Just an update on how it looks like to me, now that I looked through all the logs and other files:
- Request from a specific (IP6-only) address started with a call to "robots.txt".
- Followed by hundreds of requests to every single web page on the server, including all the "old revisions" pages (shown as "&rev=..." in the logs.
- Didn't bother to download the site-map, but rather just spidered the whole site link-to-link.
- No problem with the majority of my site, except for the large number of requests in a relatively short time (not nice!)... until they encountered a link to the English sub-site, which is a separate DokuWiki instance, and unfortunately left "open" (my fault!) ... on there, the bot submitted empty pages on every single page it encountered... thus deleting all pages.
- User agent appears as Safari on Mac, but the behaviour is clearly bot-like. However, the user agent has one oddity, which turned out to be a company name...
- Checked company name ... apparently refers to a Swiss startup which has an "education search engine" in their project portfolio (which would fit to the topic of my wiki)
I informed both their hoster and the company itself of the issue, but no answer yet.
My take here is that this is a "startup" that goes by the principle of "move fast and break things", and in this case broke my wiki in the process. And yes, this looks like somebody tried their hands on programming a spider, without bothering to first learn how that is supposed to work, and what to do (check for a sitemap!) and what to avoid (like submitting "POST" requests).
I'll keep you informed about any news, because this thing may well break other sites as well (did I mention that you should all make regular backups? ;-)