Here's a (probably non-exhaustive) list of accounts responsible:
https://wiki.mafiascum.net/index.php?ti ... tions/ADAM
https://wiki.mafiascum.net/index.php?ti ... atondon123
https://wiki.mafiascum.net/index.php?ti ... /Nehaknsl7
https://wiki.mafiascum.net/index.php?ti ... ikejack456
https://wiki.mafiascum.net/index.php?ti ... ons/Abhhii
https://wiki.mafiascum.net/index.php?ti ... ns/Sahilss
https://wiki.mafiascum.net/index.php?ti ... /Ankit1234
https://wiki.mafiascum.net/index.php?ti ... Devidewill
They've created a very large number of pages which all need deleting by a wiki admin. It'll be worth looking for any other accounts that are being used for this, too. (I strongly suspect that they're all the same person, possibly editing from compromised IPs rather than their own computer.)
I'm an admin on a non-Mafia-related wiki that's been attacked by the same spammer. (I'm pretty sure that it's a human who solves the CAPTCHAs, at least, which would explain how they managed to register an account on this wiki despite the account creation process being done on the forum). Here's a spam filter rule that seemed to help against the attack in question in the past (I haven't checked whether it would help against the latest attack):
Code: Select all
old_size = 0 & article_text rlike "1[^0-9]8[0-9][0-9][^0-9][0-9][0-9][0-9][^0-9][0-9][0-9][0-9][0-9]"