I posted some of this to Ben41, but I'll repeat it here:
It's obviously someone who knows what they're doing (IP address changing every time (and the range includes Austria, Canada, France, Finland, Greece, Germany, Hong Kong, Japan, Saudi Arabia (!), South Korea, UK, and US so far, suggesting it's a botnet or someone with a big box of proxies), vandalising random pages, edit reasons made using a password generator to stop us blocking based on those) but it seems to just be posting random thankyous to the previous poster, which suggests it's designed to be used on a forum. So it's someone technically competent but totally stupid. :s Blocking IPs and protecting pages isn't really going to do a lot since I haven't seen it use the same IP twice and it seems to just be using the random page function to choose targets. Well, at least until it starts running into IPs it's already used and pages it's already tried to edit. Not sure how it's picking names for new pages.
Also, first port of call should be to protect everything in Category: Templates and all help articles, since they're likely targets if you want to affect a lot of pages; the Bot's already tried it on the incomplete template.
Last edited by Evil Tim; 05-11-2011 at 01:56 PM.
|