[MediaWiki-l] Just got bombed by spam bots

classic Classic list List threaded Threaded
5 messages Options
Reply | Threaded
Open this post in threaded view
|

[MediaWiki-l] Just got bombed by spam bots

Yudi Wijaya
Dear all,
My site ( www.indopancing.com/wiki ) just got bombed by spam bots since
last week, i already implement re-captcha few days ago on user
registration, but still not help.
Then, i try protect all access from spam bots:

---cut---

$wgGroupPermissions['*']['createaccount'] = false;
$wgGroupPermissions['sysop']['createaccount'] = false;

$wgGroupPermissions['*']['edit'] = false;
$wgGroupPermissions['user']['edit'] = false;
$wgGroupPermissions['sysop']['edit'] = true;

# Anonymous users can't create pages
$wgGroupPermissions['*']['createpage'] = false;

# Only users with accounts four days old or older can create pages
# Requires MW 1.6 or higher.
$wgGroupPermissions['*'            ]['createpage'] = false;
$wgGroupPermissions['user'         ]['createpage'] = false;
$wgGroupPermissions['sysop']['createpage'] = true;

---cut---

Looks like it's working, no spam bots anymore..

Now, the next problem is my wiki site:
- Full of user account junk from spam bots
- Full of new page creation from spam bots

Luckily the spam bots not change/edit my wiki page.

I already backup the MySQL database with phpMyAdmin

What do you think?
1. Does using http://www.mediawiki.org/wiki/Extension:BlockandNuke is safe?
I just create / edit new page using admin account, there is no other
account create / edit page.
2. Actually I prefer do fresh installation of MediaWiki and copy paste 1000
contents from old one to the new one. Because i worry deleting user account
/ page from spam bots still leave junk in my site.

Do you have any sugestion for this problem?

Thank you

Best Regards,
Yudi
_______________________________________________
MediaWiki-l mailing list
[hidden email]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-l
Reply | Threaded
Open this post in threaded view
|

Re: Just got bombed by spam bots

George Barnick
BlockAndNuke will likely be very useful to you. I don't think a fresh
MediaWiki installation would be ideal, since it would allow for spambots to
rejoin and spam using the same usernames and IP addresses as you have
already blocked. It would just create more work.

One solution I can tell you from experience is very useful when dealing
with spambots is AbuseFilter. I work as an administrator on a couple
projects on a rather large wiki farm ( http://www.brickimedia.org ) and
after implementing abusefilters to disallow or warn users when they trip a
filter, I haven't seen an actual spambot account in several months. If you
would like to use some of the abusefilters I've made (or adapted), I'd be
perfectly willing to send you two of the most useful ones I have.

Kind Regards,
George Barnick
_______________________________________________
MediaWiki-l mailing list
[hidden email]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-l
Reply | Threaded
Open this post in threaded view
|

Re: Just got bombed by spam bots

chris tharp-2
In reply to this post by Yudi Wijaya
Hi all

My site had the same problem. The best answer I ever found was the ConfirmEdit extension combined with dynamic questions. See here:  http://thingelstad.com/stopping-mediawiki-spam-with-dynamic-questy-captchas/

It has effectively wiped out spam on my site (a very, very large site). I was spending upwards of two hours a day just cleaning spam out before
I found Thingelstad's beautiful answer.

Sent from my iPad

On Mar 6, 2014, at 5:02 PM, Yudi Wijaya <[hidden email]> wrote:

> Dear all,
> My site ( www.indopancing.com/wiki ) just got bombed by spam bots since
> last week, i already implement re-captcha few days ago on user
> registration, but still not help.
> Then, i try protect all access from spam bots:
>
> ---cut---
>
> $wgGroupPermissions['*']['createaccount'] = false;
> $wgGroupPermissions['sysop']['createaccount'] = false;
>
> $wgGroupPermissions['*']['edit'] = false;
> $wgGroupPermissions['user']['edit'] = false;
> $wgGroupPermissions['sysop']['edit'] = true;
>
> # Anonymous users can't create pages
> $wgGroupPermissions['*']['createpage'] = false;
>
> # Only users with accounts four days old or older can create pages
> # Requires MW 1.6 or higher.
> $wgGroupPermissions['*'            ]['createpage'] = false;
> $wgGroupPermissions['user'         ]['createpage'] = false;
> $wgGroupPermissions['sysop']['createpage'] = true;
>
> ---cut---
>
> Looks like it's working, no spam bots anymore..
>
> Now, the next problem is my wiki site:
> - Full of user account junk from spam bots
> - Full of new page creation from spam bots
>
> Luckily the spam bots not change/edit my wiki page.
>
> I already backup the MySQL database with phpMyAdmin
>
> What do you think?
> 1. Does using http://www.mediawiki.org/wiki/Extension:BlockandNuke is safe?
> I just create / edit new page using admin account, there is no other
> account create / edit page.
> 2. Actually I prefer do fresh installation of MediaWiki and copy paste 1000
> contents from old one to the new one. Because i worry deleting user account
> / page from spam bots still leave junk in my site.
>
> Do you have any sugestion for this problem?
>
> Thank you
>
> Best Regards,
> Yudi
> _______________________________________________
> MediaWiki-l mailing list
> [hidden email]
> https://lists.wikimedia.org/mailman/listinfo/mediawiki-l
_______________________________________________
MediaWiki-l mailing list
[hidden email]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-l
Reply | Threaded
Open this post in threaded view
|

Re: Just got bombed by spam bots

Nathan Larson
In reply to this post by George Barnick
BlockandNuke looks pretty good, except that I don't like the idea of
deleting stuff completely from the database. Therefore, I might create a
fork of that or of
BlockBatch<https://www.mediawiki.org/wiki/Extension:BlockBatch>to
revert rather than nuke changes. I've started a page to brainstorm
antivandalism development ideas:
https://www.mediawiki.org/wiki/Countervandalism_development


On Thu, Mar 6, 2014 at 8:11 PM, George Barnick <[hidden email]
> wrote:

> BlockAndNuke will likely be very useful to you. I don't think a fresh
> MediaWiki installation would be ideal, since it would allow for spambots to
> rejoin and spam using the same usernames and IP addresses as you have
> already blocked. It would just create more work.
>
> One solution I can tell you from experience is very useful when dealing
> with spambots is AbuseFilter. I work as an administrator on a couple
> projects on a rather large wiki farm ( http://www.brickimedia.org ) and
> after implementing abusefilters to disallow or warn users when they trip a
> filter, I haven't seen an actual spambot account in several months. If you
> would like to use some of the abusefilters I've made (or adapted), I'd be
> perfectly willing to send you two of the most useful ones I have.
>
> Kind Regards,
> George Barnick
> _______________________________________________
> MediaWiki-l mailing list
> [hidden email]
> https://lists.wikimedia.org/mailman/listinfo/mediawiki-l
>



--
Nathan Larson <https://mediawiki.org/wiki/User:Leucosticte>
_______________________________________________
MediaWiki-l mailing list
[hidden email]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-l
Reply | Threaded
Open this post in threaded view
|

Re: Just got bombed by spam bots

Jonathan Aquilina
I am not sure what web server you are using but I have seen mod spamhaus
which is a module for apache which using DNSBL's to block bot nets etc.


On Fri, Mar 7, 2014 at 3:35 AM, Nathan Larson <[hidden email]>wrote:

> BlockandNuke looks pretty good, except that I don't like the idea of
> deleting stuff completely from the database. Therefore, I might create a
> fork of that or of
> BlockBatch<https://www.mediawiki.org/wiki/Extension:BlockBatch>to
> revert rather than nuke changes. I've started a page to brainstorm
> antivandalism development ideas:
> https://www.mediawiki.org/wiki/Countervandalism_development
>
>
> On Thu, Mar 6, 2014 at 8:11 PM, George Barnick <
> [hidden email]
> > wrote:
>
> > BlockAndNuke will likely be very useful to you. I don't think a fresh
> > MediaWiki installation would be ideal, since it would allow for spambots
> to
> > rejoin and spam using the same usernames and IP addresses as you have
> > already blocked. It would just create more work.
> >
> > One solution I can tell you from experience is very useful when dealing
> > with spambots is AbuseFilter. I work as an administrator on a couple
> > projects on a rather large wiki farm ( http://www.brickimedia.org ) and
> > after implementing abusefilters to disallow or warn users when they trip
> a
> > filter, I haven't seen an actual spambot account in several months. If
> you
> > would like to use some of the abusefilters I've made (or adapted), I'd be
> > perfectly willing to send you two of the most useful ones I have.
> >
> > Kind Regards,
> > George Barnick
> > _______________________________________________
> > MediaWiki-l mailing list
> > [hidden email]
> > https://lists.wikimedia.org/mailman/listinfo/mediawiki-l
> >
>
>
>
> --
> Nathan Larson <https://mediawiki.org/wiki/User:Leucosticte>
> _______________________________________________
> MediaWiki-l mailing list
> [hidden email]
> https://lists.wikimedia.org/mailman/listinfo/mediawiki-l
>



--
Jonathan Aquilina
_______________________________________________
MediaWiki-l mailing list
[hidden email]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-l