Mark Clements wrote:
On mediawiki.org we quite often seem to get new pages created similar to the following:
Page name: /w/w/index.php?title=Extension:Guestbook/w/w/index.php Page text: Dear web-master ! I looked your site and I want to say that yor very well made it .All information on this site is represented for users. A site is made professionally. So to hold !
The similarities are that the pages titles always contain index.php?title=xx (with various depths of /w or /wiki) and that the message is congratulating us on our site. The user is always an anon, but without being able to search the deleted pages I don't know whether the IP address is always the same. There never seems to be any link spam or any of the other common vandalism/spamming traits in the page text.
Have any other wikis experienced this? Some kind of spambot gone wrong, or a mischievous repeat visitor? It's happened too often for me to think it's a genuine congratulatory comment posted by someone with a screwy browser...
Is there anything we can do about it?
- Mark Clements (HappyDog)
Very likely, it is a spambot, but it's not gone wrong. Having maintained my own weblog for several years, I've found that spammers often leave very innocuous-looking comments at first, to see how and how quickly the moderator/admin/owner of the site reacts. Then come the links. Unless for whatever reason a page at mediawiki.org links to [[Extension:Guestbook/w/w/index.php]], the very fact that this bot uses an extension like .php at the end of the title means that it's a spambot.
Also note that many more spambots are designed for blogging software like Movable Type and Wordpress, so they might be guessing URLs based on how those software packages work.
With spammers, the IP addresses always change (they've gotten good about that over the past few years), so I suppose the best way to control these "scout messages" is to grep [[Special:Newpages]] regularly for telltale page titles (like ".php") and delete on sight.