View source for Spam Attack

This wiki has been spammed. As soon as it showed up on Google even a little bit, it got attacked. I reacted by blocking all account creation, so this is no longer a wiki. It's just a "blog on steroids." I prefer to use my energy creating content (even though virtually no one reads any of it) than fighting spammers.

==The Attacks==
The spamming started at the end of September, when this site started to show up just a little bit on Google. I only discovered it a week later. The spammers were discrete, to avoid killing the hen that lays the golden eggs, as it were. (Seen any golden eggs around here lately?) And fortunately the site had been configured to require creating an account before editing.

I quickly modified the LocalSettings.php file to allow account creation only by WikiSysop. I then logged on as WikiSysop and blocked one by one all 8 unwanted users, each of whom seemed to have lain only one golden egg. I consulted "All Pages," and with a bit of work created the following record:

*'''user name  --- date ----- page name'''
*8 r8y d9d -- --- 5 Oct ------ 雅思枪手13764107295雅思代考雅思
*8 r8y d9 ------- 5 Oct ------ @13764107295代考雅思代考雅思枪手QQ：27939721
*Luck668 -------- 4 Oct ------ Gold wow-power-leveling
*8P2q3K68 ----- 1 Oct ---- 代考雅思代考托福代考雅思枪手QQ：27939721
*3P2e3K68 ----- 30 Sept --- =代考雅思代考托福代考QQ：27939721
*3j2e3m64 ------ 30 Sept ---- QQ：27939721代考雅思代考托福代考
*8P2q3K68 ---- 30 Sept ---- 雅思枪手QQ：27939721代考雅思代考托福代考

They all come from GuessWhere, except Luck688. There was also a user Noinfo126 who seems to have created no pages. The page from Luck668 contains nuggets like this:

*He honestly performed his promise to the [http://www.toppowerlevel.net wow power leveling] man of many cures.

As WikiSysop I could have deleted these files, but I decided to leave them for the moment (even though that way the scumbags will get the payoff - and maybe I will too). Take a look at [[Special:Allpages]].

Now I have to figure out how to allow new user accounts without getting spammed....

And how did the spammers create new pages, without first making a link in an existing page?

==Statistics about the Spammers==
The statistics about visitors to this site are furnished by the server-provider Ouvaton, who gets them from a professional group. They are rather incomplete and difficult to interpret, since what is shown is often the server and not the individual computer, and since visits from one host on multiple days are often grouped together.

Below are listed only the visitors from China, as identified by the string ".cn" at the end of the address.

*Hosts -- -- -- -- -- -- -- -- -- -- -- -- -- -- --  --Pages -- Hits -- Date last visit
*38.167.37.58.broad.xw.sh.dynamic.163data.com.cn -- -- 3 -- 3 -- 17 Oct 2007
*207.49.109.125.broad.wz.zj.dynamic.163data.com.cn -- -- 9 -- 30 -- 16 Oct 2007
*179.163.37.58.broad.xw.sh.dynamic.163data.com.cn -- -- 3 -- 3 -- 13 Oct 2007
*69.146.143.219.broad.bj.bj.dynamic.163data.com.cn -- -- 1 -- 1 -- 12 Oct 2007
*58.158.143.219.broad.bj.bj.dynamic.163data.com.cn -- -- 1 -- 1 -- 10 Oct 2007
*10.170.37.58.broad.xw.sh.dynamic.163data.com.cn -- -- 3 -- 3 -- 10 Oct 2007
*135.175.37.58.broad.xw.sh.dynamic.163data.com.cn -- -- 3 -- 3 -- 04 Oct 2007
*43.146.212.58.broad.nj.js.dynamic.163data.com.cn -- -- 3 -- 3 -- 01 Oct 2007
*43.146.212.58.broad.nj.js.dynamic.163data.com.cn -- -- 13 -- 13 -- 30 Sep 2007
*110.145.212.58.broad.nj.js.dynamic.163data.com.cn -- -- 5 -- 5 -- 30 Sep 2007

[[Category:This Site]]3