[Mediawiki-l] worm or spammers?

[Carlton B]

I'm getting it too... on about, current events, sandbox, general disclaimer, contents, community portal, and a few other prominent pages.   I've blocked 4 IP's so far, and had to protect those pages.

If anyone has any idea how to block the vandalism or report it effectively, I'm all ears. 

-----Original Message-----
From: Christof Damian <christof at damian.net>
Sent: May 23, 2005 2:46 AM
To: MediaWiki announcements and site admin list <mediawiki-l at Wikimedia.org>
Subject: [Mediawiki-l] worm or spammers?

Is there a worm on the loose, or are these just spammers testing bots?

On my three mediawiki installations I get hits like these ones:
209.88.8.182 - - [23/May/2005:07:25:43 +0100] "GET /wiki/index.php?title=damian:About HTTP/1.0" 200 5210 "-" "-"
209.88.8.182 - - [23/May/2005:07:25:44 +0100] "GET /wiki/index.php?title=damian:About&action=edit HTTP/1.0" 200 6267 "-" "-"
209.88.8.182 - - [23/May/2005:07:25:47 +0100] "POST /wiki/index.php?title=damian:About&action=submit HTTP/1.0" 200 6270 "-" "-"

They hit pages like: General_disclaimer, Community_Portal and
Help:Contents. They don't change anything, but POST anyway, even on
sites where a login is required. Its from different IPs and started
around 6:30 GMT.

Anyone else noticed this?

cheers,
christof
-- 
Christof Damian         
christof at damian.net
_______________________________________________
MediaWiki-l mailing list
MediaWiki-l at Wikimedia.org
http://mail.wikipedia.org/mailman/listinfo/mediawiki-l