Hi ho folks!
Just wanted to let you know that I think I pinpointed the guy who
used the bot network to randomly add a few characters at the
beginning of every page at jspwiki.org... Because I think he's using
http://www.jspwiki.org/wiki/KaiMysliwiec as a test bed. We switched
to the new SpamFilter on the 13th, that is, seven days ago, and I
think he just tried manually to make a change on that page. If you
look at the history, there are several, similar modifications from
the same IP address, 83.69.124.141 on that page, and on that page alone.
They learn quickly. It's obvious it's a bot - you can see it from
the patterns (e.g. no fetches for CSS or script files, even though
that has changed).
By the way, the IP address leads to Russia.
In other news, jspwiki has seen 99 legit edits in the past 7 days and
4385 rejected by the SpamFilter. Out of these, 119 were made by dumb
bots that just fill all the fields with garbage. 4146 edits were
made by bots specifically designed to target JSPWiki installations.
31 edits by humans who are just pasting huge amounts of links to the
edit page. Akismet stopped 44 edits. Regexp based filtering stopped
four, and the rest were just the same IP address being auto-
blacklisted. Note that the order of these filters matters, as many
edits would be caught by multiple algorithms.
Dark world out there...
/Janne
