From Meta, a Wikimedia project coordination wiki

• www.travel-images.com, annoying commercial site that sells images.

Pls see diff http://it.wikipedia.org/w/index.php?title=Marocco&diff=388364&oldid=388363 and spam diffusion at: http://www.google.it/search?as_q=travel-images&num=10&as_sitesearch=wikipedia.org --M/ 11:18, 28 Jan 2005 (UTC)

Added. --Aphaia | WQ2翻訳中 | talk 20:23, 7 Feb 2005 (UTC)

• cgi.ebay.com, some users try to raise their sale by adding the link to their product on ebay. Possibly also include other language ebay sites. (for an example, see these Chris 73 02:15, 6 Feb 2005 (UTC)

Added. --Aphaia | WQ2翻訳中 | talk 20:23, 7 Feb 2005 (UTC)

• bertelsmann2club.be.funpic.de calls itself an FAQ, has no special infos, the webmaster just earns money, when you sign up with his refer.

1. http://de.wikipedia.org/w/index.php?title=Bertelsmann_AG&diff=3112349&oldid=2985486
2. http://de.wikipedia.org/w/index.php?title=Bertelsmann_AG&diff=0&oldid=4429338

--82.141.59.242 14:23, 9 Feb 2005 (UTC)

en:PHP is hit by a persistent spambot, that also attacked other wikis. See en:Wikipedia:Administrators' noticeboard#Continuing spambot attacks A number of links are added frequently, and maybe it would help to put them on the blocklist. Some of these are:

• incoherent.fragment.6x.to

-- 133.240.96.4 08:16, 10 Feb 2005 (UTC)

Hello. A spambot is attacking en:PHP, en:Cybercash, en:DBpp, en:DBM, en:CCVS, en:FrontBase, and also en:Consultative Group on Indonesia, en:Wikipedia talk:Friends of Wikipedia/Other wikis, en:Thatware and their talk pages, adding several dozen edits per day in some cases using multiple anon IPs.

Can you add all of these to the spam blacklist? I'd even recommend adding the top-level domains, eg: "6x.to", "uni.cc" and all of ".su" (old Soviet Union TLD, who legitimately uses it today?). -- Curps 19:30, 9 Feb 2005 (UTC)

bizarre-free-gallery.6x.to ass-fucking-gallery.6x.to bizarre-gallery.6x.to busty-babes-gallery.6x.to anal-gallery-hardcore.6x.to nude-beach.6x.to black-ebony-pussy.6x.to gallery-of-pretty-babes.6x.to asian-nude-gallery.6x.to spice-girl.6x.to blonde-fucking-gallery.6x.to sexy-brunette.6x.to logos-shower-galleries.6x.to beach-galleries.6x.to hot-cheerleader.6x.to topless-bikini-girl-gallery.6x.to

dose-valtrex.uni.cc lipitor-zocor-1.uni.cc pregnancy-zyrtec.uni.cc housewifes.uni.cc pfizer-celebrex.uni.cc discount-adipex.uni.cc indian-larry.uni.cc discount-adipex.uni.cc nude-africa.uni.cc granny-post.uni.cc manufacturer-renova.uni.cc acyclovir-valtrex.uni.cc apache-indians.uni.cc enema-fetish-gallery.uni.cc carmen-electra-nude.uni.cc housewifes-picture.uni.cc pic-of-jenna-jameson.uni.cc despret-housewifes.uni.cc prescription-valtrex.uni.cc zocor-recall.uni.cc elephant-list-links.uni.cc indian-woman.uni.cc xenical-diet-pill.uni.cc

Cigarettes.nov.su Shopping.grozny.su Toys.grozny.su Vicodin.karacol.su Pain-relief.karacol.su Blackjack.ivanovo.su card.togliatti.su mortgages.vologda.su Phone.tselinograd.su Blackjack.tselinograd.su Pharmacy.nalchik.su Gambling.termez.su maxtor.tuva.su maxtor.lenug.su Phone.belgorod.su Percocet.spb.su Phone.north-kazakhstan.su Hobby.armenia.su Gambling.bryansk.su Baccarat.aktyubinsk.su

Prescription.kalmykia.ru Gambling.adygeya.ru Hobby.adygeya.ru Gambling.grozny.ru Pain-relief.bashkiria.ru Tramadol.cbg.ru Percocet.vladikavkaz.ru mortgages.vladimir.ru

I am seriously thinking about the idea of just filtering out all uni.cc and 6x.to addresses, but are there any legitimate links that would be affected by this? Or are they only used by spammers? What about on the non-English wikis? Silsor 01:28, Feb 10, 2005 (UTC)

Google shows a couple of legitimate uni.cc addresses and a couple of legitimate 6x.to addresses. I don't know what the solution to this is... he is probably using throwaway domains, registering new ones on a continuous basis. I suspect he may be using hacked zombie machines all over the Internet, because I saw at least one AOL IP, so that definitely wasn't an open proxy. -- Curps 01:39, 10 Feb 2005 (UTC)

Is there any way to tell the filter to operate in reverse for certain TLDs, as in "block all 6x.to addresses except this list?" Sort of like hosts.allow and hosts.deny in Unix? -- Curps 02:06, 10 Feb 2005 (UTC)

There is now a bug open for this [1]. Silsor 02:59, Feb 10, 2005 (UTC)

The bot is following links. I added a vprotect notice to en:Wikipedia talk:Recent additions 20 which generated a bogus link to en:Wikipedia talk talk:Recent additions 20. A spam page was promptly created there... -- Curps 02:06, 10 Feb 2005 (UTC)

The attack has spread to en:PL/I and en:PHP-Nuke. It could easily spread to many other pages. At this point I'd say block all of 6x.to and uni.cc (despite the 2-3 legit external links that use them) and all of .su. This is an extremely serious situation. -- Curps 08:06, 10 Feb 2005 (UTC)

halloween-costume-idea.6x.to gilmore-girl.6x.to

discount-didrex.uni.cc lortab-overdose.uni.cc nude-female.uni.cc gay-bear-gallery.uni.cc

Canadian-pharmacy.cbg.ru

Blackjack.georgia.su Gambling.exnet.su Tramadol.aktyubinsk.su

amateur-gallery.6x.to rap-olympics.6x.to

Baccarat.murmansk.su

Feb 12:

Shopping.bryansk.su Baccarat.mordovia.su Pain-relief.adygeya.ru

• pillsbook.com [2] [3]
  • Note:
    • It hit the same page en:PHP as the recent Russian bot
    • The vandalism is the same type: replace one entire section with a spam link
    • Similar IP range: 69.50.166.194 = pillsbook.com; 69.50.170.83 = percocet.spb.su
    • Google on "pillsbook" shows a large number of subdomains that strongly suggest spam use: online.poker.pillsbook.com, debt.consolidation.pillsbook.com, refinance.mortgage.pillsbook.com, viagra.pharmacy.pillsbook.com, etc.
    • Bizarre disclaimer at www.pillsbook.com and its subdomains, which effectively asks never to be linked to: This webpage and the entire domain is owned, maintained and to be viewed by Joan Stableton only. The information is collected from the open resources of Internet for PERSONAL EDUCATIONAL purposes only - to access material needed in studies from everywhere. If you are not Joan Stableton, the fact that you are viewing this webpage can only be a result of internal server failure that is being fixed now. If you are not Joan Stableton, please leave this page NOW. Thank you.
    • -- Curps 17:33, 13 Feb 2005 (UTC)

Please consider adding

• kajagoogoomania.proboards33.com/ (98 members, <500 total posts)
• duranduran.cjb.net/ (56 members, <500 total posts)

They're a minor annoyance and non-commercial, but an anon user with constantly changing IPs (and no other substantial edits) has been consistently re-adding them for the last six months, occasionally edit-warring to keep them in. (evidence). Catherine 23:38, 14 Feb 2005 (UTC)

Added, because it happens on multiple articles. silsor 02:08, Feb 15, 2005 (UTC)

• The Duran/Kaja guy blocked yesterday has alternate urls for the blocked sites. Could you please consider also blocking: kaja.cjb.net/ - kajagoogoo.cjb.net/ - limahlmania.cjb.net/ - duranmania.proboards27.com/
  • Investigation of his sites shows he also owns a few others, which don't appear to have been abused (yet); the mjj one has been in the Michael Jackson article unchallenged for a long time: www.kajagoogoo.co.nr/ - www.limahl.co.nr/ - mjj.cjb.net - michaeljjackson.proboards46.com - slim-k.cjb.net/ (in fact, it appears that the anon in question might BE Slim K, and the en:Slim K article a vanity job....) Thanks for having a look! Catherine 18:06, 15 Feb 2005 (UTC)
  • I expanded the existing filter to filter the new ones that were used on en. silsor 18:42, Feb 15, 2005 (UTC)

• Car-related articles on en.wikipedia are getting spammed with links to www.autospectator.com. [4] is an example diff. This site is simply an advertising vehicle that attempts to get high enough Google rankings to get hits, but has only trivial content. Linking it here is an attempt to get Google ranking, and it should IMO be blocked. Morven 17:56, 21 Jan 2005 (UTC)
  • Added. silsor 03:45, Feb 15, 2005 (UTC)

• www.golfcards.com and www.golftour.de commercial links that are frequently inserted in german de:Golf (Sport). Hadhuey 17:49, 6 Jan 2005 (UTC)
• www.golfcards.com (as above) and www.presidentcard.com, commercial links that are frequently inserted in Danish da:Golf. Byrial 19:12, 11 Jan 2005 (UTC)
  • Added, sorry for the long turnaround. silsor 03:45, Feb 15, 2005 (UTC)

• Please add flash88.51.net, www.gghggh.com, www.paper-translation.com, www.law-translation.com, www.book-translation.com, www.sowang.com/translation.htm, online.paper-translation.com/, www.acmetranslation.com, www.commerce-translation.com. Anoying moron(s) spamming ervery wiki online. Spammed on Meta,

Commons and pl. -83.129.21.131 09:13, 12 Jan 2005 (UTC)

• Although this is a cross-wiki incident, it seems to also be an isolated one. silsor 03:45, Feb 15, 2005 (UTC)

  Checking this out ... silsor 19:07, Feb 15, 2005 (UTC)

  Google says this has been spammed on dozens or hundreds of other wikis. Adding to our blacklist. silsor 20:59, Feb 15, 2005 (UTC)

• syn.cs.pdx.edu/wiki got linkspammed the other day: [5]. Source IP was 212.164.71.254. If you google for that ip, you see a lot of wiki logs that have been similarly spammed.

--24.22.27.155 04:06, 20 Jan 2005 (UTC)

• • I'm not sure this is enough reason to blacklist the site. silsor 03:45, Feb 15, 2005 (UTC)
  • Okay, I reviewed this again and most of the sites that were spammed are included in our new uni.cc and 6x.to blacklist. silsor 00:06, Feb 16, 2005 (UTC)

• newsmotion.com. Repeatedly added to the country articles on en: with varying IPs. Ahoerstemeier 12:45, 17 Feb 2005 (UTC)

  Could you provide some examples please? silsor 22:10, Feb 17, 2005 (UTC)

  [7], [9] Ahoerstemeier 16:14, 18 Feb 2005 (UTC)

  Okay, I think this is blacklist material, especially since they are blatantly spamming links to different news stories on their site throughout some articles. Added. silsor 23:54, Feb 18, 2005 (UTC)

www.hongkong-guide.de in de:Hongkong: [10] [11] [12] [13] [14] [15] ... and so one --141.76.1.121 00:13, 13 Feb 2005 (UTC)

• • This looks like an isolated attack that should be dealt with by protection and blocking. Was that the only page that was targeted? It looks like it's from a single ISP as well. silsor 00:19, Feb 13, 2005 (UTC)

ISP is "DEUTSCHE TELEKOM AG" and one page was targeted. --141.76.1.121 02:06, 13 Feb 2005 (UTC)

I would like to add it to the list. Is there a protocol how to do that? Maybe an email address where these urls can be sent to? Another thing, if these urls are put on this page. Isn't the spam effective after all then? Maybe they should be mangled, something like what I did to the above one. Anyway, I think this is a great idea. Fixing the problem right at the root. Polyglot 14:22, 17 Dec 2004 (UTC)

• • Declined, no reason given, can't tell whether it would be appropriate to add this or not. silsor 03:45, Feb 15, 2005 (UTC)

see http://it.wikipedia.org/wiki/Discussione:Argentina?curid=67603&diff=0 really annoying on it.wiki. TY --M/ 20:22, 9 Jan 2005 (UTC)

• • Can you provide any more examples of this happening? silsor 03:45, Feb 15, 2005 (UTC)

You can find some more evidence in Talk:Spam blacklist/piras-peron --M/ 23:43, 15 Feb 2005 (UTC)

piras-peron

• http://it.wikipedia.org/wiki/Speciale:Undelete/Juan_Peron (accessible to admin)
  • 11:00, Set 17, 2004 . . 62.11.201.110 ()
• http://it.wikipedia.org/w/index.php?title=Discussione:Juan_Domingo_Per%C3%B3n_Sosa&action=history
  • 14:38, Ott 25, 2004 62.11.211.213 (CHI ERA JUAN PERON? La verità sulle origini)
  • 23:01, Nov 9, 2004 62.11.136.141 (i due atti di nascita di Juan Pomingo Peron)
  • 23:36, Nov 9, 2004 62.11.136.141 (il mistero Peron)
  • 00:24, Nov 17, 2004 200.225.248.10 (juan peron)
• http://it.wikipedia.org/wiki/Speciale:Undelete/Discussione:1919 (accessible to admin)
  • 3:43, Gen 8, 2005 . . 195.210.65.23 ()

http://it.wikipedia.org/w/index.php?title=Discussione:Argentina&action=history

• • 20:50, Gen 9, 2005 195.210.65.32

This is annoying, I agree, but not an issue for the spam blacklist. It's one person posting a lengthy section about Juan Peron and usually including a link to that site at the bottom. Only from two IP ranges as well. The it: admins should deal with this themselves. silsor 00:01, Feb 16, 2005 (UTC)

(Moved from User talk:silsor)
Hello Silsor! Please be so kind and ban vho-dot-org, at least for the german wikipedia. They serve various books banned by the german law and various other stuff (antisemitic, "revisionistic holocaust-theories" etc. pp.). I would be happy if I didn't have to give a link (there was one today to a banned book), cause promoting that kind of desinformation is a serious crime in Germany.

There is no way to ban a URL on only one wiki. Ask your local admins to handle this. silsor 17:37, Feb 24, 2005 (UTC)

• razored.net, has been repeatedly spammed to the indian ocean earthquake and tsunami articles on en:. Fvw 20:21, 15 Jan 2005 (UTC)
  • Link please? silsor 03:45, Feb 15, 2005 (UTC)
    • Archived. silsor 10:50, Mar 6, 2005 (UTC)

• www.aktivepolitik.de its a highly POV Anti-American page which keeps reappearing on the German Wikipedia in several articles concerning US foreign policy (WW II, War on Terror, War on Irak, USA etc.). It was removed at least 30 to 40 times. -- Southgeist 22:49, 13 Feb 2005 (UTC)

  Can the de: admins not handle this themselves? What about a link to any of the articles? Is the spammer using different IPs? What are the names of these articles in German? Can you show any examples of the spam? Etc, etc. silsor 23:29, Feb 13, 2005 (UTC)

  • • Archived. silsor 10:50, Mar 6, 2005 (UTC)

• handbag.tamsquare.com and www.famousleather.com. We got hit by a spammer with a long list of html pages from these sites today. [16] RickK 08:31, 18 Feb 2005 (UTC)

  Was this spammed by more than one IP, or more than once? It looks like the en: administrators handled it easily. silsor 08:45, Feb 18, 2005 (UTC)

  • • Archived. silsor 10:50, Mar 6, 2005 (UTC)

I think http://en.thinkexist.com should be blocked - the owner adds it again and again to promote his quotation website, regardsless being told many times it has wikiqoute for that. Ahoerstemeier 17:34, 21 Nov 2004 (UTC)

Evidence please? silsor 03:45, Feb 15, 2005 (UTC)

Archived. silsor 10:50, Mar 6, 2005 (UTC)

Please add filter for cracowonline.com. See http://en.wikipedia.org/wiki/Talk:Krakow#Spam --Gene s 11:06, 3 Dec 2004 (UTC)

Is this the only page that has been spammed? silsor 03:45, Feb 15, 2005 (UTC)

Archived. silsor 10:50, Mar 6, 2005 (UTC)

Please add the following URLs (all posted dozens of times from multiple IPs) to the spam regex:

http://www.badmintonfan.com

http://www.nbpv.com

http://www.yide-sh.com

http://www.best-deals-online-gambling.info

http://www.top-deals-online-pharmacy.info

http://www.best-deals-levitra.info

http://www.top-deals-pills.info

http://www.best-deals-tramadol.info

http://www.best-deals-weight-loss.info

http://www.best-deals-diet.info

http://www.top-deals-viagra.info

http://www.best-deals-hotels.info

http://www.best-deals-roulette.info

http://www.credit-reports-4u.info

http://www.credit-report-4u.info

http://www.mortgage-calculators-ebanking.info

http://www.mortgage-4-u.info

http://www.private-mortgage-insurance-ebanking.info

http://www.student-loans-ebanking.info

http://www.loans-4-u.info

http://www.health-insurancedeals-4u.info

http://www.auto-insurancedeals-4u.info

http://www.car-insurancedeals-4u.info

http://www.insurancedeals-4u.info

http://www.insurance-quotesdeals-4u.info

http://www.credit-card-applications-4u.info

http://www.hotelse-site.info

http://www.hotele-site.info

http://www.las-vegas-hotels-e-site.info

http://www.cheap-hotels-e-site.info

http://www.hotel-dealse-site.info

http://www.travel-e-site.info

http://www.top-e-site.info

http://www.air-travel-e-site.info

http://www.great-e-site.info

http://www.car-rental-e-site.info

http://www.car-rentals-e-site.info

http://www.rental-car-e-site.info

http://www.deal-e-site.info

http://www.dating-e-site.info

http://www.online-dating-e-site.info

http://www.dating-site-e-site.info

http://www.adult-dvd-top-shop.info

http://www.dvd-top-shop.info

http://www.digital-camera-esite.info

http://www.digital-cameras-esite.info

http://www.golf-e-course.info

http://www.golf-clubs-e-course.info

See the edit history of en:Comment for a good example of how long this has been going on. The same spammers have also targeted BerliOS relentlessly. Note that some of the URLs look like repeats, but they're actually slightly different. I know it's a long list (took me a while to compile), but filtering them would be very helpful. -- Hadal 07:20, 9 Dec 2004 (UTC)

And a few more:

http:// www.hzyage.com

http:// www.51wisdom.com

http:// www.hhboy.com

http:// www.livingchina.cn

http:// www.dzsc.com

http:// www.ic37.com

http:// www.cnzsw.com

http:// www.51wisdom.com

http:// www.sj-qh.com

http:// www.my512.com

http:// www.fj-zhanhong.com

Thanks. -- Hadal 07:39, 9 Dec 2004 (UTC)

some www.numbers.com removed because they were already filtered, and blocked the update. --grin 20:50, 14 Jan 2005 (UTC)

Is this spam still continuing? Sorry for the long turnaround time. silsor 03:45, Feb 15, 2005 (UTC)

Archived. silsor 10:50, Mar 6, 2005 (UTC)

A user (bryan Derksen) left a note on my my en talk page regarding the website claudiabeni-fansite.6x.to, which is linked to on wikipedia:en:Claudia Beni. It seems like a perfectly appropriate website, but its presence was keeping him from adding a category. The website doesn't appear to be listed on the spam filter page, though, so I don't know how to fix this. Can someone help? TUF-KAT 14:44, 27 Feb 2005 (UTC)

Nevermind, I got it. TUF-KAT 18:02, 27 Feb 2005 (UTC)

Not sure if this can be part of the spamfilter, but a particularily nasty vandal redirected pages to some cache> the text he inserted was #REDIRECT[[cache:http://www.oralse.cx/]]. See the Chris 73 11:56, 18 Feb 2005 (UTC)

Brion disabled this, shouldn't be a problem anymore. silsor 12:51, Feb 18, 2005 (UTC)

Retrieved from "https://meta.wikimedia.org/w/index.php?title=Talk:Spam_blacklist/Archives/2005-02&oldid=1210144"

Categories:

• Talk archives
• Spam blacklist archives