Login attempts to my servers

I've got a couple of years worth of logs from this server and others, showing the good the bad and the ugly. Most interesting is it keeps every IP address that has ever tried to connect to each server in the last 24 hours, and emails me a list of these, among other things.

I downloaded my email inbox from GMail and wrote a quick bit of Python to scrape through a .mbox file for IP addresses that had attempted to login. In decreasing order of number of unique IP address which attempted to connect to one of my servers over SSH, the countries are as follows: US (12,048), China (4,614), GB (2,761), India (1,816), Bahrain (1,507), Brazil (1,123), Canada (1,093).

Note that this is just the country of origin of the IP, it doesn't mean the server was actually controlled by someone in that country -- botnets, people!

Here are those IP addresses plotted on a graph, where the x-axis is the first octet of the address, and the y-axis is the second octet of the address, e.g. x.y._._

(Click link for a higher resolution & DPI version).

IP Adresses small (/16)

The vertical banding is what I'd expect, but I'm fascinated by the horizontal banding at ~52 on the y-axis.

I'll publish the code at some point, but at the moment the associated data files have all the full IP addresses, so I don't want to make them public yet.

“AttributeError: ‘module’ object has no attribute ‘blah'”

This is a stupid one.

I was getting the Python error: “AttributeError: ‘module’ object has no attribute ‘mailbox'”

I read this helpful guide, which didn't fix it. I then realised that I had 'import mailbox' in the head of the python file, and the python file itself was called 'mailbox.py': Python takes files in the local folder as higher priority than the modules in the main installation.

Moral of the story: don't name your python files the same as any of the modules you're importing.

Oops!