[Pmwiki-users] Wiki-Spammers 2 - motives

[Robin]

On Tuesday 11 January 2005 11:19, Patrick R. Michaud wrote:
> The question that often perplexes me when looking at logs like
> this is:  Is this a human or a bot doing the work?  If it's a bot,
> why is the bot so ... "restrained"?  Is it that the bot is programmed
> to avoid various actions that would indicate it's a bot, such as
> making too many postings in a short period of time, or posting to
> large numbers of pages in a single session?
It is a bot. a) makes the same post three times to each page (which strikes me 
as strange, and not something a person would do) and b) this is the apache 
log entry for it:
80.68.242.97 - - [10/Jan/2005:14:52:16 +1300] "POST /Main/RecentChanges 
HTTP/1.1" 200 331 "-" "Mozilla/5.0 (compatible; MSIE 6.00; Windows NT 9.0)"
which (if you are familiar with webservers) looks about as wrong as you can 
get.

My guess is that the restraint is there because it's easier. I'd guess the 
script isn't very advanced, or they figure that they are better changing a 
few pages on lots of sites rather than lots of pages on a few sites.

> Most attacks I've seen limit the attacks to only a dozen or so
> pages on a site, and I've never quite figured out why this is the case
> if it's a bot.  Perhaps it's just a case of the parasite being
> careful not to kill the host organism?
Possible. If they filled a site with too many links, it might start to look to 
Google like a linkfarm, and lose it's contribution to the increasing ranks.

-- 
Robin <robin at kallisti.net.nz>             JabberID: <eythian at jabber.org>

Hostes alienigeni me abduxerunt. Qui annus est?

PGP Key 0xA99CEB6D = 5957 6D23 8B16 EFAB FEF8  7175 14D3 6485 A99C EB6D
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url : /pipermail/pmwiki-users_pmichaud.com/attachments/20050111/21acf3b7/attachment.bin