incubator-jspwiki-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Janne Jalkanen <Janne.Jalka...@ecyrd.com>
Subject Some minor spam statistics
Date Fri, 19 Oct 2007 22:53:11 GMT
Hi ho folks!

Just wanted to let you know that I think I pinpointed the guy who  
used the bot network to randomly add a few characters at the  
beginning of every page at jspwiki.org...  Because I think he's using  
http://www.jspwiki.org/wiki/KaiMysliwiec as a test bed.  We switched  
to the new SpamFilter on the 13th, that is, seven days ago, and I  
think he just tried manually to make a change on that page.  If you  
look at the history, there are several, similar modifications from  
the same IP address, 83.69.124.141 on that page, and on that page alone.

They learn quickly.  It's obvious it's a bot - you can see it from  
the patterns (e.g. no fetches for CSS or script files, even though  
that has changed).

By the way, the IP address leads to Russia.

In other news, jspwiki has seen 99 legit edits in the past 7 days and  
4385 rejected by the SpamFilter.  Out of these, 119 were made by dumb  
bots that just fill all the fields with garbage.  4146 edits were  
made by bots specifically designed to target JSPWiki installations.   
31 edits by humans who are just pasting huge amounts of links to the  
edit page.  Akismet stopped 44 edits.  Regexp based filtering stopped  
four, and the rest were just the same IP address being auto- 
blacklisted.  Note that the order of these filters matters, as many  
edits would be caught by multiple algorithms.

Dark world out there...

/Janne

Mime
View raw message