MediaWiki talk:Spam Blacklist

The spam blacklist extension is now working on all Wikicities. You can request new URLs be added to the filter by listing them here. See also Help:Spam.

more spam in the Fiction wikicity
213.228.84.58

same one at PeaceWiki 213.228.84.58
 * And D&D, for that matter. Mathx314(talk)(email) 23:57, 27 Apr 2005 (UTC)

here's another http://peace.wikicities.com/index.php?title=Special:Contributions&target=206.161.125.142

stargate
Blocked 81.214.103.203 on the Stargate Wikicity for spam of inappropriate url --CocoaZen 01:16, 18 May 2005 (UTC)
 * I checked a few other guilds and don't see more of the same. I cleaned up the Stargate: Wikicity.  (Stargate:Special:Recentchanges).  --CocoaZen 01:28, 18 May 2005 (UTC)
 * That IP vandalized the Calgary: Wiki too. --JamesTeterenko 02:34, 18 May 2005 (UTC)

81.214.101.220 spam
FYI, 81.214.101.220 spammed the Calgary: wiki as well as the pc: wiki. -- JamesTeterenko 23:58, 24 May 2005 (UTC)
 * Looking at a few random wikis, I also found it at Stargate:. Is there an easy way to check the changes at all wikicities?  -- JamesTeterenko 00:07, 25 May 2005 (UTC)


 * There's a combined recent changes at Bloglines, but it doesn't pick everything up and limits how many changes are actually shown. Angela (talk) 03:21, 25 May 2005 (UTC)


 * I used that, and that is how I picked up the ones that I did fix. Since you have to click on every Wikicity to see the result, I only looked at some of them.  -- JamesTeterenko 04:40, 25 May 2005 (UTC)


 * If you click on Wikicities's Feeds at the top of the left hand frame, you don't need to click on each one separately since it will expand and show you some results from each one. It takes a while to load though. Angela (talk) 05:17, 25 May 2005 (UTC)


 * That is good to know. I'll use that next time.  -- JamesTeterenko 15:10, 25 May 2005 (UTC)

When to Add to the Blacklist?
Should we add URLs after one instance of a spam attack, or wait for more? Also, I'm not sure how much of the URL is best? Advice please? As a specific example, should I add the two URLs just posted (and already removed) to the Central Wikicity's home page? I don't want to slow the loading of every saved page, but I'd rather not have to clean-up the same URLs again. --CocoaZen 17:50, 2 Jun 2005 (UTC)


 * It depends what they are and whether they are definitely spam. Something like this is an obvious spam attack, but someone adding one innapropriate URL to a page is often not. If you're unsure, you can also add it temporarily. It might be worth checking Google for other wikis with the spam URL. If +wiki Google: SpamURL.com +wiki has hits, then it should be blacklisted. If an edit adds dozens of different URLs, adding just one of those to the blacklist will normally prevent future attacks since the edits are being made by bots who won't know to just remove the blacklisted URL from their edit. Angela (talk) 00:00, 8 Jun 2005 (UTC)

Request additions to spam blacklist from SCA wiki
On the Sustainable Community Action Wiki, we've been getting a number of spam entries using different IP addresses and affecting diferent pages, so normal stuff of blocking and protecting pages seems ineffective. Most recent: Revision as of 11:50, 17 Jul 2005 Also similar seem to be a series, latest one of which  Revision as of 15:46, 16 Jul 2005 from 217.26.153.102 Philralph 19:58, 17 Jul 2005 (UTC)


 * I've added osbercad\.com. I'm not sure about the 2nd one. Was it a one-off or have those atspace addresses been spammed anywhere else? Angela (talk) 01:20, 18 Jul 2005 (UTC)


 * Hi, Angela, Thanks. Yes, 2nd one - have been 7 instances including the atspace addresses since 00:13, 11 Jul 2005, although we've been able to keep the number down a bit as has used same IP address so far, so been able to block once obvious not going to go away. Philralph 07:12, 18 Jul 2005 (UTC)


 * I've added the hoodiadietpills one. Let me know if uses other atspace addresses. Angela (talk) 02:45, 21 Jul 2005 (UTC)

Removed recent edit
Hello, I have removed this recent edit:
 * 

It replaced the entire contents of previous edits. If I am mistaken, I apologize. Robert Harrison 02:30, 19 Jul 2005 (UTC)
 * I edited your comment to remove the links. The spammers do this to boost their Google pagerank. 12:42, 19 Jul 2005 (UTC)

Checking contribs across wikis
I now have a somewhat buggy script that will check edits across multiple wikis. It doesn't work perfectly, but can be used for finding cases of the same user spamming multiple Wikicities, so please report the username or IP of spammers here as well as links to the diffs where they spammed. Angela (talk) 02:49, 21 Jul 2005 (UTC)

porno spam from multiply IPs
received the same porno spam from 69.50.187.89, 69.50.187.91 and 69.50.184.221. i can block them but they only alter the IP. the page being affected is the main page on PeaceWiki ... the "diff" pages: http://peace.wikicities.com/index.php?title=Main_Page&curid=71&diff=6879&oldid=6878&rcid=7871 http://peace.wikicities.com/index.php?title=Main_Page&curid=71&diff=6891&oldid=6886&rcid=7880 http://peace.wikicities.com/index.php?title=Main_Page&curid=71&diff=0&oldid=6891&rcid=7885 what can be done other than protecting the page? thanks. 13:48, 22 Jul 2005 (UTC)


 * Thanks for reporting it. I've blacklisted some of those URLs and checked the IPs - they had also spammed universitywikinodewiki and dystopia. Angela (talk) 15:57, 22 Jul 2005 (UTC)

spam at Protoscience and Academia
86.104.17.160 added a bunch of pornography URLs to the Journal of Protoscience and Journal of Soul Science pages. More of the same at academia.wikicities.com --JWSchmidt 14:27, 11 Aug 2005 (UTC)


 * Thanks for reporting it. That IP has spammed Alaska and Vancouver as well. Angela (talk) 23:24, 15 Aug 2005 (UTC)

61.25.121.90
This one seems intent editing jellos page. Has done so twice, both removing stuff and adding a link.


 * You mean 66.25.121.90. It has also edited lotr and religion. I've added the URLs to the blacklist. Angela (talk) 18:57, 16 Aug 2005 (UTC)

Protection
Perhaps the Spam Blacklist should be protected? 17:41, 17 Aug 2005 (UTC)


 * It is protected now. Angela (talk) 17:18, 22 Aug 2005 (UTC)

Mozspam
User:83.237.185.104 (contribs) mrjeweller\.us 22:54, 20 Aug 2005 (UTC)


 * I've added those URLs. He'd spammed dnd, pnw, mac, warzone2100 and worldcitizen too. Angela (talk) 17:18, 22 Aug 2005 (UTC)

Gameinfo spam
67.163.194.6, 69.91.65.130, 68.12.127.104, and 24.19.127.190 have been adding links repeatedly to Talk:Main Page. The URLs are: See for example this diff. Garrett 13:27, 27 Aug 2005 (UTC)


 * Thanks. Now blocked. Angela (talk)

Garbage from 81.177.7.37 about Multiple Sites (e.g., work-from-home...netfirms.com)
Junk postings from this IP ran across many Wikicities August 30th. Some of the key URLs have been blacklisted already. If you find more problems, please help fix them. Unless they are newer than 17:59, 30 Aug 2005 (UTC), they don't need to be reported anymore. Thank you all for your help! --CocoaZen 21:16, 31 Aug 2005 (UTC)

Genealogy spam (81.177.7.37)
81.177.7.37 spamed the main page and the main talk page. Removed. Jtc 16:12, 30 Aug 2005 (UTC)
 * MozCom too. 17:47, 30 Aug 2005 (UTC)
 * Most (w/out blogspot.com and 9k.com) of the spam-urls are now in the list. --DCLXVI 17:56, 30 Aug 2005 (UTC)
 * And the Central Wikicity. I think we've got it covered now. Thanks, Jtc for reporting it. And DCLXVI and Jellochuu for helping to take care of it. --CocoaZen 17:59, 30 Aug 2005 (UTC)
 * Also hit NeoPets Guilds. Pages are fixed now.  Please check your favorite Wikicities for more damage.  :-(  --RJ 18:09, 30 Aug 2005 (UTC)
 * 18:23, 30 Aug 2005 (UTC)
 * Also, 81.177.7.37 WHOIS points to "Vladimir V Panfilovich", who gets plenty of Google hits for spamfraud like this. 19:10, 30 Aug 2005 (UTC)
 * Caught 81.177.7.37 on history. Spam was essentially identical to that used by 81.176.65.247 also on history, and also blocked on history.--Kirk 21:39, 30 Aug 2005 (UTC)

more Gameinfo spam

 * http://*.netfirms.com
 * You can see here that countless subdomains have been spammed, so I say block 'em all. Garrett 05:38, 31 Aug 2005 (UTC)

Three pages on LOTR by 81.177.7.37
I see that number is listed above too. Robin Patterson 20:06, 31 Aug 2005 (UTC)

any more?
Is any of it newer than 17:59, 30 Aug 2005 (UTC) when the sites were added to the blacklist? --CocoaZen 21:16, 31 Aug 2005 (UTC)
 * Not as far as I can see.. there's probably still alot of unreverted spam though. Is there any way to automate reverting/finding a specific IPs edits across all Wikicities? 21:47, 31 Aug 2005 (UTC)

I checked the IP 81.177.7.37 which had spammed 82 wikis. It should all be reverted now. I'm hoping in future the option to check IPs will become a special page rather than something I need to run on the server. Angela (talk) 15:23, 2 Sep 2005 (UTC)

Any chance of an alphanumeric list?
Maybe a one-off extraction as a first port of call? Maybe no value?? (Some of us are a bit ignorant about these things) Robin Patterson 01:40, 1 Sep 2005 (UTC)
 * Please clarify. An alphanumeric list of what?  Are you suggesting that the blacklist be ordered?
 * That might be a good idea.
 * If that is what you meant, I'd like to understand the potential benefit.  We only add sites when they become problems.  After they've been put on the list, they shouldn't be able to be a problem.  Is that what you mean?  What value do you think it would have?  I wouldn't have any problem with it, but don't really want to go to the work of organizing what we have without a reason.
 * Another potential problem with alphabetizing is that it depends on how much of the url is used. Sometimes we have to make a choice about whether to post xyz.objectionable-site.tla or the more generic objectionable-site.tla that would also cover abc.objectionable-site.com.  As you can see, each choice would appear in a different place in an alphabetized list.
 * Again, it's not that I'm disagreeing with your suggestion, it's just that I don't understand it. Maybe someone else will have a better response.  --CocoaZen 02:09, 1 Sep 2005 (UTC)


 * I don't mind, but I often update the page from the version on Meta, so I don't promise to keep it alphanumeric, but someone else can if they find it useful. Angela (talk) 15:25, 2 Sep 2005 (UTC)

Creatures Wiki
sercheng.com also needs to be added to the blacklist - see this diff for more details. - Malkin 08:56, 2 Sep 2005 (UTC)

as well as air.sercheng.com. see: this diff at Peace Wiki. 14:20, 2 Sep 2005 (UTC)


 * Added. Angela (talk)

Spam at protoscience
Main Page link spam by 195.39.240.10 195.39.240.10 also hit the Reviews wikicity Main Page. 195.39.240.10 also hit the Academia wikicity Main Page.


 * I've added the URLs. I'll check their other contribs too. It's looks like they've hit a lot of wikis. :( Angela (talk) 15:05, 10 Sep 2005 (UTC)

Please remove
These are popular free hosting sites. Also remove
 * pochta\.ru
 * narod\.ru
 * boom\.ru
 * msk\.ru - a Moscow subdomain.
 * host\.sk - also a popular free hosting site.

Is it possible to disable spam blacklist for particular wikicities or have a custom list? Or to get edit access to the existing list? Paranoid 10:56, 13 Sep 2005 (UTC)


 * I've removed the Russian ones, but if you see spam from them, can you let me know the subdomains so I can blacklist those? Host.sk is too much of a problem though. They regularly spam 80 wikis in one go, so I'll leave that in until there are any valid sites there which need to be linked to. Angela (talk) 13:45, 13 Sep 2005 (UTC)

861 kB of spam at http://lotr.wikicities.com/index.php?title=Category:Plots&action=edit - I can't delete it Robin Patterson 20:21, 15 Sep 2005 (UTC)
 * I've blanked it.  20:29, 15 Sep 2005 (UTC)