MediaWiki talk:Spam Blacklist

Report a spammer here


 * The spam blacklist extension is now working on all Wikicities. You can request new URLs be added to the filter by listing them here. Please state the IP (or username) used to spam and the wiki it happened on.

See also Help:Spam.

When to Add to the Blacklist?
Should we add URLs after one instance of a spam attack, or wait for more? Also, I'm not sure how much of the URL is best? Advice please? As a specific example, should I add the two URLs just posted (and already removed) to the Central Wikicity's home page? I don't want to slow the loading of every saved page, but I'd rather not have to clean-up the same URLs again. --CocoaZen 17:50, 2 Jun 2005 (UTC)


 * It depends what they are and whether they are definitely spam. Something like this is an obvious spam attack, but someone adding one innapropriate URL to a page is often not. If you're unsure, you can also add it temporarily. It might be worth checking Google for other wikis with the spam URL. If +wiki Google: SpamURL.com +wiki has hits, then it should be blacklisted. If an edit adds dozens of different URLs, adding just one of those to the blacklist will normally prevent future attacks since the edits are being made by bots who won't know to just remove the blacklisted URL from their edit. Angela (talk) 00:00, 8 Jun 2005 (UTC)

Checking contribs across wikis
I now have a somewhat buggy script that will check edits across multiple wikis. It doesn't work perfectly, but can be used for finding cases of the same user spamming multiple Wikicities, so please report the username or IP of spammers here as well as links to the diffs where they spammed. Angela (talk) 02:49, 21 Jul 2005 (UTC)

Any chance of an alphanumeric list?
Maybe a one-off extraction as a first port of call? Maybe no value?? (Some of us are a bit ignorant about these things) Robin Patterson 01:40, 1 Sep 2005 (UTC)
 * Please clarify. An alphanumeric list of what?  Are you suggesting that the blacklist be ordered?
 * That might be a good idea.
 * If that is what you meant, I'd like to understand the potential benefit.  We only add sites when they become problems.  After they've been put on the list, they shouldn't be able to be a problem.  Is that what you mean?  What value do you think it would have?  I wouldn't have any problem with it, but don't really want to go to the work of organizing what we have without a reason.
 * Another potential problem with alphabetizing is that it depends on how much of the url is used. Sometimes we have to make a choice about whether to post xyz.objectionable-site.tla or the more generic objectionable-site.tla that would also cover abc.objectionable-site.com.  As you can see, each choice would appear in a different place in an alphabetized list.
 * Again, it's not that I'm disagreeing with your suggestion, it's just that I don't understand it. Maybe someone else will have a better response.  --CocoaZen 02:09, 1 Sep 2005 (UTC)


 * I don't mind, but I often update the page from the version on Meta, so I don't promise to keep it alphanumeric, but someone else can if they find it useful. Angela (talk) 15:25, 2 Sep 2005 (UTC)

Chem is back
In Cities: and Genealogy: Robin Patterson 19:20, 3 Oct 2005 (UTC) By 69.50.165.186 - AGAIN! - looks like that address needs a ban, or a final warning at least Ace of Risk 20:10, 3 Oct 2005 (UTC)


 * 69.50.165.186 again... ouch. He should have been blocked on the server side already, but the block somehow got removed when the server rebooted. He's created 330 more "chem" pages. Insane. Jason's going to try to delete them automatically this time. Angela (talk) 21:33, 3 Oct 2005 (UTC)

Hydrocodone sites - block all?
There are multiple hydrocodone sites which have been spammed. Would it make sense to blacklist all sites with "hydrocodone."? Normally it would be overkill, and it seems to me that assuming good will works well for most cases, but after multiple violations, I'm proposing this stronger measure. If someone comes up with a non-advertising, legitimate site, we could remove this blanket block. --CocoaZen 03:37, 6 Oct 2005 (UTC)


 * Yes, blocking all those is fine. Just don't block cialis. I considered doing so before until I realised it"s the middle of the word "socialism" which has legitamate links, especially on the socialism wiki. :) Angela


 * Wow, that explains some odd looking stuff I've seen elsewhere - just depends if someting can be identified as a delimited word, though the perishers usually mis-spell stuff like that to get though spam filters Ace of Risk

Atspace
Real Life Soap wikicity; porn link spam by 195.16.125.192


 * I've blocked those 4 subdomains. If atspace.com continues to show nothing but spammy domains, it might be worth blocking them totally. Angela (talk) 06:44, 23 Oct 2005 (UTC)

Blocking IP addresses
i don't know the name of this stupid guy, but he has put thousands porno websites on the first pages of svt.wikicities.com (french wiki on biology). I already erase his stuff, i hope this kind of people can be blacklisted, even if we don't know his name
 * IP addresses can be banned (not blacklisted). Any administrator for your Wikicity can do that.  Pieces of inappropriate URLs can be blacklisted.  This makes it so that no one can save a page with those URLs.  I think Angela may have already added ones from this attack, but I'll check and add some, if she hasn't.  Thank you for reporting the problem.  --CocoaZen 23:11, 23 Oct 2005 (UTC)

http://ogame.wikicities.com/index.php?title=Main_Page&oldid=32 http://ogame.wikicities.com/index.php?title=Main_Page&oldid=33 http://ogame.wikicities.com/index.php?title=Main_Page&oldid=35
 * Please read the previous entry. These posts were rude, and luckily were fixed.  But, they aren't URLs or keywords that can be blacklisted.  IP blocking is different, and your admins have already blocked this IP for 999 days.  I don't think anymore action needs to be taked, but thank you for reporting the problem.  --CocoaZen 02:53, 24 Oct 2005 (UTC)

Fiberia
http://alaska.wikicities.com/index.php?title=Talk:Alaska&diff=0&oldid=528 This one was just a single link to a pharmaceutical. Removed. Blocked.--Doug 06:04, 8 Nov 2005 (UTC)


 * This was fiberia again, which should be blocked already. Angela (talk) 22:55, 9 Nov 2005 (UTC)
 * Weird. It's not getting blocked because of the underscore in the url.. 00:55, 11 Nov 2005 (UTC)


 * Reported at MediaWiki bug 3934. Angela (talk)

Invisible divs
Yes, more fun...  This "invisible" exploit they've found is getting really annoying as they only show up when viewing diffs, but I guess you can't really ban that attribute... Garrett 22:15, 13 Nov 2005 (UTC)
 * nyork.dyndsl.com/phentermine/
 * nyork.dyndsl.com/butalbital/
 * eagle.myftpsite.net/tramadol/
 * eagle.myftpsite.net/cialis/
 * direc.dynu.net
 * host.fdns.net/tramadol/
 * This isn't done to be annoying, but apparently to minimize harm done to the wiki; Alexandru Popescu, one of the guys that does this, said to me in an email to reason why his spam was "ethical": "2nd is that my spam comes in a tiny div and is always appended ." I guess it's better in some aspects.
 * But I really find it hard to believe that spammers are too stupid to notice everything here has rel=nofollow. 00:52, 14 Nov 2005 (UTC)

More on Talk:Alaska
http://alaska.wikicities.com/index.php?title=Talk%3AAlaska&diff=0&oldid=530 Whoever is into this is choosing the same spot to leave a single link. It reminds me of canine scent-marking behavior.--Doug 07:19, 16 Nov 2005 (UTC)


 * q4w.net is already blocked. If this one gets through again, please let me know. Angela (talk) 09:01, 16 Nov 2005 (UTC)

New Alaska wiki Spam
From my aggregator I discovered that a new edit happened on http://alaska.wikicities.com/wiki/Category_talk:Browse There are dozens of links left inside of div tag: guid="{877b43bd-1c2b-e184-4437-a8dc809f3303}"style="overflow:auto;height:1px;" The links point to q301.com. Clicking on the page showed no text. I removed the links, blocked the user.--Doug 16:47, 18 Nov 2005 (UTC)
 * They were over at MozCom, too, with about hundred or so edits. " ." I'll email him and tell him about nofollow.. you'd think someone who spams wikis for a living would know to check for it.  19:44, 18 Nov 2005 (UTC)
 * I just found a bunch more on Cities:. I'l add it (q301.com) to the blacklist.  What's "no follow"?  And, I wouldn't necessarily believe that the signature matches the poster.  This was odd because they weren't going to be visible anyway; are they just trying to get their crawler count up? --CocoaZen 22:11, 18 Nov 2005 (UTC)
 * If you look at the page source you'll see all the external links have rel="nofollow" attached to them. It means webspiders won't crawl the links, so their search ranking doesn't go up, which is the reason behind wikispam usually -- so their efforts are in vain. I think DCLXVI added q301 earlier, though. :) 22:25, 18 Nov 2005 (UTC)
 * I just blocked 86.120.197.66 for doing the same thing on history. --Kirk 22:25, 18 Nov 2005 (UTC)

The Responsible One : What you don't know is that Yahoo! seems to ignore the nofollow tag or at least has old versions of your pages. Technically nofollow stops from casting a vote but it does queue you up for indexing. Trust me on this. I think you have guessed the eMail is fake of course. It's just for me to know when you are stamped (not spammed). Cheers ! And btw, I've seen the nofollow , but I've explained my reasons. :) I appologize for my actions but I think you've seen I did no deface your sites, and my spam was virtually invisible . I've seen many wikis wiped out but I have respect for your work.

Take care. I don't think I'll spam you anymore. (scythe@go.ro - for any potential comments)

Creatures Wiki
narod.ru .. seems familiar to me from somewhere, but I can't place it. 202.58.85.8 http://creatures.wikicities.com/index.php?title=User_talk%3AOfficer_1BDI&diff=0&oldid=15345 - Malkin 04:47, 20 Nov 2005 (UTC)

221.3.235.96 here at central and 202.58.85.8 also vandalized additional wikicities. --JWSchmidt 16:49, 20 Nov 2005 (UTC)
 * "viagra" spam at RLS wikicity again by 84.235.174.186 and 202.58.85.8 returned to the fiction wikicity. --JWSchmidt 14:21, 21 Nov 2005 (UTC)


 * Also 219.93.174.100. Do you blacklits the IP or the site that they link to? If its the link, it is about levitra


 * I blacklist the URL on all wikis. Individual wikis can blacklist the IP. Angela (talk) 14:16, 3 Dec 2005 (UTC)

Alaska (again)
Spam from ip 84.235.174.186 and ip 203.116.214.2 which was first commented with "Problem?" and then on the second edit "Reported vandalism." I didn't know how to use the rollback feature so after a few tries I simply re-edited the last good version and saved it. The vandalism happened on Talk:Alaska, same as the other times. --Doug 03:17, 23 Nov 2005 (UTC)


 * If you're logged in, you should see a "rollback" link when you look at the user's contributions, or at a diff page. Angela (talk) 14:16, 3 Dec 2005 (UTC)