Dont bother with the IP-Adresses, install proper Anti-Spam-Extensions.

See http://www.mediawiki.org/wiki/Manual:Combating_spam for a MediaWiki-Helppage (and follow the links on that page to learn more), or have a look at http://www.wiki-aventurica.de/wiki/Wiki_Aventurica:Anti-Spam which is a short summary of measures that work for me.

I highly recommend using the QuestyCaptcha-part of Confirm-Edit to prevent account creation, and installing SpamBlacklist to block those pesky spamlinks.

For this http://arktur.de/Wiki/index.php?title=Kategorie:Whiteboard&curid=2323&am... kind of spam you might need to install SpamRegex or AbuseFilter, though.

Greetings Stip

Am 27.05.2012 12:24, schrieb Helmut Hullen:

Hallo,

is it possible that a bad guy fakes his IP address when he creates a page?

My wiki (arktur.de/Wiki) suffers from Wiki spam, and sometimes I see IP addresses from spammers which don't occur in the apache access_log.

Viele Gruesse! Helmut

---

MediaWiki-l mailing list MediaWiki-l@lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/mediawiki-l

On 27/05/12 12:24, Helmut Hullen wrote:

Hallo,

is it possible that a bad guy fakes his IP address when he creates a page?

My wiki (arktur.de/Wiki) suffers from Wiki spam, and sometimes I see IP addresses from spammers which don't occur in the apache access_log.

Viele Gruesse! Helmut

Kind of. If the spammer uses a proxy, and the proxy provides a X-Forwarded-For header, with the IP of the client on behalf of which it is forwarding the request (or more, if there were several proxy hops), MediaWiki will use that IP instead, provided it trusts the proxy. Your apache access_log will report the proxy in such case.

This is most interesting for the case where you have a reverse proxy (such as squid or varnish) in front of your site.

A proxy is considered trusted if its ip appears on $wgSquidServers or $wgSquidServersNoPurge.