MediaWiki talk:Spam Blacklist

 '''[ Report a spammer here ]


 * The spam blacklist extension is now working on all Wikia. You can request new URLs be added to the filter by listing them here. Please state the IP (or username) used to spam and the wiki it happened on.

See also Help:Spam.

When to Add to the Blacklist?
Should we add URLs after one instance of a spam attack, or wait for more? Also, I'm not sure how much of the URL is best? Advice please? As a specific example, should I add the two URLs just posted (and already removed) to the Central Wikicity's home page? I don't want to slow the loading of every saved page, but I'd rather not have to clean-up the same URLs again. --CocoaZen 17:50, 2 Jun 2005 (UTC)


 * It depends what they are and whether they are definitely spam. Something like this is an obvious spam attack, but someone adding one innapropriate URL to a page is often not. If you're unsure, you can also add it temporarily. It might be worth checking Google for other wikis with the spam URL. If +wiki Google: SpamURL.com +wiki has hits, then it should be blacklisted. If an edit adds dozens of different URLs, adding just one of those to the blacklist will normally prevent future attacks since the edits are being made by bots who won't know to just remove the blacklisted URL from their edit. Angela (talk) 00:00, 8 Jun 2005 (UTC)

Checking contribs across wikis
I now have a somewhat buggy script that will check edits across multiple wikis. It doesn't work perfectly, but can be used for finding cases of the same user spamming multiple Wikicities, so please report the username or IP of spammers here as well as links to the diffs where they spammed. Angela (talk) 02:49, 21 Jul 2005 (UTC)

Any chance of an alphanumeric list?
Maybe a one-off extraction as a first port of call? Maybe no value?? (Some of us are a bit ignorant about these things) Robin Patterson 01:40, 1 Sep 2005 (UTC)
 * Please clarify. An alphanumeric list of what?  Are you suggesting that the blacklist be ordered?
 * That might be a good idea.
 * If that is what you meant, I'd like to understand the potential benefit.  We only add sites when they become problems.  After they've been put on the list, they shouldn't be able to be a problem.  Is that what you mean?  What value do you think it would have?  I wouldn't have any problem with it, but don't really want to go to the work of organizing what we have without a reason.
 * Another potential problem with alphabetizing is that it depends on how much of the url is used. Sometimes we have to make a choice about whether to post xyz.objectionable-site.tla or the more generic objectionable-site.tla that would also cover abc.objectionable-site.com.  As you can see, each choice would appear in a different place in an alphabetized list.
 * Again, it's not that I'm disagreeing with your suggestion, it's just that I don't understand it. Maybe someone else will have a better response.  --CocoaZen 02:09, 1 Sep 2005 (UTC)


 * I don't mind, but I often update the page from the version on Meta, so I don't promise to keep it alphanumeric, but someone else can if they find it useful. Angela (talk) 15:25, 2 Sep 2005 (UTC)

Hydrocodone sites - block all?
There are multiple hydrocodone sites which have been spammed. Would it make sense to blacklist all sites with "hydrocodone."? Normally it would be overkill, and it seems to me that assuming good will works well for most cases, but after multiple violations, I'm proposing this stronger measure. If someone comes up with a non-advertising, legitimate site, we could remove this blanket block. --CocoaZen 03:37, 6 Oct 2005 (UTC)


 * Yes, blocking all those is fine. Just don't block cialis. I considered doing so before until I realised it"s the middle of the word "socialism" which has legitamate links, especially on the socialism wiki. :) Angela


 * Wow, that explains some odd looking stuff I've seen elsewhere - just depends if someting can be identified as a delimited word, though the perishers usually mis-spell stuff like that to get though spam filters Ace of Risk

Atspace
Real Life Soap wikicity; porn link spam by 195.16.125.192


 * I've blocked those 4 subdomains. If atspace.com continues to show nothing but spammy domains, it might be worth blocking them totally. Angela (talk) 06:44, 23 Oct 2005 (UTC)

Blocking IP addresses
I don't know the name of this stupid guy, but he has put thousands porno websites on the first pages of svt.wikicities.com (french wiki on biology). I already erase his stuff, i hope this kind of people can be blacklisted, even if we don't know his name
 * IP addresses can be banned (not blacklisted). Any administrator for your Wikicity can do that.  Pieces of inappropriate URLs can be blacklisted.  This makes it so that no one can save a page with those URLs.  I think Angela may have already added ones from this attack, but I'll check and add some, if she hasn't.  Thank you for reporting the problem.  --CocoaZen 23:11, 23 Oct 2005 (UTC)

Is it not possible to connect the wikis in such a way that when an IP is blocked on one wiki it is autmatically blocked on other wikis ? At least the wikis that share the same subject like MA. -- Q 21:18, 17 May 2006 (UTC)

Fiberia
http://alaska.wikicities.com/index.php?title=Talk:Alaska&diff=0&oldid=528 This one was just a single link to a pharmaceutical. Removed. Blocked.--Doug 06:04, 8 Nov 2005 (UTC)


 * This was fiberia again, which should be blocked already. Angela (talk) 22:55, 9 Nov 2005 (UTC)
 * Weird. It's not getting blocked because of the underscore in the url.. 00:55, 11 Nov 2005 (UTC)


 * Reported at MediaWiki bug 3934. Angela (talk)

Creatures Wiki
...


 * Also 219.93.174.100. Do you blacklits the IP or the site that they link to? If its the link, it is about levitra


 * I blacklist the URL on all wikis. Individual wikis can blacklist the IP. Angela (talk) 14:16, 3 Dec 2005 (UTC)

It seems to me that there has been a recent influx of spammers signing up accounts with an IP-looking username, like this one: http://creatures.wikia.com/index.php?title=User_talk%3AGreenReaper&diff=26412&oldid=26410 - "User:200.122.153.2"

Can anything be implemented at a Wikia level to curb this kind of spambot? - Malkin 09:42, 23 April 2006 (UTC)


 * The spam blacklist is meant to curb it. User:200.122.153.2 was an IP, not a username. Angela (talk)

Alaska (again)
Spam from ip and ip   which was first commented with "Problem?" and then on the second edit "Reported vandalism." I didn't know how to use the rollback feature so after a few tries I simply re-edited the last good version and saved it. The vandalism happened on Talk:Alaska, same as the other times. --Doug 03:17, 23 Nov 2005 (UTC)


 * If you're logged in, you should see a "rollback" link when you look at the user's contributions, or at a diff page. Angela (talk) 14:16, 3 Dec 2005 (UTC)

overzealous spam filter
Reverting the latest vandalism here was troublesome, because of the above link being blacklisted. I tried to enclose it in tags so it doesn't register on the spam filter but had to end up breaking the link. This may need to be looked into at some point. nae'blis (talk) 19:28, 14 Dec 2005 (UTC)


 * I think it's useful that the spam is blocked even on talk pages like this. It's easy enough to just type lucky.to without the preceeding http:// that makes it a link. --Angela (talk) 23:33, 15 Dec 2005 (UTC)

netfirms.com
Please remove this URL from the blacklist, or change it to at least exclude "supernovawd.netfirms.com" before running this script on Memory Alpha/en again. The subdomain specified above belongs to a MA contributor and should not be considered spam. See also Memoryalpha:User talk:Spam cleanup script. Thanks. -- Memoryalpha:User:Cid Highwind)


 * netfirms isn't currently blocked. Angela (talk)

Removing Domains
Hello, there. I'm having some trouble with the blacklist. It seems you have added certain domains which are owned by dyndns.org which a lot of people use. Domains like is-a-geek.com and kicks-ass.net. This block is preventing me from listing my personal website in my Wikifur article. Can someone help me out?


 * See Spam cleanup script. The easiest way is to use a tinyurl.com link instead of the kicks-ass one. Angela (talk) 09:10, 22 January 2006 (UTC)


 * I'm actually using is-a-geek.com, not kicks-ass.net, which I noticed was removed from the block list. Any way is-a-geek removed, as well? Threyon (talk)


 * There are far too many subdomains of is-a-geek that are being spammed. I think this one should stay in. I suggest you move to a web host that doesn't permit spammers. Angela (talk)

narod.ru
On my wikicity, I have a legitimate need to link to a legitimate site hosted on narod.ru. The Spam cleanup script keeps deleting the entire contents of the page (not just the link to a blacklisted domain). FIX THIS BUG! The wikicity is at and the page is at  --Lowland Boxman 19:00, 8 February 2006 (UTC)


 * Lowland Boxman - It's not a bug; it's a feature. ;-)
 * Ok, I just had to say that.
 * This sounds like what the spam blacklist is supposed to do. When someone tries to post content with the blacklisted domain, in this case "narod . ru", the post will not be saved. It should not be blanking other content.  If it is, that is a bug.  If you need to link to that domain, maybe we can be more specific about what parts of it are blocked.
 * --CocoaZen 02:08, 9 February 2006 (UTC)
 * More...
 * I just checked the page you referred to, and the spam clean-up program did what it should. On the first pass through, it took the page back to the edit before the first time that domain was added.  Then you added back all that content, including the site that it recognizes as spam, so it just removed it again.
 * In order to keep that content on your page, I think the spam list needs to be adjusted. If spam has come from too many sub-sites in that domain, I don't know what the decision will be. Maybe the program can be adjusted to allow for an exception for the sub-site of "skomorokhi . narod . ru", if no spam has been posted to the sub-site.  --CocoaZen 02:20, 9 February 2006 (UTC)

The page also needs to link to  narod.ru. narod.ru is a popular free hosting service in Russia and most of the sites there are legitimate. Blacklisting the whole second-level domain just because a few spammers used it is a bad decision. Paranoid 05:16, 9 February 2006 (UTC)


 * Until a compromise can be found, you can just put in the text of the domain. Eg, you can just put in a www.narod.ru  entry, that isn't stopped by the blacklist (The blacklist only stops links, as spammers must link to get google ranking points). Splarka 05:46, 9 February 2006 (UTC)


 * I tried enclosing the link within  , but when I tried to save, I got:
 * Spam protection filter
 * The page you wanted to save was blocked by the spam filter. This is probably caused :by a link to an external site.
 * The following text is what triggered our spam filter: http:// skomorokhi . narod . :ru
 * In fact, I had to insert those spaces around the dots in order to mention it on this talk page! --Lowland Boxman 19:01, 9 February 2006 (UTC)


 * As I said, leave off the http:// and it works: skomorokhi.narod.ru Splarka 22:06, 9 February 2006 (UTC)
 * That's not exactly what you said; you said to enclose it in   tags.  The "http://" inside    tags is not a link!  Anyway, it's worked-around now.  BTW, do we have logs of the Spam cleanup script's activity to determine which subdomains of narod.ru the real spammers are using?  If it's just a few, they should be explicitly added to the blacklist and narod.ru should be removed. --Lowland Boxman 22:38, 10 February 2006 (UTC)
 * I said you can just put in the text of the domain and The blacklist only stops links. http:// prefixed to an address (making a URI) is a link, even if it is wrapped in  . I said (or demonstrated actually) that all you had to do was wrap only the address in nowiki to show it. My error was in assuming you knew that meant to leave off the http://. I said enclose it meaning (and showing even) just the address, not the link. Splarka 23:54, 10 February 2006 (UTC)
 * PS: You'll have to ask Tim or Angela as to the extent of the abuse of that domain, but it has appeared on several wikicities (see above). 221.3.235.96 and 202.58.85.8 only spammed with best-windows2005.narod.ru here at central, but I can't easily check all ~800 other wikicities myself. If that was the only domain, it would probably be ok to edit the entry. Splarka 23:54, 10 February 2006 (UTC)
 * There are 50,000 potentially spammed wiki pages with narod.ru on them . Please host your sites somewhere that does not support spammers in this way. The level of spam from narod.ru is completely unacceptable. There are hundreds of alternative hosts that are better at removing these spam domains. Angela (talk) 23:59, 10 February 2006 (UTC)
 * If it were my site to host, I would host it elsewhere. I'm just trying to link to it because it had some relevant information.  http://inside.nowikitags.is.not.a.link --Lowland Boxman 14:52, 13 February 2006 (UTC)
 * You can link to it using a tinyurl instead. Angela (talk)

Legitimate site blocked
An apparently legitimate site was blocked from Muppet Wiki by the spam cleanup script. I can't actually post the link here, because it'll be blocked, so I'll post it in pieces: http: // e. domain dlx. com/jerrynelson/. "Domain dlx.com" is on the spam blacklist, but the site is legitimate. Is there anything that can be done about that, or is just bad luck that that website is being hosted on a domain where people are spamming from? -- Danny Toughpigs 15:50, 24 February 2006 (UTC)


 * The spam blacklist only blocks posting embedded links. You can just report bad domains by omitting the http://, eg: e.domaindlx.com/jerrynelson/ .... that domain was added by Angela, and it seems to be a common spam domain on wikis under several prefixes (k. ccc. www.cc. users. etc). It probably should not be removed. Splarka 03:00, 25 February 2006 (UTC)


 * I'll try just blocking some subdomains of it and see how problematic it is. Please report any new subdomains that are spammed. Angela (talk) 07:36, 27 February 2006 (UTC)


 * That helped, thanks! -- Danny Toughpigs 16:12, 28 February 2006 (UTC)

80.77.82.216
Hosting spam here -- Scarecroe 21:44, 28 February 2006 (UTC)


 * As they aren't being put in as embedded links they can't be blacklisted. :/ Splarka 22:18, 28 February 2006 (UTC)


 * They can now. Please let me know and I can add them to $wgspamregex in default settings. Angela (talk) 14:52, 5 April 2006 (UTC)

March 6, L5R Wiki
We're getting hit repeatedly today. So far, IPs 24.191.96.110, 69.132.38.151, 64.184.59.173, 69.246.172.124, and 67.160.111.204. Just so people know. -- 17:10, 6 March 2006 (UTC)
 * In the future, be sure to let us know what urls they are spamming (omit the http). Splarka 03:39, 7 March 2006 (UTC)

Horrid spammer/vandal at Radio Control
Just placed a perma-whammy on User:Y♥Θ⌠VΓ&åV5*3Σl╒$Ω■∩ at the R/C wiki. Hang on and I'll be right back with the link he put on one of the articles. - Lucky 6.9 05:07, 26 March 2006 (UTC)

The idiot tried linking to a picture that (mercifully) he didn't take the time to upload. Picture was xxx-anal-porn-again.jpg. - Lucky 6.9 05:09, 26 March 2006 (UTC)


 * If this happens with the same file name again, let me know and I can add the phrase to the $wgspamregex (which is on the server and blocks words, not just URLs). Angela (talk) 14:52, 5 April 2006 (UTC)

The blanker strikes again: Petdiabetes wiki
These IPs

Thanks, and I hope I didn't include any innocent friends in the list. --Steve and Jock 14:56, 26 March 2006 (UTC)


 * Thanks for reporting all those IPs. It makes it very easy for me to check for pages they've blanked on other Wikia. Angela (talk) 14:52, 5 April 2006 (UTC)

Similar to page blanking on sca21?
I was looking around to see if could get any more advice about spates of vandalism to sustainable community action wiki when saw this, and found one same ip address used to vandalise both sca and the above wiki (only looked through about 5 addresses). We've had 6 sets of vandalsim since 6 March, and seemingly getting a little more frequent. Typically 14 to 17 different IP addresses delete most of (except first few characters) of about 15 - 20 pages. Wondered if anything more could be done about this? perhaps along the lines suggested on Community portal? Or is there some way of / any point in blocking all the known addresses to all wikis? Philralph 18:10, 26 March 2006 (UTC)


 * They change IP almost every time, so blocking wouldn't help much. I think implementing captchas for some wikis would be a good thing to try out, once we've upgraded to MediaWiki 1.6. Angela (talk) 14:52, 5 April 2006 (UTC)

Several new spammers at Radio Control
Ladies and gentlemen, four more IP's for your pleasure, now blocked for spamming.
 * 67.83.143.58
 * 71.128.213.118
 * 198.53.37.235
 * 24.6.23.1

A couple more Comcast addresses are among this august group. Is it time to start blocking these ranges? - Lucky 6.9 18:49, 26 March 2006 (UTC)


 * It's up to individual wikis whether they want to block ranges, but I'd rather try softer approaches, like using captchas. Angela (talk) 14:52, 5 April 2006 (UTC)

Petitiononline.com
I met the director of PetitionOnline today, and as I was listening to his talk I realised where I'd heard of petitiononline.com before... in this blacklist. It's a genuine site, not a spam site, but because they host so many petitions, there are going to be some people who spam sites in an attempt to get more votes on their petition. Kevin Matthews assured me they do act to remove problem sites if they know about them, so I'm going to try removing this from the blacklist. If there is any more wikispam linking to this site, please report the individual subdomains here so that those can be both blacklisted and reported to their site.Angela (talk) 06:27, 11 April 2006 (UTC)

LouisVuitton Site Blocked
I've blocked the louisvuittonreplica site after a third vandalism attack. They occurred over a period of a few months; all posted by an IP beginning with 80.68. I hope that will be enough to stop it, but in case they try to continue, some of the other urls are (http:// is removed so they won't be links) louisvuittonpurses.blogs.eurosport.com, louisvuittonbags.blogs.eurosport.com, louisvuittonreplica.blogs.eurosport.com, fakelouisvuitton.blog. If there's a better way to block these, please improve the block. (I figured blocks.eurosport would be too broad?) --CocoaZen 22:50, 30 April 2006 (UTC)

div-spammer
There is a pattern in latest spam. All URLs were within tags like. And can't we train the spam-detector to be smart enough to recognise about 20+ external URLs in a row to be spam? We are one step behind if we define each URL one after the other although there is other evidence. &mdash; Florian &#x2122; talk 01:56, 21 May 2006 (UTC)
 * All divs seem to contain the text "Excuse for my post but I do not have money to buy meal to my children. Forgive me please." Maybe a check on some words to block the poster ? -- Q 14:41, 4 June 2006 (UTC)

This particular spammer seems to use bot-nets and hijacked computers to have a distributed spam-attack on random pages. Please do something clever to stop it! This spammer was successful for nearly a dozen of times until we blocked his URLs. It would be smater to have a logic like number of URLs per edit on anonymous users. Maybe this spammer used a distinct use-agent for requests (see apache-log). And, like Q says, it's always the same sad excuse for beeing an a..hole. &mdash; Florian &#x2122; talk 15:46, 4 June 2006 (UTC)

User: Fuckface
For his attacks on the Star Wars Fanon wiki on virtually everryone. I would like to have him banned. |User: MaulYoda 20:53, 30 May 2006 (UTC)


 * The Spam Blacklist is only for blocking spammed links, and won't do anything to stop a page move vandal. I've pokled some staff to have him blocked. Splarka 21:27, 30 May 2006 (UTC)


 * Those can now be reported at Cross wiki user blocks. Angela (talk)

cygnus-x1.net
Spamming Memory Alpha for a long time from various IPs. Jaz 19:59, 4 June 2006 (UTC)


 * Added. Angela (talk) 22:23, 4 June 2006 (UTC)


 * There seem to be a lot of false positives for this. Are you sure that site isn't wanted on Memory Alpha? Angela (talk) 02:49, 17 June 2006 (UTC)

Another request

 * perso.wanadoo.es, from IP address 89.0.34.10 on Wookieepedia. &mdash;Silly Dan (talk) 10:59, 10 June 2006 (UTC)
 * Added. Szoferka 11:01, 10 June 2006 (UTC)


 * I'm not sure about this one. I ran the spam cleanup script today and there were a lot of false positives. Genuine users seem to be linking to that site quite a lot. Are you sure it's worth blacklisting it? Angela (talk) 05:07, 17 June 2006 (UTC)

194.164.78.173
Came, created a random page "Bypass Steam", and added this link http://www.mgforums.com/forums/showthread.php?t=33001 to the HowTo Wiki

Inyuki 15:53, 12 June 2006 (UTC)


 * This seems like a one off, so I shan't blacklist it yet since it could have been a confused newbie rather than a spammer. Angela (talk) 05:08, 17 June 2006 (UTC)

130.126.37.246
Came to HowTo Wiki, and added a line "This is a silly, useless, bad joke of a stub" the talk page http://en.howto.wikia.com/wiki/Talk:How_to_create_Heavy_water without adding any other reference.

Inyuki 15:57, 12 June 2006 (UTC)


 * That isn't spam. Spam means external links being added, usually by bots, in an attempt to increase the page rank of their own sites in Google. This just seems like someone giving an opinion. Angela (talk) 05:10, 17 June 2006 (UTC)

Jotspot
vse-ok\.jot\.com

A bunch of different spam addresses from this domain, posted by 64.190.54.194 on Muppet Wiki. Thanks! -- Danny (talk ) 13:19, 16 June 2006 (UTC)
 * Added. Szoferka 13:49, 16 June 2006 (UTC)

dir1\.jot\.com

posted by 213.113.123.15 on Muppet Wiki. -- Danny (talk ) 19:01, 16 June 2006 (UTC)
 * Added. Szoferka 19:14, 16 June 2006 (UTC)

Unfortunately, I've had to block the whole of jot.com for now. I contacted their customer service who just told me they'd delete spam sites they knew about, but they don't appear to be monitoring new wikis quickly enough to see if they are spam. Almost all the spam over the last 2 days has come from jot.com, including these domains:

fortop\.jot\.com lastt\.jot\.com vse-ok\.jot\.com podarki-prishli\.jot\.com valium\.jot\.com levitra\.jot\.com dir1\.jot\.com hochu\.jot\.com mymedia\.jot\.com xenical\.jot\.com brin-durak\.jot\.com

Jimbo Wales has contacted their founder about it, but I'd suggest leaving the whole site blocked for now until these attacks die down. Angela (talk) 05:14, 17 June 2006 (UTC)