Wikipedia talk:WikiProject Spam/2012 Archive Aug 1

Page contents not supported in other languages.
Source: Wikipedia, the free encyclopedia.

User:Sobur09

something to say?
) 04:26, 1 August 2012 (UTC)

affiliatefuture.com

Spammers

No redeeming value.  Defer to Local blacklist MER-C 10:23, 1 August 2012 (UTC)

diplomacy.edu Spamming

Google Analytics ID: UA-364439 - (Track - Report - reverseinternet.com • Meta: Track - Report)
Accounts

Tanja Nikolic (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
Valentino k (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
--Hu12 (talk) 17:41, 1 August 2012 (UTC)

Return of Product Development Institute and Stage-Gate International Spamming

Google Analytics ID: UA-684908 - (Track - Report - reverseinternet.com • Meta: Track - Report)
Spammed
Article Spam
Accounts

EmirOzdemir10 (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam) (Emir Ozdemir, Product Manager)
70.25.21.97 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
Sunil Bechar (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam) (Marketing Communications at Stage-Gate Inc)
69.159.45.85 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
69.157.46.2 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
65.92.52.28 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
[email protected] (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
Dkrempa (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam) (Daniel Krempa. Director of Digital Platforms at Stage-Gate Inc)
Sbechar (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam) (Marketing Communications at Stage-Gate Inc)
Izabellalis (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam) (Izabella Lis. Product Manager at Stage-Gate International)
Jenarl (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
130.215.109.204 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
--Hu12 (talk) 22:53, 1 August 2012 (UTC)

Virtual Medical Centre Adsense link-farming Spam

Adsense google_ad_client = pub-2899426054289428 (Track - Report - reverseinternet.com • meta: Track - Report)
Articles
Accounts

Medicalcentre (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
Medical info (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
Baggy75 (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
116.212.205.246 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
203.59.102.88 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
Musicnotes117 (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
203.59.45.176 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
Fascia.far (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
Sambo72 (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
203.59.102.88 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
Long term multi-article, multiple Adsense related domains. replacing existing links with ones own link is never a sign of good faith. --Hu12 (talk) 03:23, 2 August 2012 (UTC)

DocuWare Spamming

Google Analytics ID: UA-5632806 - (Track - Report - reverseinternet.com • Meta: Track - Report)
Article spam
w:fr:DocuWare
w:de:DocuWare
w:es:DocuWare
w:it:DocuWare

de:Benutzer:ECMdoku/DocuWare

Accounts
Accounts

ECMdoku (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)

es:Special:Contributions/ECMdoku
it:Special:Contributions/ECMdoku
fr:Special:Contributions/ECMdoku
de:Special:Contributions/ECMdoku

Mary K. Williams (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
Klsmith88 (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
Docuware s.l. (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)

es:Special:Contributions/Docuware s.l.

DDBritta (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
Floyd2Carolina (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
217.91.107.21 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
85.48.252.237 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)

es:Special:Contributions/85.48.252.237

88.30.0.28 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)

es:Special:Contributions/88.30.0.28

91.199.155.2 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot) --Hu12 (talk) 10:56, 2 August 2012 (UTC)

imcredel.com

links
accounts

Multiple SPA accounts adding misleading links and hijacking existing "official links" from multiple articles to point to this site. --- Barek (talk • contribs) - 04:14, 3 August 2012 (UTC)

seeraa.com

Google Analytics ID: UA-18179304 - (Track - Report - reverseinternet.com • Meta: Track - Report)

Spammers

 Defer to Local blacklist MER-C 12:24, 3 August 2012 (UTC)

silsila-e-iftekhari.com Spamming

Accounts

Spam attack the last 2 days--Hu12 (talk) 19:52, 3 August 2012 (UTC)

packershalloffame.com Spamming

Google Analytics ID: UA-24540090 - (Track - Report - reverseinternet.com • Meta: Track - Report)
Accounts

--Hu12 (talk) 20:13, 3 August 2012 (UTC)

Joseph Di Virgilio Long term promotion

(old) Wikipedia:Conflict_of_interest/Noticeboard/Archive_15#Joseph_Di_Virgilio

Accounts


--Hu12 (talk) 02:16, 4 August 2012 (UTC)

radioguide.fm

Adsense google_ad_client = pub-7023873810903687 (Track - Report - reverseinternet.com • meta: Track - Report)
Google Analytics ID: UA-2177208 - (Track - Report - reverseinternet.com • Meta: Track - Report)
Adsense related
Accounts

--Hu12 (talk) 17:14, 5 August 2012 (UTC)

www.mariocorp.com

194.102.94.193 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)

Also 86.126.5.148
Also www.mariocorp.ro

History of Italian fashion Milan Fashion Week Italian fashion

Classic: adding new copy of link immediately following a previous insertion October 2011. Paid by the keystroke? Shenme (talk) 04:59, 6 August 2012 (UTC)

hoparoundindia.com

Anyone have time to look into this link? I saw that

talk
) 15:48, 23 July 2012 (UTC)

  • talk
    ) 03:19, 24 July 2012 (UTC)

--

talk
) 16:51, 24 July 2012 (UTC)

Most of the remaining links that I've seen were added as references. Refspam perhaps? Its hard to tell if the site is reliable, Indian geography isn't really my field. If the site is reliable I'd say it isn't doing any harm as a reference. ThemFromSpace 17:07, 25 July 2012 (UTC)
Adsense related
Adsense google_ad_client = pub-2014564446906822 (Track - Report - reverseinternet.com • meta: Track - Report)
--Hu12 (talk) 19:39, 25 July 2012 (UTC)

The site is clearly intended to promote tourism. I don't see any indication that they meet

talk
) 15:30, 26 July 2012 (UTC)

These could all be the same person. --
talk
) 15:55, 27 July 2012 (UTC)
Also found on fa fwiw. Many on en are from Rkiran t (talk · contribs), who started posting them on 19 March.LeadSongDog come howl! 22:05, 27 July 2012 (UTC)
Sorry, but "fa" = Farsi? --
talk
) 13:50, 28 July 2012 (UTC)
Googling "hoparoundindia.com" site:wikipedia.org finds [1] and [2] in addition to all the English pages. LeadSongDog come howl! 23:45, 29 July 2012 (UTC)
Looks
talk
) 23:45, 30 July 2012 (UTC)
One editor added it a source when they had difficulty finding anything better. While he agrees it's promotional in nature, I'm not against keeping it for clear statements of fact about locations or regions, but not for history, religion, etc, and certainly not for listing "local attractions." --
talk
) 15:53, 1 August 2012 (UTC)
I've found a few more editors using it as a reference. --
talk
) 16:19, 4 August 2012 (UTC)

I'm done with this. There are currently 32 links still, but most are from other editors made in good faith. I'm sure I missed a few by Rkiran t, but I'm not going back to find them. --

talk
) 17:21, 6 August 2012 (UTC)

2012-london-olympics-news.com and dhruvplanet.com - can someone look into this?

Related links
Editors
120.63...
202.134...
Probably should be considered for immediate blacklisting given the problems with the related links --
talk
) 14:16, 28 July 2012 (UTC)
Cleanup of 2012-london-olympics-news.com done.
(As an aside, it looks like there are other bloggers doing the same thing: creating websites to carry news related to the Olympics, then spamming them to Wikipedia.) --
talk
) 03:50, 29 July 2012 (UTC)
The site appears to be plagiarizing articles. --
talk
) 21:30, 29 July 2012 (UTC)
I've requested that 202.134.156.161 be blocked as the only one continuing to spam the olympic site. Still looking at the other sites... --
talk
) 19:54, 30 July 2012 (UTC)
A number of editors have noted that dhruvplanet.com articles sometimes mirror Wikipedia articles, and have removed them as unreliable and plagiarizing. --
talk
) 22:12, 6 August 2012 (UTC)
Adsense google_ad_client = pub-9445189103749654 (Track - Report - reverseinternet.com • meta: Track - Report)
Previous incidents:
 Defer to Local blacklist MER-C 11:33, 31 July 2012 (UTC)
Cleanup of dhruvplanet.com done. Found rupeeinvest.com spamming as well, which shares same host and adsense pub-9445189103749654. --
talk
) 22:44, 6 August 2012 (UTC)
Cleanup of rupeeinvest.com done. --
talk
) 03:28, 7 August 2012 (UTC)

Technofix book/cite Spamming

Accounts

Doctor Lionel (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
65.249.55.82 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)

"Huesemann, M.H., and J.A. Huesemann (2011). http://www.technofix.org Technofix: Why Technology Won’t Save Us or the Environment, New Society Publishers, Gabriola Island, British Columbia, Canada,"

--Hu12 (talk) 01:47, 7 August 2012 (UTC)

*codedatabase.com Spamming

Accounts

Dhruvpat (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
59.183.170.52 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
59.183.138.166 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
59.183.136.49 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
59.183.156.253 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
59.183.133.207 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
59.183.184.6 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
59.183.133.207 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
--Hu12 (talk) 02:33, 7 August 2012 (UTC)

martinlawfirm.com

Google Analytics ID: UA-788456 - (Track - Report - reverseinternet.com • Meta: Track - Report)

Spammers

MER-C 09:53, 31 July 2012 (UTC)

Updated. MER-C 10:24, 5 August 2012 (UTC)
 Defer to Local blacklist MER-C 10:38, 7 August 2012 (UTC)

latestmoviez.com

Adsense google_ad_client = pub-0045382496712859 (Track - Report - reverseinternet.com • meta: Track - Report)
Google Analytics ID: UA-236291 - (Track - Report - reverseinternet.com • Meta: Track - Report)

Spam pages
Sites spammed
  • redirects to latestmoviez.com
  • redirects to latestmoviez.com
  • redirects to latestmoviez.com
Spammers

 Defer to Local blacklist MER-C 12:36, 13 July 2012 (UTC)

Updated. MER-C 09:51, 15 July 2012 (UTC)
talk
) 15:22, 15 July 2012 (UTC)

Post-blacklist spamming:

Spammers

MER-C 10:02, 20 July 2012 (UTC)

Continued:
MER-C 01:56, 21 July 2012 (UTC)
Also, plain text spamming. MER-C 06:21, 22 July 2012 (UTC)

Another day, another domain:

MER-C 01:50, 23 July 2012 (UTC)

I note that the latter 2 are redirect domains (which should be on meta without even thinking about it) - I've instructed XLinkBot to do whack-a-mole. --Dirk Beetstra T C 06:49, 23 July 2012 (UTC)

MER-C 11:08, 3 August 2012 (UTC)

1.38.16.95 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
1.38.16.22 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
1.38.17.106 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
1.38.17.106 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
plus Added
Rangeblocked
--Hu12 (talk) 19:26, 3 August 2012 (UTC)

I'm not going to bother listing the spammers any more. MER-C 09:35, 7 August 2012 (UTC)

Forgotten opera singers

Users

Sock started after first sockmaster got blocked. Same articles, same inserted text. --Dirk Beetstra T C 10:30, 7 August 2012 (UTC)

geekscholars.com

links

geekscholars.com: Linksearch

Lone boatman (talk
) 14:30, 7 August 2012 (UTC)

accounts

eyetwitchingcure.org

links
unambiguous advert page created
accounts

Spamming of URL into multiple articles by

SPA accounts. --- Barek (talk • contribs
) - 16:03, 8 August 2012 (UTC)

Leafly

Google Analytics ID: UA-319135 - (Track - Report - reverseinternet.com • Meta: Track - Report)
Article
Accounts

Lem0415 (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
Christian Groh (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
174.65.115.82 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
--Hu12 (talk) 03:01, 9 August 2012 (UTC)

xt3.com

Continuous pushing, see ANI thread Wikipedia:Administrators'_noticeboard/Incidents#Mass_spamming_from_multiple_socks.

Final warning given. Creating this report 'for the record'. --Dirk Beetstra T C 07:08, 9 August 2012 (UTC)

Long term mdct.com.au Spamming

Accounts

Long term(2007) persistant spamming including Link vandalism;[4][5]. --Hu12 (talk) 13:43, 9 August 2012 (UTC)

R To Z Media Spamming

Adsense google_ad_client = pub-7088803035940952 (Track - Report - reverseinternet.com • meta: Track - Report)
Google Analytics ID: UA-7072263 - (Track - Report - reverseinternet.com • Meta: Track - Report)
Accounts

Randi Zuckerberg's company. --Hu12 (talk) 13:43, 10 August 2012 (UTC)

92.251.229.192

92.251.229.192 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)

freerice.com: Linksearch en (insource) - meta - de - fr - simple - wikt:en - wikt:fr • MER-C X-wiki • gs • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced - RSN • COIBot-Link, Local, & XWiki Reports - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.com

IP adding spam link to talk pages. --Nathan2055talk - contribs 01:14, 12 August 2012 (UTC)

Triplett, J. M
WP:BOOKSPAM

Accounts

Dohaschmoha (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
24.166.34.106 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
--Hu12 (talk) 00:38, 13 August 2012 (UTC)

Bertrand Moingeon ‎
WP:BOOKSPAM

Articles
Accounts

Management1 (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
Bmpub (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
Innovation91 (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
79.85.198.179 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
80.214.5.61 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
--Hu12 (talk) 13:12, 13 August 2012 (UTC)

HospitalGlobal

Google Analytics ID: UA-33643851 - (Track - Report - reverseinternet.com • Meta: Track - Report)
Accounts

Medicworld (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
Clear promotion additions (domain created:7/24/2012)-Hu12 (talk) 14:10, 13 August 2012 (UTC)

Oxford Bibliographies
WP:SOCK
Spamming

Accounts

Rwarden87 (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
Christina1012 (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
Naar0711 (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
Scisw (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
12.182.77.130 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot) OXFORD UNIVERSITY PRESS OXFORD-U61-77-128
--Hu12 (talk) 17:15, 13 August 2012 (UTC)

Spammer(s) blocked--Hu12 (talk) 17:24, 13 August 2012 (UTC)

Long term spamming by logos.com

216.57.209.252 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
User has been spamming links for logos.com bible software products for at least three years, continuing in spite of eight warnings over the years, and a final warning four days ago. To add to the cynicism of this 'user,' they are spamming from the logos.com owned email server,[6] which also geolocates to their corporate headquarters in Bellingham, Washington. A longer than typical block is warranted in my opinion. First Light (talk) 00:13, 15 August 2012 (UTC)

Tracking. MER-C 01:43, 15 August 2012 (UTC)
The static IP range occupied by Logos Research Systems,
talk
) 21:02, 15 August 2012 (UTC)
Many thanks. I see they continued to spam even after I posted here (and before your block, of course). First Light (talk) 21:46, 15 August 2012 (UTC)

Tarai Dooars Tour & Travels Spam

Google Analytics ID: UA-25929093 - (Track - Report - reverseinternet.com • Meta: Track - Report)
Accounts

117.201.115.177 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
117.201.125.100 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
117.201.118.197 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
--Hu12 (talk) 13:14, 15 August 2012 (UTC)

Return of Long term doabaheadlines.co.in Citespam

Articles

Accounts

Asside from the MASS recent

WP:CITESPAMming, activity also involes replaceing established reliable sources (such as the official Olympic site (london2012.com)[7][8]) with this unreliable spam. Others have also noticed this behavior. I find it very telling that, Money would be on the mind of this editor --Hu12 (talk
) 13:50, 15 August 2012 (UTC)

Fleming Europe Promotion

Google Analytics ID: UA-32277402 - (Track - Report - reverseinternet.com • Meta: Track - Report)
Articles
Accounts

‎Peterkortvel (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam) Marketing Executive chez Fleming Europe[9]
178.40.21.207 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)

cs:Special:Contributions/178.40.21.207

--Hu12 (talk) 13:39, 16 August 2012 (UTC)

ForexPeaceArmy.com

Google Analytics ID: UA-1863633 - (Track - Report - reverseinternet.com • Meta: Track - Report)
Accounts

ForexTruth (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
Kostas1284 (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
88.74.19.46 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
Spamming, with an agenda. Spammer(s) blocked--Hu12 (talk) 23:01, 16 August 2012 (UTC)

Tattoo spamming

Anonymous IPs mass spamming to mgunandinktattoostore.info: Linksearch

talk
) 06:38, 17 August 2012 (UTC)

DVBViewer promotion

Articles
Accounts

En rago (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
CHackbart (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
Oliver Sc (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
91.20.211.242 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
31.17.173.130 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
--Hu12 (talk) 21:35, 10 August 2012 (UTC)

More showed up in the Wikipedia:Articles for deletion/DVBViewer debate
Ezekial 9 (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam
)

--Hu12 (talk) 14:40, 14 August 2012 (UTC)

It appears that CHackbart (talk · contribs) is the re-creator of the articles (as evidenced by this post) and is the author of DVBViewer.--Hu12 (talk) 19:57, 15 August 2012 (UTC)
79.207.118.114 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
91.20.222.108 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
Tag removal--Hu12 (talk) 01:13, 18 August 2012 (UTC)

spoturtrain.com

Accounts

Murugaprabum (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
61.247.241.218 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
124.124.216.219 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
203.193.158.82 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
--Hu12 (talk) 01:24, 18 August 2012 (UTC)

spiralpointtaps.com

link
related link
previous report
new involved accounts

Repeated addition of blog front-end that links heavily and exclusively to taylortool.com. --- Barek (talk • contribs) - 16:11, 16 August 2012 (UTC)

69.166.19.6 tried to delete this Wikiproject Spam section a few hours ago.
Now the IP has spammed cross-wiki:
--A. B. (talk • contribs) 21:43, 20 August 2012 (UTC)

irishcountry.ie Spamming

Adsense google_ad_client = pub-4843620931592465 (Track - Report - reverseinternet.com • meta: Track - Report)
Accounts

--Hu12 (talk) 17:17, 19 August 2012 (UTC)

Snodger Media Spamming

Google Analytics ID: UA-739971 - (Track - Report - reverseinternet.com • Meta: Track - Report)
Analytics related
Articles
Accounts

Pinkcat2 (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
202.137.73.41 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
124.148.135.209 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
220.235.39.119 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
124.168.122.171 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
Site is essentially a fork of wikipedia, fails

WP:RS--Hu12 (talk
) 15:05, 20 August 2012 (UTC)

Oleg Prikhodko Spamming
Accounts

--Hu12 (talk) 00:30, 21 August 2012 (UTC)

hazardousareas.net

Google Analytics ID: UA-21278874 - (Track - Report - reverseinternet.com • Meta: Track - Report)
Accounts

Rudivittori (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
2.40.94.68 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
--Hu12 (talk) 00:39, 21 August 2012 (UTC)

arbitrarytweets.com

Spammers

MER-C 12:32, 21 August 2012 (UTC)

related spam sites

Accounts

Rohan.kk (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
Rohan.kk100 (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
Taruna.kk100 (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
Kk100.rajesh (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
Mohan.kk100 (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
Rajesh.100kk (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
Rajesh.kk100 (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
Kumar.kishor100 (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
Rajesh.r100 (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
219.91.180.24 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
K.kamlani (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
Sock spamming related sites and moving ones own link "UP" is never a sign of good faith.--Hu12 (talk) 18:25, 21 August 2012 (UTC)

There are a few more userIDs matching these user name patterns in my recent blocks - all were found via CU. --Versageek 18:39, 21 August 2012 (UTC)
R.p.kishor (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
Ramesh.kishor100 (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
Rajesh.kk99 (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
Rakesh.kk99 (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
Kamlani.rohan Template:Toolbar
Rajesh.kk99 safesubst:#invoke:Toolbar
Got em, thanks--Hu12 (talk) 22:23, 21 August 2012 (UTC)

Grime Digital Spamming

Template:GoogleAnalyticsSummary
Template:GoogleAnalyticsSummary
  • Template:LinkSummary
Related
Accounts

Template:IPSummary

"Grime Digital is a collective of like minded people working together to improve the online presence of Grime" - grimedigital.com footer

Spamming categories multiple times is never a sign of good faith.--Hu12 (talk) 14:55, 22 August 2012 (UTC)

Outsource Infotech Services

links
related sites
  • Template:LinkSummary
accounts
  • Template:UserSummary

Blatant advert linkspam by SPA/COI user. --- Barek (talk • contribs) - 17:42, 24 August 2012 (UTC)

hairsaloninclearwater.com

Template:GoogleAnalyticsSummary

  • Template:Spamlink
Spammers
  • Template:IPSummary
  • Template:IPSummary
  • Template:IPSummary

MER-C 12:10, 15 August 2012 (UTC)

  • Template:IPSummary
Shared IP. MER-C 10:47, 21 August 2012 (UTC)
The first three IPs are in Florida, as is the hair salon. At least one has been identified as a source of forum spam. The last IP is in Nepal. Maybe it's an open proxy or maybe it's just a mountain-climbing hairstylist. --A. B. (talk • contribs) 01:34, 25 August 2012 (UTC)
  • Template:IPSummary

Template:Deferblack MER-C 10:50, 27 August 2012 (UTC)

Automated wikipedia trolling

Kulkapedia

https://www.google.co.uk/search?q=kulkapedia

thanks! — Preceding unsigned comment added by 92.40.255.91 (talk) 10:44, 28 August 2012 (UTC)

Questions about "Chinese Knockoff Spam"

Continuing earlier research about link spam has led me to intensive archive browsing. It is impossible not to notice the many-many iterations of "Generic Chinese Knockoff Spam" that appear throughout 2010 and 2011 (now inactive?). Given that this time is far past, it inhibits my investigation a bit. Moreover, it seemed the team here usually blacklisted it without much discussion or fanfare. For these reasons, I'd like to ask a few questions of those who were active at that time:

  • Was there a particular modus operandi for their actions?
  • How were "related domains" found? I notice that usually only a few domains were actually spammed, but many more were pro-actively blacklisted on some basis? Something to do with WHOIS registrations?
  • What was actually at the destinations? Were there just a couple of core sites that they endlessly purchased new domains for?
  • How do you think they got all those IPs? Do you think this was a single person or a team? Were they utilizing proxy servers, or something more powerful?
  • Do you have any evidence that these spam links were being used elsewhere? blog/forum spam?
  • Do you think these links were added by a human acting quickly, or were there automation scripts?
  • Has any attacker near this scale/complexity been seen before?

Thanks for all you help, West.andrew.g (talk) 21:16, 28 July 2012 (UTC)

From top to bottom:
  • Profit.
  • Web search for various unique Chinglish phrases.
  • They usually aren't redirects. Chinese knockoff domains are copypasta/reskins.
  • I don't know, but there is definitely more than one person doing it.
  • Google is your friend. Something like "louis vuitton cheap comment" will do. This is an internet wide problem.
  • Most likely human sweatshop spam.
  • No.
    This is organized, as in organized crime
    .
MER-C 03:03, 29 July 2012 (UTC)
In case people are not aware, Andrew is probably not just curious—he is able to monitor link additions and perform complex processing. If there were patterns that might be detected (article categories, timing of link additions, ranges of IPs, and more), his processing may be of assistance (potentially, it could do more background checking than XLinkBot). The copypaste/reskins observation is of interest—it would be difficult, but it might be possible to guess that the target of an added link is a reskin. Another clue might be the whois registrant for the domain, although whois lookups can become expensive. Johnuniq (talk) 03:22, 29 July 2012 (UTC)
Johnuniq is correct. I have several corpora of Wikipedia link spam, run a link processing engine, and have worked heavily in anti-vandalism development (see WP:STiki. No offense, but I found MER-C's answers were a bit sarcastic/brief, whereas I was hoping to have a more technical discussion on the topic of Generic Chinese Knockoff Spam (CGKS). If anyone seems to be persistent and technically sophisticated in profiting off of wiki via link spam, it would seem to be those folks. Understanding their attack vectors would seem key to understanding Wikipedia's spam weaknesses. So to go top to bottom again, with a little more detail:
  • Yes, profit is obviously the over-arching MO. However, the actions are just puzzling. Sometimes they blank articles with links. Sometimes they insert 5-10 at a time in the middle of an article. Sometimes they post to talk pages. They obviously aren't trying to blend in and evade the first wave of anti-vandal checks. With this behavior so obvious to patrollers, its difficult to imagine how the links survive long enough to extract any utility. It's also a bit odd that they had to know the accounts/IPs would be blocked, but didn't seem to use accounts to their full capacity (i.e., spamming at speed until blocked). Real spam outfits know how things work and have technical sophistication, these folks just seemed dumb and random at times (which made me wonder about automation).
  • I don't imagine you actually searched Chinglish phrases. I imagine the related domains were sitting on the same server?
  • The destination sites were actually selling products, I assume? With this complexity I imagined they were probably part of a larger affiliate program into the actual goods, but probably using copypaste/reskins themselves - i.e., some central backend was fulfilling any "orders"
  • Looking at the accounts used was a bit perplexing. For their poor understanding of the interface and norms (i.e., spamming talk pages, they still managed to register some accounts. As far as the IPs involved, they seem all over the place. This isn't local IP hopping. They are geographically distributed. This screams proxy servers to me. In the worst case, it could be a botnet (but these attacks simply don't seem large enough for that). Why do you believe it is more than one person? The spam never really happened so quickly that it couldn't be a single person.
  • I understand that GCRS is a widespread Internet problem, but there are certainly many outfits involved in it globally. I was curious about the domains Wikipedia was dealing with in particular. They've paid for 1000s of domain registrations, so if they weren't getting used on wiki, they had to be showing up elsewhere. Strange, then, why they didn't show up on wiki? 50 or so pockets of spam over 1.5 years isn't *that* much for an outfit that seems to have these capabilities.
  • -skip-
  • I understand the organized crime ramifications of spam outfits. What I was asking if anyone/anything had come close to this in your experience *on Wikipedia"? My interest here is confined to wiki/Wikipedia experience.
Additional questions:
  • Were all/most of these blacklisted? Over at meta? Including the "related but not yet seen on wiki" set? MER-C always seemed to lodge the reports, but it wasn't clear the blacklist treatment of these guys.
Thanks for your help. More than a casual passer-by, I am trying to develop tools/algorithms that aide the project. I'd be happy to take this up on IRC if that is easier for anyone involved. Thanks, West.andrew.g (talk) 04:04, 29 July 2012 (UTC)
P.S. Why when I do an archive search for "Generic Chinese" or any variant thereof I only get 24 results? I have more luck searching for "2.0", "3.0", "4.0", but this only gets me one at a time and doesn't help with the odd ones, i.e., "8.5". Thanks, West.andrew.g (talk) 04:36, 29 July 2012 (UTC)
Thanks Andrew, however this page is not a good place for discussion because it is subject to a lot of churning as new reports come in.
@MER-C: Do you think there is value in continuing this elsewhere? A subpage dedicated to the topic? I don't think IRC is desirable as complex statements there are difficult—a wiki page would help with development of any ideas, and may be useful for future discussions. I suggest moving this section to a subpage, with a link here. Johnuniq (talk) 04:42, 29 July 2012 (UTC)

I think that this is very well within the capabilities of LiWa3/XLinkBot. Problem is that XLinkBot only reverts, spammers will re-insert add nausiam, they don't care when accounts get blocked (just move to another IP), they don't even care when their links get blocked (they just copypaste or reskin to a new domain). It is how they make money. I think that it is therefore valuable to have these link blanket-blacklisted. Preemptively, it saves us, and XLinkBot, a lot of work. If the spammers found out Wikipedia is a target (and they obviously did, some of the links were spammed to Wikipedia), then the fact that only so few links were actually added (while the internet at large was targetted) may actually show MER-C's efficiency here: either they did not spam because their domains were already blacklisted, or the sweat-shop workers were told to not make a priority of Wikipedia, as it was too effective too fast.

Andrew, I'd like to hear more about your detection systems, maybe there are things that can be incorporated into LiWa3 so we can work in real time and ask COIBot to make reports. Indeed, maybe a dedicated subpage is better. --Dirk Beetstra T C 05:09, 29 July 2012 (UTC)

Regarding IRC, MER-C and I generally hang around in #wikipedia-spam-t (the main 'command center' for XLinkBot, though it , you may want to join us there. Regarding doing everything on-wiki - I'd like to put

WP:BEANS into consideration there. --Dirk Beetstra T C
05:12, 29 July 2012 (UTC)

However, the actions are just puzzling. Sometimes they blank articles with links. Sometimes they insert 5-10 at a time in the middle of an article. Sometimes they post to talk pages. They obviously aren't trying to blend in and evade the first wave of anti-vandal checks.
These guys (1) probably don't speak English too well and (2) are targeting the entire interwebz. This isn't "pay $X to get your link into Wikipedia" spam -- these spammers don't specialize and are paid piecewise per comment => quantity over quality. They do not target Wikipedia specifically -- we're just another website to be spammed. Something like this, I guess. (I have read a more detailed article on this subject but the link escapes me). Usernames are often the same across websites. Messages are usually copypasta. Automation (if used) is usually achieved with XRumer. If there are bots, they pass the Turing test (only because the humans are so dumb).
I don't imagine you actually searched Chinglish phrases.
Yes, I actually did. Examine the spam reports here closely and you will find the search phrases I used.
The destination sites were actually selling products, I assume?
Mostly. There are also
splogs
for the knockoff domains.
Something to do with WHOIS registrations?
WHOIS data isn't really helpful for knockoffs. Come to think of it, this might be an example of smurfing. Re: copy and paste reskins -- they look the same, and many use the same server-side software. (So do many other sites).
blacklist treatment of these guys
Blacklisted on sight, uncontroversially.
Why do you believe it is more than one person? The spam never really happened so quickly that it couldn't be a single person.
Remember, it's the entire internet being targeted. What you see here is the tip of the iceberg.
Do you think there is value in continuing this elsewhere?
I'll "sticky" this by adding an appropriate timestamp. Things tend to die on subpages.
I apologise for my brevity, but the OP should have put a little more effort into asking the initial questions. MER-C 09:46, 29 July 2012 (UTC)
Sticky. MER-C 09:36, 29 August 2012 (UTC)
FWIW, I've compiled all the reports in archives into a single page @ User:West.andrew.g/GCKS
Continuing to update, I geolocated all the IP addresses found in the GCKS campaigns. 99% trace back to a single Chinese province. This doesn't seem to be at botnet scope and too much time has passed to determine the open proxy status of the IPs. This seems to further support the "distributed sweatshop" thinking someone put forth earlier. Out of curiosity, what do the experts around here think is the second most prevalent or determined campaign/faction/attempt they've seen? Does it even begin to approach the scale of GCKS? Thanks, West.andrew.g (talk) 17:55, 4 August 2012 (UTC)
The 'internet brands' stuff? Some specialists have managed to circumvent our detection for a long, long time. --Dirk Beetstra T C 04:01, 6 August 2012 (UTC)
The "latestmoviez.com" crap (see below) is getting there as well. MER-C 09:36, 7 August 2012 (UTC)

Promo on user talk page of Millycylan

Template:User summary Hi, I just removed promo on Cloud computing added by Millycylan, but apparently this user left also promo on his talk page. I'm not sure I can remove this too. Can somebody help to get this removed? Thanks, SchreyP (messages) 07:26, 29 August 2012 (UTC)

Done. (You can do this yourself). MER-C 10:38, 29 August 2012 (UTC)
When I notice that, I just replace the user's talk page with
Template:Tl or with a warning (if they spammed elsewhere). Johnuniq (talk
) 10:52, 29 August 2012 (UTC)
Thanks MER-C and Johnuniq, I learned something today :) Next time I do this indeed myself. SchreyP (messages) 20:35, 29 August 2012 (UTC)
Retrieved from "https://en.wikipedia.org/w/index.php?title=Wikipedia_talk:WikiProject_Spam/2012_Archive_Aug_1&oldid=1144626936"