On Feb 6, 2007, at 11:45 PM, Minh Nguyen wrote: <snip>
Very likely, it is a spambot, but it's not gone wrong. Having maintained my own weblog for several years, I've found that spammers often leave very innocuous-looking comments at first, to see how and how quickly the moderator/admin/owner of the site reacts. Then come the links. Unless for whatever reason a page at mediawiki.org links to [[Extension:Guestbook/w/w/index.php]], the very fact that this bot uses an extension like .php at the end of the title means that it's a spambot.
Wouldn't the parser strip the links they tried to put in? On the blogs and bbs that I administer, the bots try and don't bother checking back to see if they got through.
Also note that many more spambots are designed for blogging software like Movable Type and Wordpress, so they might be guessing URLs based on how those software packages work.
With spammers, the IP addresses always change (they've gotten good about that over the past few years), so I suppose the best way to control these "scout messages" is to grep [[Special:Newpages]] regularly for telltale page titles (like ".php") and delete on sight.
The sophisticated spammers use botnets, but others don't bother to shift IPs. I think there's been a population explosion in naive spammers in the past month or so. I've blocked >50K trackback spam attempts at my blog just in Feb 2007. 13,236 are from one IP, which tried 29,332 times in January. And these are obscure sites! Maybe a lot of people got "make money at home by spamming" kits for Xmas.
-- Minh Nguyen mxn@zoomtown.com [[en:User:Mxn]] [[vi:User:Mxn]] [[m:User:Mxn]] AIM: trycom2000; Jabber: mxn@myjabber.net; Blog: http://mxn.f2o.org/
Wikitech-l mailing list Wikitech-l@lists.wikimedia.org http://lists.wikimedia.org/mailman/listinfo/wikitech-l