MediaWiki talk:Spam Blacklist

Report a spammer here


 * The spam blacklist extension is now working on all Wikicities. You can request new URLs be added to the filter by listing them here. Please state the IP (or username) used to spam and the wiki it happened on.

See also Help:Spam.

When to Add to the Blacklist?
Should we add URLs after one instance of a spam attack, or wait for more? Also, I'm not sure how much of the URL is best? Advice please? As a specific example, should I add the two URLs just posted (and already removed) to the Central Wikicity's home page? I don't want to slow the loading of every saved page, but I'd rather not have to clean-up the same URLs again. --CocoaZen 17:50, 2 Jun 2005 (UTC)


 * It depends what they are and whether they are definitely spam. Something like this is an obvious spam attack, but someone adding one innapropriate URL to a page is often not. If you're unsure, you can also add it temporarily. It might be worth checking Google for other wikis with the spam URL. If +wiki Google: SpamURL.com +wiki has hits, then it should be blacklisted. If an edit adds dozens of different URLs, adding just one of those to the blacklist will normally prevent future attacks since the edits are being made by bots who won't know to just remove the blacklisted URL from their edit. Angela (talk) 00:00, 8 Jun 2005 (UTC)

Checking contribs across wikis
I now have a somewhat buggy script that will check edits across multiple wikis. It doesn't work perfectly, but can be used for finding cases of the same user spamming multiple Wikicities, so please report the username or IP of spammers here as well as links to the diffs where they spammed. Angela (talk) 02:49, 21 Jul 2005 (UTC)

Any chance of an alphanumeric list?
Maybe a one-off extraction as a first port of call? Maybe no value?? (Some of us are a bit ignorant about these things) Robin Patterson 01:40, 1 Sep 2005 (UTC)
 * Please clarify. An alphanumeric list of what?  Are you suggesting that the blacklist be ordered?
 * That might be a good idea.
 * If that is what you meant, I'd like to understand the potential benefit.  We only add sites when they become problems.  After they've been put on the list, they shouldn't be able to be a problem.  Is that what you mean?  What value do you think it would have?  I wouldn't have any problem with it, but don't really want to go to the work of organizing what we have without a reason.
 * Another potential problem with alphabetizing is that it depends on how much of the url is used. Sometimes we have to make a choice about whether to post xyz.objectionable-site.tla or the more generic objectionable-site.tla that would also cover abc.objectionable-site.com.  As you can see, each choice would appear in a different place in an alphabetized list.
 * Again, it's not that I'm disagreeing with your suggestion, it's just that I don't understand it. Maybe someone else will have a better response.  --CocoaZen 02:09, 1 Sep 2005 (UTC)


 * I don't mind, but I often update the page from the version on Meta, so I don't promise to keep it alphanumeric, but someone else can if they find it useful. Angela (talk) 15:25, 2 Sep 2005 (UTC)

Chem is back
In Cities: and Genealogy: Robin Patterson 19:20, 3 Oct 2005 (UTC) By 69.50.165.186 - AGAIN! - looks like that address needs a ban, or a final warning at least Ace of Risk 20:10, 3 Oct 2005 (UTC)


 * 69.50.165.186 again... ouch. He should have been blocked on the server side already, but the block somehow got removed when the server rebooted. He's created 330 more "chem" pages. Insane. Jason's going to try to delete them automatically this time. Angela (talk) 21:33, 3 Oct 2005 (UTC)

Hydrocodone sites - block all?
There are multiple hydrocodone sites which have been spammed. Would it make sense to blacklist all sites with "hydrocodone."? Normally it would be overkill, and it seems to me that assuming good will works well for most cases, but after multiple violations, I'm proposing this stronger measure. If someone comes up with a non-advertising, legitimate site, we could remove this blanket block. --CocoaZen 03:37, 6 Oct 2005 (UTC)


 * Yes, blocking all those is fine. Just don't block cialis. I considered doing so before until I realised it"s the middle of the word "socialism" which has legitamate links, especially on the socialism wiki. :) Angela


 * Wow, that explains some odd looking stuff I've seen elsewhere - just depends if someting can be identified as a delimited word, though the perishers usually mis-spell stuff like that to get though spam filters Ace of Risk

Atspace
Real Life Soap wikicity; porn link spam by 195.16.125.192


 * I've blocked those 4 subdomains. If atspace.com continues to show nothing but spammy domains, it might be worth blocking them totally. Angela (talk) 06:44, 23 Oct 2005 (UTC)

Blocking IP addresses
i don't know the name of this stupid guy, but he has put thousands porno websites on the first pages of svt.wikicities.com (french wiki on biology). I already erase his stuff, i hope this kind of people can be blacklisted, even if we don't know his name
 * IP addresses can be banned (not blacklisted). Any administrator for your Wikicity can do that.  Pieces of inappropriate URLs can be blacklisted.  This makes it so that no one can save a page with those URLs.  I think Angela may have already added ones from this attack, but I'll check and add some, if she hasn't.  Thank you for reporting the problem.  --CocoaZen 23:11, 23 Oct 2005 (UTC)

http://ogame.wikicities.com/index.php?title=Main_Page&oldid=32 http://ogame.wikicities.com/index.php?title=Main_Page&oldid=33 http://ogame.wikicities.com/index.php?title=Main_Page&oldid=35
 * Please read the previous entry. These posts were rude, and luckily were fixed.  But, they aren't URLs or keywords that can be blacklisted.  IP blocking is different, and your admins have already blocked this IP for 999 days.  I don't think anymore action needs to be taked, but thank you for reporting the problem.  --CocoaZen 02:53, 24 Oct 2005 (UTC)

Fiberia
http://alaska.wikicities.com/index.php?title=Talk:Alaska&diff=0&oldid=528 This one was just a single link to a pharmaceutical. Removed. Blocked.--Doug 06:04, 8 Nov 2005 (UTC)


 * This was fiberia again, which should be blocked already. Angela (talk) 22:55, 9 Nov 2005 (UTC)
 * Weird. It's not getting blocked because of the underscore in the url.. 00:55, 11 Nov 2005 (UTC)


 * Reported at MediaWiki bug 3934. Angela (talk)

Invisible divs
Yes, more fun...  This "invisible" exploit they've found is getting really annoying as they only show up when viewing diffs, but I guess you can't really ban that attribute... Garrett 22:15, 13 Nov 2005 (UTC)
 * nyork.dyndsl.com/phentermine/
 * nyork.dyndsl.com/butalbital/
 * eagle.myftpsite.net/tramadol/
 * eagle.myftpsite.net/cialis/
 * direc.dynu.net
 * host.fdns.net/tramadol/
 * This isn't done to be annoying, but apparently to minimize harm done to the wiki; Alexandru Popescu, one of the guys that does this, said to me in an email to reason why his spam was "ethical": "2nd is that my spam comes in a tiny div and is always appended ." I guess it's better in some aspects.
 * But I really find it hard to believe that spammers are too stupid to notice everything here has rel=nofollow. 00:52, 14 Nov 2005 (UTC)

More on Talk:Alaska
http://alaska.wikicities.com/index.php?title=Talk%3AAlaska&diff=0&oldid=530 Whoever is into this is choosing the same spot to leave a single link. It reminds me of canine scent-marking behavior.--Doug 07:19, 16 Nov 2005 (UTC)


 * q4w.net is already blocked. If this one gets through again, please let me know. Angela (talk) 09:01, 16 Nov 2005 (UTC)

New Alaska wiki Spam
From my aggregator I discovered that a new edit happened on http://alaska.wikicities.com/wiki/Category_talk:Browse There are dozens of links left inside of div tag: guid="{877b43bd-1c2b-e184-4437-a8dc809f3303}"style="overflow:auto;height:1px;" The links point to q301.com. Clicking on the page showed no text. I removed the links, blocked the user.--Doug 16:47, 18 Nov 2005 (UTC)
 * They were over at MozCom, too, with about hundred or so edits. " ." I'll email him and tell him about nofollow.. you'd think someone who spams wikis for a living would know to check for it.  19:44, 18 Nov 2005 (UTC)
 * I just found a bunch more on Cities:. I'l add it (q301.com) to the blacklist.  What's "no follow"?  And, I wouldn't necessarily believe that the signature matches the poster.  This was odd because they weren't going to be visible anyway; are they just trying to get their crawler count up? --CocoaZen 22:11, 18 Nov 2005 (UTC)
 * If you look at the page source you'll see all the external links have rel="nofollow" attached to them. It means webspiders won't crawl the links, so their search ranking doesn't go up, which is the reason behind wikispam usually -- so their efforts are in vain. I think DCLXVI added q301 earlier, though. :) 22:25, 18 Nov 2005 (UTC)
 * I just blocked 86.120.197.66 for doing the same thing on history. --Kirk 22:25, 18 Nov 2005 (UTC)

The Responsible One : What you don't know is that Yahoo! seems to ignore the nofollow tag or at least has old versions of your pages. Technically nofollow stops from casting a vote but it does queue you up for indexing. Trust me on this. I think you have guessed the eMail is fake of course. It's just for me to know when you are stamped (not spammed). Cheers ! And btw, I've seen the nofollow , but I've explained my reasons. :) I appologize for my actions but I think you've seen I did no deface your sites, and my spam was virtually invisible . I've seen many wikis wiped out but I have respect for your work.

Take care . I don't think I'll spam you anymore. (scythe@go.ro - for any potential comments)

Creatures Wiki
narod.ru .. seems familiar to me from somewhere, but I can't place it. 202.58.85.8 http://creatures.wikicities.com/index.php?title=User_talk%3AOfficer_1BDI&diff=0&oldid=15345 - Malkin 04:47, 20 Nov 2005 (UTC)

221.3.235.96 here at central and 202.58.85.8 also vandalized additional wikicities. --JWSchmidt 16:49, 20 Nov 2005 (UTC)
 * "viagra" spam at RLS wikicity again by 84.235.174.186 and 202.58.85.8 returned to the fiction wikicity. --JWSchmidt 14:21, 21 Nov 2005 (UTC)


 * Also 219.93.174.100. Do you blacklits the IP or the site that they link to? If its the link, it is about levitra


 * I blacklist the URL on all wikis. Individual wikis can blacklist the IP. Angela (talk) 14:16, 3 Dec 2005 (UTC)

Alaska (again)
Spam from ip 84.235.174.186 and ip 203.116.214.2 which was first commented with "Problem?" and then on the second edit "Reported vandalism." I didn't know how to use the rollback feature so after a few tries I simply re-edited the last good version and saved it. The vandalism happened on Talk:Alaska, same as the other times. --Doug 03:17, 23 Nov 2005 (UTC)


 * If you're logged in, you should see a "rollback" link when you look at the user's contributions, or at a diff page. Angela (talk) 14:16, 3 Dec 2005 (UTC)


 * This is why my q301.com spam was nice . No pages were defaced ! I hate spammers with no respect for others work.
 * It's not nice to take advantage of open editing. Filling wiki pages with hidden links is not very respectful either, especially when the spamming is completely pointless. Wikicities has nofollow enabled for external links. Surely this should be something a spammer would take notice of before annoying us with your capitalism. 19:20, 9 Dec 2005 (UTC)


 * I wouldn't call it capitalism, since there doesn't seem to be any investment. It's litter, as far as I'm concerned.

Reverted Talk:Alaska and blocked ip 66.130.224.24 for littering (again) a couple of days ago. --Doug 21:09, 18 Dec 2005 (UTC)

A series of edits with invisible links placed on user and category pages. I reverted the pages and blocked ip -85.255.113.154 and 85.255.113.157--Doug 17:52, 23 Dec 2005 (UTC) And it continues...85.255.113.156 blocked for vandalism--Doug 18:24, 23 Dec 2005 (UTC)


 * These invisible edits start with the line <div style="overflow and have been found in Activism and Wikianswers as well. The IP in all instances begins with


 * 85.255.113.


 * and may end with a number ranging from 154 to 158.

--Kirk 19:22, 23 Dec 2005 (UTC)


 * 85.255.113.155 blocked on Alaska now. That's .54-.57 so far this AM. --Doug 20:18, 23 Dec 2005 (UTC)

Both of the following IP's are now blocked due to vandalism on the pages listed. Alaska:General disclaimer; 20:58. . 212.77.192.61 Alaska:Community Portal; 20:42. . 62.233.191.172 These pages each had dozens of innappropriate links pasted onto them.--Doug 16:28, 19 January 2006 (UTC)

Do you need a new watch? I don't need a new watch
Admin Flammable KUN on Uncyclopedia here. Reporting Spamming on our featureds by 64.92.165.10, of http://lucky7. to/timex/. Insidious 1 px ads, but ads nonetheless. --Flammable 23:55, 10 Dec 2005 (UTC)


 * lucky7 has been blacklisted. --Angela (talk) 23:33, 15 Dec 2005 (UTC)

overzealous spam filter
Reverting the latest vandalism here was troublesome, because of the above link being blacklisted. I tried to enclose it in tags so it doesn't register on the spam filter but had to end up breaking the link. This may need to be looked into at some point. nae'blis (talk) 19:28, 14 Dec 2005 (UTC)


 * I think it's useful that the spam is blocked even on talk pages like this. It's easy enough to just type lucky.to without the preceeding http:// that makes it a link. --Angela (talk) 23:33, 15 Dec 2005 (UTC)

More on LOTR
12.211.112.49; 69.183.223.89; and others - 203.116.214.2 219.93.174.103 over the last few weeks on the same page: http://lotr.wikicities.com/index.php?title=LOTR:Copying_from_Wikipedia&action=history

Robin Patterson 02:59, 17 Dec 2005 (UTC)


 * Those URLs are blocked now. I'll check the IPs on the other wikis later today. Angela (talk) 03:19, 17 Dec 2005 (UTC)

Uncyc
Since no one is active in #wikicities meh...: xenical-drugs.fw.nu www2.sextoys.com Also, noticed these pages get spammed (not vandalized, but actually spammed with business spam) repeatedly: uncyclopedia:User_talk:Wiki_don%27t_lose_that_number uncyclopedia:User:SGCommand Squirrel uncyclopedia:Talk:Main_Page uncyclopedia:User:B4zm4lti uncyclopedia:User:Jebus

Splarka 04:18, 27 Dec 2005 (UTC)


 * Those 2 URLs are now blocked. Angela (talk) 11:07, 3 Jan 2006 (UTC)

followhim.dyndns.tv/anime
Linkspam on genealogy:. Maybe by the same "person" who had spammed the pages Angela reverted a few hours ago mostly with different IPs. Robin Patterson 23:49, 15 Jan 2006 (UTC)

Same on engineering. Robin Patterson 23:57, 15 Jan 2006 (UTC)


 * That one is blocked, but there's still a lot of this spam to be cleared up. Angela (talk) 23:53, 15 Jan 2006 (UTC)

Thanks, Angela; I'd noticed that you had been busy cleaning. Robin Patterson 23:57, 15 Jan 2006 (UTC)

Spammer on RBWiki
I don't know if these spammers have been blacklisted yet, so I thought i'd posts their info here.


 * Robotbattle:User:85.255.113.158
 * Robotbattle:User:85.255.114.133
 * Robotbattle:User:85.255.113.156
 * Robotbattle:User:85.255.113.157

Sorcerer 14:19, 17 Jan 2006 (UTC)

Computing Knowledgebase Spam
Hi, just cleaned off the vandalism from the CK Wiki.


 * PC:85.255.113.155
 * PC:85.255.113.156
 * PC:85.255.113.157
 * PC:85.255.113.158
 * PC:85.255.114.130
 * PC:85.255.114.131
 * PC:85.255.114.132
 * PC:85.255.114.133
 * PC:85.255.114.134

Also had someone create a User Talk Page on IP PC:70.177.1.144, that read 'keep surfing', and edited part of the 'Community Portal' to include "Wikipeople in a single word for words to a single love".

--TwoTailedFox 18:53, 17 January 2006 (UTC)

4wj6.info
-> 4wj6.info Splarka 12:11, 18 January 2006 (UTC)
 * http://uncyclopedia.org/index.php?title=US&diff=prev&oldid=454889
 * http://www.wikicities.com/index.php?title=Talk:About&rcid=22560

netfirms.com
Please remove this URL from the blacklist, or change it to at least exclude "supernovawd.netfirms.com" before running this script on Memory Alpha/en again. The subdomain specified above belongs to a MA contributor and should not be considered spam. See also Memoryalpha:User talk:Spam cleanup script. Thanks. -- Memoryalpha:User:Cid Highwind)

Removing Domains
Hello, there. I'm having some trouble with the blacklist. It seems you have added certain domains which are owned by dyndns.org which a lot of people use. Domains like is-a-geek.com and kicks-ass.net. This block is preventing me from listing my personal website in my Wikifur article. Can someone help me out?


 * See Spam cleanup script. The easiest way is to use a tinyurl.com link instead of the kicks-ass one. Angela (talk) 09:10, 22 January 2006 (UTC)


 * I'm actually using is-a-geek.com, not kicks-ass.net, which I noticed was removed from the block list. Any way is-a-geek removed, as well? Threyon (talk)

Hitting on my blog
These IPs are crawling all over my blog. What to do? Andrea

IP           Page Hits B/W     Date 85.255.114.130 825 825 74.72 MB 20 Jan 2006 - 07:44 85.255.114.134 800 800 82.42 MB 20 Jan 2006 - 07:44 85.255.114.131 790 790 82.82 MB 20 Jan 2006 - 07:42 85.255.114.133 809 809 77.15 MB 20 Jan 2006 - 07:41 85.255.113.158 444 444 51.99 MB 20 Jan 2006 - 07:39 85.255.113.157 461 461 47.38 MB 20 Jan 2006 - 07:39 66.220.20.112 1 1 24.52 KB 20 Jan 2006 - 07:16 85.255.113.156 448 448 44.08 MB 20 Jan 2006 - 07:06 85.255.113.155 436 436 42.78 MB 20 Jan 2006 - 07:06 85.255.113.154 419 419 46.65 MB 20 Jan 2006 - 07:06 85.255.114.132 727 727 70.13 MB 20 Jan 2006 - 06:52


 * This page is about wiki spamming, specifically on Wikicities, so I can't really help much with blog spamming. Are you able to turn on comment moderation or block IPs from commenting on your blog perhaps? Angela (talk) 09:07, 22 January 2006 (UTC)

spam from W.f3so.info. can this be added to the Spam Script?
more spam from W.f3so.info/ and j.f3so.info/

http://peace.wikicities.com/index.php?title=Special:Undelete&target=Talk%3ACurrent_events&timestamp=20060122130322 http://peace.wikicities.com/index.php?title=Special:Undelete&target=Talk%3AGeneral_disclaimer&timestamp=20060122094133 22:35, 22 January 2006 (UTC)


 * f3so.info is already in the spam blacklist. DCLXVI 23:49, 22 January 2006 (UTC)


 * well, here is yet another .... from M.f3so.info this time.
 * all that changes is the letter before the .f3so
 * how about adding .f3so.info and \.f3so.info then ???
 * just asking ... how much should be included?
 * http://peace.wikicities.com/index.php?title=Current_events&curid=7&diff=9798&oldid=7744&rcid=8936
 * 15:11, 23 January 2006 (UTC)

narod.ru
On my wikicity, I have a legitimate need to link to a legitimate site hosted on narod.ru. The Spam cleanup script keeps deleting the entire contents of the page (not just the link to a blacklisted domain). FIX THIS BUG! The wikicity is at and the page is at  --Lowland Boxman 19:00, 8 February 2006 (UTC)


 * Lowland Boxman - It's not a bug; it's a feature. ;-)
 * Ok, I just had to say that.
 * This sounds like what the spam blacklist is supposed to do. When someone tries to post content with the blacklisted domain, in this case "narod . ru", the post will not be saved. It should not be blanking other content.  If it is, that is a bug.  If you need to link to that domain, maybe we can be more specific about what parts of it are blocked.
 * --CocoaZen 02:08, 9 February 2006 (UTC)
 * More...
 * I just checked the page you referred to, and the spam clean-up program did what it should. On the first pass through, it took the page back to the edit before the first time that domain was added.  Then you added back all that content, including the site that it recognizes as spam, so it just removed it again.
 * In order to keep that content on your page, I think the spam list needs to be adjusted. If spam has come from too many sub-sites in that domain, I don't know what the decision will be. Maybe the program can be adjusted to allow for an exception for the sub-site of "skomorokhi . narod . ru", if no spam has been posted to the sub-site.  --CocoaZen 02:20, 9 February 2006 (UTC)

The page also needs to link to  narod.ru. narod.ru is a popular free hosting service in Russia and most of the sites there are legitimate. Blacklisting the whole second-level domain just because a few spammers used it is a bad decision. Paranoid 05:16, 9 February 2006 (UTC)


 * Until a compromise can be found, you can just put in the text of the domain. Eg, you can just put in a www.narod.ru  entry, that isn't stopped by the blacklist (The blacklist only stops links, as spammers must link to get google ranking points). Splarka 05:46, 9 February 2006 (UTC)


 * I tried enclosing the link within  , but when I tried to save, I got:

Spam protection filter The page you wanted to save was blocked by the spam filter. This is probably caused by a link to an external site. The following text is what triggered our spam filter: http:// skomorokhi. narod. ru
 * In fact, I had to insert those spaces around the dots in order to mention it on this talk page! --Lowland Boxman 19:01, 9 February 2006 (UTC)


 * As I said, leave off the http:// and it works: skomorokhi.narod.ru Splarka 22:06, 9 February 2006 (UTC)
 * That's not exactly what you said; you said to enclose it in   tags.  The "http://" inside    tags is not a link!  Anyway, it's worked-around now.  BTW, do we have logs of the Spam cleanup script's activity to determine which subdomains of narod.ru the real spammers are using?  If it's just a few, they should be explicitly added to the blacklist and narod.ru should be removed. --Lowland Boxman 22:38, 10 February 2006 (UTC)
 * I said you can just put in the text of the domain and The blacklist only stops links. http:// prefixed to an address (making a URI) is a link, even if it is wrapped in  . I said (or demonstrated actually) that all you had to do was wrap only the address in nowiki to show it. My error was in assuming you knew that meant to leave off the http://. I said enclose it meaning (and showing even) just the address, not the link. Splarka 23:54, 10 February 2006 (UTC)
 * PS: You'll have to ask Tim or Angela as to the extent of the abuse of that domain, but it has appeared on several wikicities (see above). 221.3.235.96 and 202.58.85.8 only spammed with best-windows2005.narod.ru here at central, but I can't easily check all ~800 other wikicities myself. If that was the only domain, it would probably be ok to edit the entry. Splarka 23:54, 10 February 2006 (UTC)
 * There are 50,000 potentially spammed wiki pages with narod.ru on them . Please host your sites somewhere that does not support spammers in this way. The level of spam from narod.ru is completely unacceptable. There are hundreds of alternative hosts that are better at removing these spam domains. Angela (talk) 23:59, 10 February 2006 (UTC)
 * If it were my site to host, I would host it elsewhere. I'm just trying to link to it because it had some relevant information.  http://inside.nowikitags.is.not.a.link --Lowland Boxman 14:52, 13 February 2006 (UTC)

85.255.114.134 sends porn
 * Which wiki did it hit? Mindspillage 14:44, 17 February 2006 (UTC)