Hallo,
I'm watching the drug spammer on and on ...
67.154.54.242 - - [18/Dec/2009:19:29:45 +0100] "GET
/Wiki/index.php?title=Special:UserLogin&type=signup HTTP/1.1" 302 - "-"
"Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.1) Gecko/20061204
Firefox/2.0.0.1"
67.154.54.242 - - [18/Dec/2009:19:29:45 +0100] "GET
/Wiki/index.php?title=Spezial:Anmelden&type=signup HTTP/1.1" 200 9529
"-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.1)
Gecko/20061204 Firefox/2.0.0.1"
67.154.54.242 - - [18/Dec/2009:19:29:48 +0100] "GET
/Wiki/index.php?title=User:Online_Pharmacy_Azelaic_Acid_Generic_Azelex&action=edit
HTTP/1.1" 200 12333 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1;
en-US; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1"
confuses me a bit: "Special:UserLogin" leads to "302" (blocked), but
"Spezial:Anmelden" leads to "200" (success).
Ok - I don't know if the spammer uses the same login string both times.
But that looks like an incomplete barrier.
There is only one extension running (I'm trying what is necessary):
"PaddwordReset".
-------------------
By the way: sometimes "Special:Contributions" is visited by the spammer
- I can't find the german name and location of this side.
Viele Gruesse!
Helmut