Hallo,
I have (since some months) problems with a machine/robot which fills
some pages with pure nonsense (and deletes sometimes the old contents).
http://arktur.de/Wiki
MediaWiki 1.17.0
From the log file, from perhaps hijacked clients:
46.100.171.23 - - [22/Oct/2011:02:15:20 +0200] "GET
/Wiki/index.php?title=Zusatzprogramme:kopiere&action=edit HTTP/1.1" 200 15984
"-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
46.100.171.23 - - [22/Oct/2011:02:15:34 +0200] "POST
/Wiki/index.php?title=Zusatzprogramme:kopiere&action=submit HTTP/1.1" 302 -
"http://arktur.de/Wiki/index.php?title=Zusatzprogramme:kopiere&action=edit"
"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
46.100.171.23 - - [22/Oct/2011:02:15:42 +0200] "GET
/Wiki/index.php?title=Zusatzprogramme:kopiere HTTP/1.1" 200 11027
"http://arktur.de/Wiki/index.php?title=Zusatzprogramme:kopiere&action=edit"
"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
46.100.171.23 - - [22/Oct/2011:02:15:47 +0200] "GET
/Wiki/index.php?title=Zusatzprogramme:kopiere HTTP/1.1" 200 10593 "-"
"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
203.160.123.161 - - [22/Oct/2011:02:32:52 +0200] "GET
/Wiki/index.php?title=Texte:Rembo-Installation&action=edit§ion=1
HTTP/1.1" 200 15440 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT
5.1; SV1)"
203.160.123.161 - - [22/Oct/2011:02:32:57 +0200] "POST
/Wiki/index.php?title=Texte:Rembo-Installation&action=submit HTTP/1.1" 302 -
"http://arktur.de/Wiki/index.php?title=Texte:Rembo-Installation&action=edit§ion=1"
"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
203.160.123.161 - - [22/Oct/2011:02:33:07 +0200] "GET
/Wiki/index.php?title=Texte:Rembo-Installation HTTP/1.1" 200 41623
"http://arktur.de/Wiki/index.php?title=Texte:Rembo-Installation&action=edit§ion=1"
"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
203.160.123.161 - - [22/Oct/2011:02:33:14 +0200] "GET
/Wiki/index.php?title=Texte:Rembo-Installation HTTP/1.1" 200 41183 "-"
"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
The "POST" operation shows the return level 302, but the page is
changed.
I've included "ConfirmEdit" and "MathCaptcha" - doesn't help.
Maybe
"MathCaptcha" doesn't work ...
Allowing write access only for registered users doesn't help.
Where's the hidden entry for this nasty robot?
Viele Gruesse!
Helmut