Mathias Schindler wrote:

can anyone reproduce the following behavior?

if you work as an non-logged in user at en.wp and insert <ref>www.ultraevilspamlink.com</ref> into a page that does not have <references>, you will not be asked to solve a CAPTCHA. It only starts the moment someone introduces a <references /> tag.

Since this would not in fact produce a link (and thus would be totally useless to our would-be spammer), it will indeed not trip the URL-addition trigger.

-- brion vibber (brion @ wikimedia.org)