UESPWiki:Administrator Noticeboard/Archives/New Bot

This is an archive of past UESPWiki:Administrator Noticeboard discussions. Do not edit the contents of this page, except for maintenance such as updating links.

New Bot

We appear to be the target of a new bot that inserts a single nonsense word at the top of an article, for example: [1] and [2]. There have so far been seven such edits made (although five are on pages that have been or are about to be deleted), all in the last 4-5 hours. To summarize:

• Oblivion:Quests/Anvil_Recommendation: 63.241.9.240 added "noviric"
• Oblivion_talk:Quests/Anvil_Recommendation: 192.115.104.88 added "noractadar"
• Oblivion:Quests/Mazoga_the_Orc: 63.241.9.240 added "trorrol"
• Tamriel_talk:Sload: 218.39.17.155 added "roervaracell"
• Oblivion:Quests/Paradise: 222.86.132.20 added "rollivarolod"
• Oblivion:Quests/Deliver_the_Amulet: 217.169.44.14 added "pasdarlar"
• Tribunal:Diary_of_a_Lost_Sailor: 202.101.189.126 added "eltcaa"

There is obviously a pattern here, and the fact that six different IPs have made such edits so far says that a bot is likely to behind it. The problem IMO is what can be done about it. Blocking an IP address for adding a single nonsense word to an article seems unreasonable: thousands of edits in the past match that description. There is no way to objectively tell the difference between one of these edits and a real person experimenting with the wiki for the first time by typing "asdfasdf". And most of the time we haven't even bothered to give warnings for edits like "asdfasdf". So far only only 63.241.9.240 (the only IP to make two of these edits) has been blocked.

On the other hand, keeping track of repeat offenders here is going to be difficult if the bot continues to hit pages like the Oblivion:Quests/* pages that are due for deletion anyway. Deleted nonsense edits won't subsequently show up in the IP's contribution history.

At the moment, I'm not too sure what to do here, but I thought I'd post the information in case anyone else has a brilliant idea ;) --Nephele^Talk 02:06, 26 September 2007 (EDT)

Well I'd agree it's a bot of some kind given all the different IP addresses but it seems unlikely to me that somebody would go to the trouble of developing a bot (or whatever exactly it is) to add a few letters of nonsense to a page. I'd guess that what we're seeing at the moment is the test phase of a new spambot, which means we can expect lots of new and exciting links to dubious sites sometime soon. If that's the case then the IP addresses can be blocked; no problem. If we keep getting these irritating edits then it may be time to look again at CAPTCHA implementations or even disallowing anonymous edits. --Rpeh^Talk 07:44, 26 September 2007 (EDT)

IPs for Blocking

• 217.169.44.14 - has now made three such edits (Oblivion:Quests/Deliver_the_Amulet above, Oblivion:Quests/Temple of the One and Oblivion:Quests/Liberation or Apprehension) --Rpeh^Talk 08:40, 26 September 2007 (EDT)

I just blocked it. The weird thing about this is the way it's mostly been targetting obsolete pages which need to be deleted anyhow. I wonder if the bot is aware that these pages are marked for deletion, and is perhaps attempting to fly under the radar by running tests on pages that nobody cares about? I agree with Rpeh, though, that this is likely just the first phase of a new spam attack. I've blocked 2 accounts already (both of which had made several of these nonsense edits, not just one). I realize that it may have been slightly premature to do so without first giving a warning, but I believe this behavior is almost certainly a bot which would never see such a warning, and I'd really rather not see what this thing has planned for us next. (Though we probably will anyhow.) If it really is a legitimate editor, which I highly doubt, well, they can complain on their talk page and ask the block to be lifted, but I don't think that's very likely to happen. --TheRealLurlock ^Talk 10:02, 26 September 2007 (EDT)