Yesterday and today there have been no new attacks on the dragonthoughts.com mail servers. Finally the forces of evil have given up… For the time being.

There has been a significant decrease in the spammers reaching dragonthoughts.com.
This is largly due to the hosting company considering my reports and taking action by blacklisting the IP addresses that are known to be compromised, of which only a couple of new ones appeared today.
United Hosting support staff said:

After discussion amongst our team we are going to block the IP’s listed on your blog. If this catches some legitimate IP’s we will get reports and unblock as necessary.

The spammers who have been trying to post their rubbish using the dragonthoughts contact script will find that the php script, that they posted to, has been renamed and provides a hard redirect to another site. This performs two purposes:

1. It keeps the spammers from chewing up hosting bandwidth
2. It still gives them something to post, so keeping them away from other potential victims

Google was chosen as the redirection recipient, not out of malciousness, but on the understanding that they have sufficient bandwidth and resources for it not to cause their servers problems.

The distributed attempts to misuse the scripts on this web site have continued today.
More of the compromised IP addresses used have been used for the attack have been added to the spamming site list

Today, spammers have treid a distributed denial of service (DDOS) attack on Dragon Thoughts.

It appears the attack took two forms.

1. Spamming possibly non-existant aol accounts with faked headers claiming to be from this domain, resulting in many hundreds of mail bounces from aol.com, which it repeats at regular intervals.
2. Attempts to repeatedly flood posts to php scripts on the DragonThoughts contact forms on the web server. I think the idea was to generate fake mail, as blind carbon copies (bcc:) to appear to have come from DragonThoughts . I believe this attack failed, other than flooding logs with garbage.

Security has been stepped up, including banning all of the IP addresses (presumably compromised computers) from access to the entire site.

Details of the IP addresses involved