I'm getting it too... on about, current events, sandbox, general disclaimer, contents, community portal, and a few other prominent pages. I've blocked 4 IP's so far, and had to protect those pages. If anyone has any idea how to block the vandalism or report it effectively, I'm all ears. -----Original Message----- From: Christof Damian <christof(a)damian.net> Sent: May 23, 2005 2:46 AM To: MediaWiki announcements and site admin list <mediawiki-l(a)Wikimedia.org> Subject: [Mediawiki-l] worm or spammers? Is there a worm on the loose, or are these just spammers testing bots? On my three mediawiki installations I get hits like these ones: 209.88.8.182 - - [23/May/2005:07:25:43 +0100] "GET /wiki/index.php?title=damian:About HTTP/1.0" 200 5210 "-" "-" 209.88.8.182 - - [23/May/2005:07:25:44 +0100] "GET /wiki/index.php?title=damian:About&action=edit HTTP/1.0" 200 6267 "-" "-" 209.88.8.182 - - [23/May/2005:07:25:47 +0100] "POST /wiki/index.php?title=damian:About&action=submit HTTP/1.0" 200 6270 "-" "-" They hit pages like: General_disclaimer, Community_Portal and Help:Contents. They don't change anything, but POST anyway, even on sites where a login is required. Its from different IPs and started around 6:30 GMT. Anyone else noticed this? cheers, christof -- Christof Damian christof(a)damian.net _______________________________________________ MediaWiki-l mailing list MediaWiki-l(a)Wikimedia.org http://mail.wikipedia.org/mailman/listinfo/mediawiki-l _______________________________________________ MediaWiki-l mailing list MediaWiki-l(a)Wikimedia.org http://mail.wikipedia.org/mailman/listinfo/mediawiki-l