MEXICO |
| 1087 | ARGENTINA |
| 848 | PHILIPPINES |
| 707 | ITALY |
| 693 | SWITZERLAND |
| 461 | UKRAINE |
| 452 | JAPAN |
| 434 | KAZAKHSTAN |
| 342 | BRAZIL |
| 178 | NETHERLANDS |
| 176 | UNITED KINGDOM |
| 122 | FRANCE |
| 96 | COLOMBIA |
| 26 | BULGARIA |
| 14 | SERBIA AND MONTENEGRO |
| 11 | AUSTRALIA |
| 10 | INDONESIA |
| 10 | GREECE |
| 6 | PARAGUAY |
| 1 | THAILAND |
| 1 | MALAYSIA |
The “no associated country” bit here is an overly generous regular expression accepting domain names in place of an IP address, and the real surprise here is the number of attempts from Spain of all places. China and Russia, I would expect (and I would have expected Russia to be higher than it is). Singapore was also a bit of a surprise here, seeing how it's Disneyland with the Death Penalty.
Go figure.
![[The future's so bright, I gotta wear shades]](https://www.conman.org/people/spc/about/2023/1023.t.jpg "The future's so bright, I gotta wear shades")