My site has become a spammer pilgrimage destination

I reconfigured this site sometime in January of this year and installed a security feature toward the end of February that tracks failed log ins.  Checking the logs just now, I noticed that I had well over 18,000 failed log in attempts.  Now, 99.9% of the time, these log in attempts are not made by users trying to recover their passwords, but instead by human and/or robot spammers/hackers trying to break in.  In other words, the underbelly of the internet is knocking on my door and trying to get in at a rate of around 260 times per day, or 10+ times per hour.

I should point out that this is actually not the number of spammers visiting my site, but only the number of attempts to bypass username and password authentication for access.  I have another security feature installed which blocks certain nefarious visitors based on hostname, IP, email address, and so forth.  Since the end of January, that has blocked over 70,000 spammers, or about 729 per day.

It’s pretty ridiculous, of course, since there’s no financial information kept on this site and nothing really worth breaking into (unless you put a high price on historical knowledge;) ).  I think the reason for all the spammers is simply because discussion forums have traditionally been targeted by them, and that this forum has been online long enough to be on the target list of plenty of Russian or Turkish spammer lists.

In any case, it’s a spammer pilgrimage site.

Here is the log of some recent failed log in attempts, including username (second column) and password (third column).  Note to self: don’t ever use one of the passwords for any accounts that hackers/spammers are familiar with.