May be it's a good idea to collect all the info on malicious IP in a single topic, so that everybody can block them in .htacces.
At the moment they are scattered quite randomly around the forum, a list here:

from Romeus:
31.133.44.40
81.163.143.194
78.24.220.110
209.44.123.133

from helfgott:
92.63.104.34
82.146.43.62

from olihar:
78.24.216.211

from performancepixel:
78.24.220.110
81.163.143.194 (coincided with php file mod timestamps)
92.63.104.34
92.63.105.26

Thanks, hopefully no virus scanners alert on these being posted here...

from archimede333:
31.133.44.40
62.109.21.23
78.24.220.110
81.163.143.194
82.146.43.62
92.63.102.50
92.63.105.26
92.63.107.39
209.44.123.133

Of course, if these are proper hackers, they'll be relaying through some unsuspecting person's home computer.

Yes, but as you can see many of those IP are repeated between users, so in any case is better to keep those computer away from our sites, at least for a while..

Oh absolutely. And personally, there aren't users in Russia, China et al that I cater for, so it's not a problem for me to block them.

Thanks for the IPs. My logs were wiped after the stats program ran, so I had little information to go on. Only now do I find the settings to archive them.

Well, I can't even access the apache log on my server, the provider can only give it to the police if I make an accusation to the authorities.
I there any other way to track the attacks?
I have the old zenphoto logs, no info there.

Without the access logs - no, not unless there's additional tracing in zenphoto itself.

If the security logger plugin is enabled there is a log, but of course only for things Zenphoto is involved like login attempts etc.

Yes, I have that Zenphoto log, only for things regarding ZP.
Today I have blocked another IP, this time for spamming in comments:
94.181.153.120

Please post here also spammers IP, Zenphoto captcha is not enough to protect us, may be when reCapcha will be implemented we'll be more safe, unless they are doing it manually.
May be we can open another topic for spammers IP?

I suggest to try the 3rd party Akisment spam filter.

Thanks, I've placed the file akismet_php5.php in
/zp-core/zp-extensions/spamfilters
Is that all? I didn't find any option in the backend

You also need to enable it on the comments options of course. And you will need an Akismet api key (it's free).

I'm not noticing where to get akismet_php5.php ... can someone help with a link? Thanks!

... or is this it?

http://www.achingbrain.net/stuff/php/akismet

but this link gives a .class file only?

here:
http://www.zenphoto.org/news/spamfilter-akismet_php5

btw, it really works!

We have an extensions section, you know?
http://www.zenphoto.org/news/spamfilter-akismet_php5