00256: automated robot assault on pmwiki1 installations?
Description: A robot from IP 66.221.193.1 has been assaulting the ResettingPagePermissions page my pmwiki web site, although editing of pages has been closed by password by default on my complete pmwiki installation (i'm using pmwiki as an password protected, easily editable personal web site). I guess it's a robot as the IP dumped an amazingly big chunk of drugs-commercials into my pages, that have been specifically written in pmwiki1's [[http://url linkname]] linking scheme.
You can see some evidence of this in the revisions of this page (it's partly broken because i messed something up with the diff engine, but that is not part of this bug report)
http://anthony.liekens.net/index.php/PmWiki/ResettingPagePermissions?action=diff
Here is the access_log of my apache from this IP address:
66.221.193.1 - - [22/Dec/2004:00:54:36 +0100] "GET /index.php/PmWiki/ResettingPagePermissions?action=edit HTTP/1.0" 200 9576 "-" "(compatible; MSIE 4.01; MSN 2.5; AOL 4.0; Windows 98)"
66.221.193.1 - - [22/Dec/2004:00:54:37 +0100] "POST /index.php/PmWiki/ResettingPagePermissions HTTP/1.0" 302 189 "-" "(compatible; MSIE 4.01; MSN 2.5; AOL 4.0; Windows 98)"
66.221.193.1 - - [22/Dec/2004:00:54:37 +0100] "POST /index.php/PmWiki/ResettingPagePermissions/index.php/PmWiki/ResettingPagePermissions HTTP/1.0" 302 189 "-" "(compatible; MSIE 4.01; MSN 2.5; AOL 4.0; Windows 98)"
66.221.193.1 - - [22/Dec/2004:00:54:38 +0100] "POST /index.php/PmWiki/ResettingPagePermissions/index.php/PmWiki/ResettingPagePermissions/index.php/PmWiki/ResettingPagePermissions HTTP/1.0" 302 189 "-" "(compatible; MSIE 4.01; MSN 2.5; AOL 4.0; Windows 98)"
66.221.193.1 - - [22/Dec/2004:00:54:39 +0100] "POST /index.php/PmWiki/ResettingPagePermissions/index.php/PmWiki/ResettingPagePermissions/index.php/PmWiki/ResettingPagePermissions/index.php/PmWiki/ResettingPagePermissions HTTP/1.0" 302 189 "-" "(compatible; MSIE 4.01; MSN 2.5; AOL 4.0; Windows 98)"
66.221.193.1 - - [22/Dec/2004:00:54:39 +0100] "POST /index.php/PmWiki/ResettingPagePermissions/index.php/PmWiki/ResettingPagePermissions/index.php/PmWiki/ResettingPagePermissions/index.php/PmWiki/ResettingPagePermissions/index.php/PmWiki/ResettingPagePermissions HTTP/1.0" 302 189 "-" "(compatible; MSIE 4.01; MSN 2.5; AOL 4.0; Windows 98)"
66.221.193.1 - - [22/Dec/2004:00:54:40 +0100] "POST /index.php/PmWiki/ResettingPagePermissions/index.php/PmWiki/ResettingPagePermissions/index.php/PmWiki/ResettingPagePermissions/index.php/PmWiki/ResettingPagePermissions/index.php/PmWiki/ResettingPagePermissions/index.php/PmWiki/ResettingPagePermissions HTTP/1.0" 302 189 "-" "(compatible; MSIE 4.01; MSN 2.5; AOL 4.0; Windows 98)"
66.221.193.1 - - [22/Dec/2004:01:16:45 +0100] "GET /index.php/PmWiki/ResettingPagePermissions?action=edit HTTP/1.0" 200 21176 "-" "(compatible; MSIE 4.01; MSN 2.5; AOL 4.0; Windows 98)"
66.221.193.1 - - [26/Dec/2004:19:55:18 +0100] "GET /index.php/PmWiki/ResettingPagePermissions?action=edit HTTP/1.0" 200 21176 "-" "(compatible; MSIE 4.01; MSN 2.5; AOL 4.0; Windows 98)"
66.221.193.1 - - [26/Dec/2004:19:55:19 +0100] "POST /index.php/PmWiki/ResettingPagePermissions HTTP/1.0" 302 189 "-" "(compatible; MSIE 4.01; MSN 2.5; AOL 4.0; Windows 98)"
66.221.193.1 - - [26/Dec/2004:19:55:19 +0100] "POST /index.php/PmWiki/ResettingPagePermissions/index.php/PmWiki/ResettingPagePermissions HTTP/1.0" 302 189 "-" "(compatible; MSIE 4.01; MSN 2.5; AOL 4.0; Windows 98)"
66.221.193.1 - - [26/Dec/2004:19:55:20 +0100] "POST /index.php/PmWiki/ResettingPagePermissions/index.php/PmWiki/ResettingPagePermissions/index.php/PmWiki/ResettingPagePermissions HTTP/1.0" 302 189 "-" "(compatible; MSIE 4.01; MSN 2.5; AOL 4.0; Windows 98)"
66.221.193.1 - - [26/Dec/2004:19:55:21 +0100] "POST /index.php/PmWiki/ResettingPagePermissions/index.php/PmWiki/ResettingPagePermissions/index.php/PmWiki/ResettingPagePermissions/index.php/PmWiki/ResettingPagePermissions HTTP/1.0" 302 189 "-" "(compatible; MSIE 4.01; MSN 2.5; AOL 4.0; Windows 98)"
66.221.193.1 - - [26/Dec/2004:19:55:22 +0100] "POST /index.php/PmWiki/ResettingPagePermissions/index.php/PmWiki/ResettingPagePermissions/index.php/PmWiki/ResettingPagePermissions/index.php/PmWiki/ResettingPagePermissions/index.php/PmWiki/ResettingPagePermissions HTTP/1.0" 302 189 "-" "(compatible; MSIE 4.01; MSN 2.5; AOL 4.0; Windows 98)"
66.221.193.1 - - [26/Dec/2004:19:55:22 +0100] "POST /index.php/PmWiki/ResettingPagePermissions/index.php/PmWiki/ResettingPagePermissions/index.php/PmWiki/ResettingPagePermissions/index.php/PmWiki/ResettingPagePermissions/index.php/PmWiki/ResettingPagePermissions/index.php/PmWiki/ResettingPagePermissions HTTP/1.0" 302 189 "-" "(compatible; MSIE 4.01; MSN 2.5; AOL 4.0; Windows 98)"
66.221.193.1 - - [26/Dec/2004:19:55:23 +0100] "GET /index.php/PmWiki/ResettingPagePermissions HTTP/1.0" 200 27589 "-" "(compatible; MSIE 4.01; MSN 2.5; AOL 4.0; Windows98)"
Has anyone seen anything similar?
Sure, lots of wiki sites (not just PmWiki) are being hit with wiki vandalism and wiki spam. Take a look at Cookbook.Blocklist for a method of blocking posts from an individual site. --Pm