From Meta, a Wikimedia project coordination wiki

(Redirected from Talk:Spam blacklist/Archives/2005/09)

Not a usual spam, seems to be instead some sort of adware which causes the links to be inserted (with obvious HTML formatting instead of wiki formatting) when a page is edited.

Samples can be found at en:Special:Contributions/70.146.152.173. For instance:

• [1]
• [2]

--cesarb 8 July 2005 22:03 (UTC)

Also en:Special:Contributions/65.1.214.82 and [3] and en:Special:Contributions/68.21.9.142. Looks like it's not a single infected computer. --cesarb 20:14, 9 July 2005 (UTC)

Added, thanks. --cesarb 20:40, 9 July 2005 (UTC)

• diff from main page spam
• Google search for other targetted sites

+sj | Translate the Quarto |+ 01:56, 14 July 2005 (UTC)

• • Added - Andre Engels 22:38, 20 July 2005 (UTC)

I am requesting an addition of the flats.h1.ru link, which is continuously being added to several articles in English Wikipedia. The link leads to the website of a company that rents apartments in different cities around the world. Diffs (some add the link along with bits of useful information or editing):

In en:Yekaterinburg—[4], [5], [6], [7], [8], [9], [10], [11], [12], [13].

In ru:Екатеринбург—[14], [15], [16].

In en:Riga—[17], [18].

In ru:Рига—[19], [20], [21].

In en:Odessa—[22].

In ru:Одесса—[23].

There may be more similar edits that I am not aware of.

The en:User:Vic-vic seems to be the person behind this. I advised him numerous times not to add the link as it is considered commercial and move it to WikiTravel instead (for the discussion flow (in Russian), see en:User talk:Vic-vic). I had to block the user for 24 hours once. The user finally complied, but then returned, adding the link from different IP addresses. He later impersonated ru:Участник:HedgeBot—a legit Russian WP user—creating an account with the same name in English Wikipedia (see en:User:HedgeBot, en:User talk:Ezhiki.—Ezhiki 18:40, 14 Jun 2005 (UTC)

There is a very persistent linkspammer on en, who is changing IPs within what appears to be a large IP range. A quick block of some of the links he posts may deter him.

See en:User:Nigosh/linkspammers for some of the IPs he has used. The spamming is a mixture of new pages and edits, so the empty contrib lists are probably because all the new pages have been deleted.

Actually, the empty contribs are generally clean as far as I know, I added three above and below the active range to monitor for other events. I don't think many new pages are being made at present (I have only seen one), so I would only recommend action against those IPs with an obvious history at present - Nigosh 10:38, 21 July 2005 (UTC)

Among the links which could be blocked are

• nerdcamp.net
• duplo.dnip.net
• funnydog.prettyfar.com
• fakir.zenno.info
• shemtop.bpa.nu

Thue 09:36, 21 July 2005 (UTC)

I've added those 5 to the blacklist. Angela 19:35, 21 July 2005 (UTC)

It is not working yet; See fx the edit [24] from today, which contains a link to duplo.dnip.net . Thue 12:19, 22 July 2005 (UTC)

I don't get it, the edit diff I linked above was made after Angela's addition to the blacklist, but when I tried to insert the same edit which the linkspammer had used on en the edit was stopped by the blacklist? Thue 12:35, 22 July 2005 (UTC)

Apparently a quite fast spambot, coming from various IP of the 69.50.18x.xxx range. See e.g. Ahoerstemeier 12:00, 26 July 2005 (UTC)

'Done Raul654 00:47, 27 July 2005 (UTC)

This is the Atrivo spammer listed above. -- Cyrius 01:31, 27 July 2005 (UTC)

Guerrilla Marketing/ Spamming by the owner of the already added domain "handycool\.de": ( http://de.wikipedia.org/w/index.php?title=Mobiltelefon&action=history )

They own at least the following domains, please add them all:

• handycool.de (already added)
• handy-cool.de
• 1-handys.de
• 2-handys.de
• profi-handys.de
• handy-fun.tk
• handy-kaufhaus.tk

Done. UninvitedCompany 18:47, 5 August 2005 (UTC)

Linkspam here.--80.136.166.185 19:35, 4 August 2005 (UTC)

Done. UninvitedCompany 18:52, 5 August 2005 (UTC)

Spam with different IPs on several pages including the german wikipedia main page and the german wikinews mainpage. I tried to talk friendly to a person affiliated in IRC, who announced that this won't stop, because the website likes to get more hits.

"Important" Examples: [26], [27], [28], ... --Avatar 21:35, 1 Jul 2005 (UTC)

• modz.de added - Andre Engels 17:22, 9 August 2005 (UTC)

In ja.wp the linkspammer also posts a lot, and we have deleted such spams for 11 times. Those spams contain links to...

• bpa.nu
  • aftar.bpa.nu
  • crionica.bpa.nu
  • shemtop.bpa.nu

• cable.nu
  • streamings.cable.nu

• dnip.net
  • duplo.dnip.net

• dundeeleagues.ca
  • fectr.dundeeleagues.ca

• fidosoft.de
  • kisa.fidosoft.de
  • primer.fidosoft.de

• homes.com.au
  • sherlok.homes.com.au

• nerdcamp.net
  • author.nerdcamp.net
  • chaka.nerdcamp.net
  • dabest.nerdcamp.net
  • ferdrubt.nerdcamp.net
  • freedom.nerdcamp.net
  • popov.nerdcamp.net

• prettyfar.com
  • funnydog.prettyfar.com
  • perfection.prettyfar.com

• whyza.net
  • whoisi.whyza.net

• zenno.info
  • bidlo.zenno.info
  • fakir.zenno.info

--Sylphie 06:25, 27 July 2005 (UTC)

I restored the revisions posted by the spammer and they are now on ja:Wikipedia:Spam/日本歯周病学会. Those spams were continuously posted to the article ja:日本歯周病学会. Sylphie 01:11, 29 July 2005 (UTC)

I don't feel comfortable adding so many entries at once without seeing some diffs. Perhaps Silsor or another meta admin will feel differently. UninvitedCompany 18:58, 5 August 2005 (UTC)

I have added them all apart from the fidonet.de addresses. They are all linking through to the same collection of porn links. - Andre Engels 17:22, 9 August 2005 (UTC)

Various IPs added a link to varios articles in the German Wikipedia today. Examples: http://de.wikipedia.org/w/index.php?title=Viagra&diff=8100435&oldid=8099355 http://de.wikipedia.org/w/index.php?title=Viagra&diff=prev&oldid=8098055 http://de.wikipedia.org/w/index.php?title=Kimi_R%C3%A4ikk%C3%B6nen&diff=prev&oldid=8098250 82.83.136.41 22:26, 31 July 2005 (UTC)

• Added. - Andre Engels 17:22, 9 August 2005 (UTC)

There's a spammer who attacks a number of articles on enwiki, particularily the articles w:Alprazolam, w:Pharmacy, w:Anxiety, and w:Pharmacist. The spammer operates from a number of different IP addresses and has been persistantly linkspamming the same urls for about 2-3 months. The spammer often adds "Sorry!" or "Thanks" or something similar at the beginning of each block of links, and is a nuisance on the articles that get spammed (at the time of writing, w:Pharmacy is protected because of the spammer.)

Some examples: [29] [30] [31] [32] [33] [34] [35] [36]

URLs I'm requesting the blacklisting of are the following:

• webzdarma.cz
• bigsitecity.com
• newmail.ru
• mujweb.cz
• sweb.cz

Thanks, Yelyos 07:39, 8 August 2005 (UTC)

Blocked by Brion, but mostly unblocked and replaced by more restricted blocks now. - Andre Engels 17:22, 9 August 2005 (UTC)

Could petitiononline.com be added? At the Dutch Wikipedia Elvis Presley article, the link http://www.petitiononline.com/041972/petition.html has already been added over ten times in the past 2 weeks, by at least 10 different IP-addresses, only to be repeatedly removed again by users. - Andre Engels 16:05, 9 August 2005 (UTC)

Links to additions:

• On nl: [37], [38], [39], [40] and several more
• On de: [41], [42], [43], [44], [45], [46] and many more
• On en: [47], [48] (probably more, but there's another large edit war going on on the page too)
• On it: [49], [50], [51]
• The link was also added on es, fr, ja pt and sv, but did not get reverted there. - Andre Engels 16:42, 9 August 2005 (UTC)

Added. UninvitedCompany 20:18, 10 August 2005 (UTC)

spammed in ja.wp. [52] [53] [54] [55]. --Tietew 15:14, 28 August 2005 (UTC)

There has been a rash of modifications to film-related articles to link to the "American Film Foundation" . Initially these were done from an anonymous IP; then, when that spam was removed, a user named JaimeyWB re-inserted it across Wikipedia.

For example, on July 23, a user from IP 67.101.217.126 revised the William Goldman article to include the following text: To those within the industry, he is "the most observant, knowledgeable and intuitive screenwriter in the business." In an on-camera interview, Goldman applies his brutally honest perspective to his industry and in analyzing his screenplay for Butch Cassidy and the Sundance Kid.This edit was reverted. User JaimeyWB then inserted the text "Goldman speaks candidly about his writing process in American Film Foundation's series Screenwriters: Words into Motion into the body of the article, and an a link to the American Film Foundation into the "External Links" segment.

Other examples: spammed Tom Hanks article

spammed Maya Lin article

spammed Robert MacNeil article

spammed Peter Norton article

spammed Rose Fitzgerald Kennedy article

I've been trying to do some clean-up of this spam and in rare cases (like the Maya Lin article) the link to the AFF in the external links section seems worth keeping. 

Note that there is also a Wikipedia page for American Film Foundation. I considered putting it up for deletion but the article actually makes a pretty good case for the notability of the AFF. I would just suggest that any links to the AFF be confined entirely within the AFF article.

I am going to ask JaimeyWB to stop this spamming via his userpage, but I'm wondering if it would be a good idea to block links to the American Film Foundation as well. This is the first time I've been driven to propose adding an item to a spam blacklist; please let me know if I need to do some additional homework, or if this request would better be made elsewhere.

I reviewed these and removed them again, and left another note for JaimeyWB. I don't think this quite rises to the level where we would want to blacklist the site, particularly because there are a few places where the links may be appropriate. UninvitedCompany 18:52, 5 August 2005 (UTC)

I agree that the links might be appropriate, so we should be hesitant in blacklisting. - Andre Engels 17:22, 9 August 2005 (UTC)

I have talked to the perps and they seem to have stopped. I doubt they'll be back. UninvitedCompany 20:22, 10 August 2005 (UTC)

Here is our Blacklist page of spammers that we've started: http://wiki.ehow.com/Spam-Blacklist and a few examples: Travisd666 16:26, 14 July 2005 (UTC)

Thanks for the offer. I reviewed the list, and doubt if it is appropriate to add here; it is a short list and appears to include several free webhosting sites that we would not want to block. UninvitedCompany 18:58, 5 August 2005 (UTC)

Retrieved from "https://meta.wikimedia.org/w/index.php?title=Talk:Spam_blacklist/Archives/2005-09&oldid=1210115"

Categories:

• Talk archives
• Spam blacklist archives