[Pmwiki-users] Wiki-Spammers 2 - motives
Robin
robin
Mon Jan 10 17:12:29 CST 2005
On Tuesday 11 January 2005 11:19, Patrick R. Michaud wrote:
> The question that often perplexes me when looking at logs like
> this is: Is this a human or a bot doing the work? If it's a bot,
> why is the bot so ... "restrained"? Is it that the bot is programmed
> to avoid various actions that would indicate it's a bot, such as
> making too many postings in a short period of time, or posting to
> large numbers of pages in a single session?
It is a bot. a) makes the same post three times to each page (which strikes me
as strange, and not something a person would do) and b) this is the apache
log entry for it:
80.68.242.97 - - [10/Jan/2005:14:52:16 +1300] "POST /Main/RecentChanges
HTTP/1.1" 200 331 "-" "Mozilla/5.0 (compatible; MSIE 6.00; Windows NT 9.0)"
which (if you are familiar with webservers) looks about as wrong as you can
get.
My guess is that the restraint is there because it's easier. I'd guess the
script isn't very advanced, or they figure that they are better changing a
few pages on lots of sites rather than lots of pages on a few sites.
> Most attacks I've seen limit the attacks to only a dozen or so
> pages on a site, and I've never quite figured out why this is the case
> if it's a bot. Perhaps it's just a case of the parasite being
> careful not to kill the host organism?
Possible. If they filled a site with too many links, it might start to look to
Google like a linkfarm, and lose it's contribution to the increasing ranks.
--
Robin <robin at kallisti.net.nz> JabberID: <eythian at jabber.org>
Hostes alienigeni me abduxerunt. Qui annus est?
PGP Key 0xA99CEB6D = 5957 6D23 8B16 EFAB FEF8 7175 14D3 6485 A99C EB6D
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url : /pipermail/pmwiki-users_pmichaud.com/attachments/20050111/21acf3b7/attachment.bin
More information about the pmwiki-users
mailing list