I've updated to Weatherwax RC1 and the latest captcha plugin (image + audio), and I'm turning registrations back on, so we'll see.
It is my strong impression that both the registrations and the spam profile pages were robot generated. One odd thing about the registrations is that the userid and real name matched, but often the email blatantly mismatched, like:
_______________________________________
A new user has registered. Here are the details:
User name : roland64eglygpz
Full name : Roland Macias
E-mail : AstridTanneraf4@hotmail.com
Date : 2013/05/03 18:49
Browser : Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
IP-Address : 5.135.46.155
Hostname : 5.135.46.155
______________________________________
Possibly the emails are real accounts that have been compromised. The IPs and user agents are all different too. This makes me suspect a botnet.
The spam pages were to two major types. Though both edits are called "profile_USERNAME", and are committed with are remark that "Just a profile page, hope you don't mind", one more-or-less resembles a profile, and the other is a "payload" page that contains a spurious review of penis pills or payday loans, or something like that. One of the "profile" pages I clicked through was to another very similar bogus looking profile on another site, and this one points to a very silly post:
Shoes are our life. We can't do without shoes; it had become the most important component of our day to day activity. Your child born wears it to keep shielded from allergens and dirt.
So these relate to SEO and link farming
Just now, I notice that the name in the profile page is yet another name, not matching either the "real name" or the email.
[root@ram attic]# zcat ./analysis/profile_roland64eglygpz.1367621936.txt.gz
Name: Marilou Lackey
Age: 22
Country: Switzerland
Town: Veyras
ZIP: 3968
Address: Via Stauffacher 70
Also visit my website: [[http://pairalink.info/story.php?title=helpful-resources-4|This Resource site]]
I too only recently started to get the spam pages, though I had been getting suspicious registrations for a while. I'm guessing that it may have taken them a while to get the spam code working. The bogus pages are getting created in random namespaces, probably the same namespace as their landing page, and not at the root.
>> When I deleted pages without deleting the user, the page got recreated.
I take that back. It's possible I got confused in "revert manager", because I was definitely having problems with reverting my reversions.
Rob