Author: H.Chestwig (6 Apr 09 10:27am)
<laughs> Well, it's more properly the job of isc.sans.org, but if ProjectHoneypot has the resources to track the skiddies & botnets as well as spammers, more power to them!
Don't forget though, roughly 50% of these attacks are coming from people's subverted home PCs that are part of one of the botnets, and they have NO clue that they're infected. The other half are coming from toxic servers in various countries. A lot of the botnets are running old data (the domains that the 'babycaleb' attacks try to include from are all dead) so they're already effectively neutered.
I was tracking them for a while, but my logs were getting so large that I finally gave up and simply blocked them all on our shared Apache host with some simple & elegant .htaccess code that I'd found and cobbled together. All of their attacks now drop into the bit bucket.