[Mediawiki-l] worm or spammers?

Christof Damian christof at damian.net
Mon May 23 06:46:28 UTC 2005


Is there a worm on the loose, or are these just spammers testing bots?

On my three mediawiki installations I get hits like these ones:
209.88.8.182 - - [23/May/2005:07:25:43 +0100] "GET /wiki/index.php?title=damian:About HTTP/1.0" 200 5210 "-" "-"
209.88.8.182 - - [23/May/2005:07:25:44 +0100] "GET /wiki/index.php?title=damian:About&action=edit HTTP/1.0" 200 6267 "-" "-"
209.88.8.182 - - [23/May/2005:07:25:47 +0100] "POST /wiki/index.php?title=damian:About&action=submit HTTP/1.0" 200 6270 "-" "-"

They hit pages like: General_disclaimer, Community_Portal and
Help:Contents. They don't change anything, but POST anyway, even on
sites where a login is required. Its from different IPs and started
around 6:30 GMT.

Anyone else noticed this?

cheers,
christof
-- 
Christof Damian         
christof at damian.net



More information about the MediaWiki-l mailing list