[Systems] wiki account creation, Talk page spam

[Frederick Grose]

On Wed, Jul 14, 2010 at 9:05 AM, Bernie Innocenti <bernie at codewiz.org>
wrote:
>
> El Tue, 13-07-2010 a las 21:49 -0400, Frederick Grose escribió:
>
> >[...]
> > This has prevented the spam, but the server and database may still be
> > under attack.

Notice this pattern on http://wiki.sugarlabs.org/go/Special:BlockList :

10:32, 14 July
2010, FGrose (Talk | contribs | block) blocked Alcrapinten (Talk |
contribs) (infinite,
account creation blocked, e-mail blocked) (Spamming links to external
sites) (unblock | change block)
10:32, 14 July 2010, FGrose (Talk | contribs | block) blocked #386 (expires
on 15 July 2010 at 10:32, account creation blocked)(Autoblocked because your
IP address has been recently used by "Alcrapinten". The reason given for
Alcrapinten's block is: "Spamming links to external sites") (unblock)
     (from moments ago)

and from yesterday:
21:07, 13 July 2010, Patrol (Talk | contribs | block) blocked #381 (expires
on 14 July 2010 at 21:07, account creation blocked)(Autoblocked because your
IP address has been recently used by "Sarismalo". The reason given for
Sarismalo's block is: "Spamming links to external sites") (unblock)
21:07, 13 July
2010, FGrose (Talk | contribs | block) blocked Asdasd112w (Talk |
contribs) (expires
on 13 August 2010 at 21:07, account creation blocked, e-mail
blocked) (suspect creation) (unblock | change block)

Does this suggest a continuing attack, a server queue, or something else?

If there is interest, someone with capability might preserve the server logs
to help understand the attack.

Or, perhaps the server monitors show no threat?, and we can just leave
OpenID as the new account authority provider for the time being to
experience its advantages and disadvantages.  So far, it seems effective
with one serious attack vector.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.sugarlabs.org/private/systems/attachments/20100714/c39aa9bb/attachment.htm