Wikipedia talk:WikiProject Spam/2012 Archive Jan 1

Page contents not supported in other languages.
Source: Wikipedia, the free encyclopedia.

scalibux.com

Caution: NSFW

Spam pages
  • deleted 2 times
Sites spammed
Spammers

 Defer to Global blacklist MER-C 13:13, 19 December 2011 (UTC)

Plain text spamming after blacklisting:
MER-C 03:45, 2 January 2012 (UTC)

ceoneedtoknow.com

links
accounts

Repeated addition of self-published site, including issuing a threat to vandalize if the link is removed.[3] --- Barek (talk • contribs) - 05:24, 3 January 2012 (UTC)

User:Davem1981

Davem1981 (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)

ponygames.biz: Linksearch en (insource) - meta - de - fr - simple - wikt:en - wikt:fr • MER-C X-wiki • gs • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced - RSN • COIBot-Link, Local, & XWiki Reports - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.com

webpacman.com: Linksearch en (insource) - meta - de - fr - simple - wikt:en - wikt:fr • MER-C X-wiki • gs • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced - RSN • COIBot-Link, Local, & XWiki Reports - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.com

tarzangames.net: Linksearch en (insource) - meta - de - fr - simple - wikt:en - wikt:fr • MER-C X-wiki • gs • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced - RSN • COIBot-Link, Local, & XWiki Reports - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.com

All of Davem1981's contributions are irrelevant external links.

talk
) 16:45, 22 December 2011 (UTC)

Adsense pub-1609789099200669
Google Analytics UA-869385
Additional domains:
  • blacklisted globally
Additional spammers:
Reverted and warned. MER-C 08:31, 23 December 2011 (UTC)
Updated. MER-C 01:20, 4 January 2012 (UTC)

entireeducation.com

Spammers

 Defer to Local blacklist MER-C 12:39, 24 December 2011 (UTC)

Updated. MER-C 02:58, 4 January 2012 (UTC)

indiantvserials.orgfree.com

Previous incidents
Sites spammed
Spammers

 Defer to Local blacklist MER-C 10:43, 25 November 2011 (UTC)

Updated. MER-C 11:12, 1 December 2011 (UTC)
Recycled. MER-C 01:25, 4 January 2012 (UTC)

soulinterviews.com

Previous incidents
Spam pages
Sites spammed
Spammers
See also

MER-C 01:48, 4 January 2012 (UTC)

Whatisall.com

whatisall.com: Linksearch en (insource) - meta - de - fr - simple - wikt:en - wikt:fr • MER-C X-wiki • gs • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced - RSN • COIBot-Link, Local, & XWiki Reports - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.com Ad-laden Wikipedia mirror. Added to two articles by User:219.91.185.197 [4][5] and perhaps to other articles by other IPs. Beyond My Ken (talk) 03:56, 31 December 2011 (UTC)

Adsense pub-2938541844964998, Google Analytics UA-25826123
Also:
Accounts
MER-C 05:03, 31 December 2011 (UTC)
Updated. MER-C 02:56, 4 January 2012 (UTC)
additional IP accounts
Added additional IPs whose sole activity is adding techiecop.com to multiple articles, in some cases removing other existing links in the process. --- Barek (talk • contribs) - 05:20, 5 January 2012 (UTC)

Mehul Brahmbhatt 05:20, 5 January 2012 (UTC) The content which was being linked was relevant to topic and up to the point than what was point for deletion? Mehul Brahmbhatt 05:20, 5 January 2012 (UTC) — Preceding unsigned comment added by Web mehul (talk • contribs)

sitka.com

link
accounts

A geodomain site for community networking that is being repeatedly added by drive-by IPs. The link is neither the official city site, nor the site of the visitor/convention bureau, so has been removed per

WP:NOT#REPOSITORY. --- Barek (talk • contribs
) - 17:24, 4 January 2012 (UTC)

CreateOnline Ltd. Spam Campaign

"Prints Place is operated by Printree, which is the online trading name for CreateOnline, which is owned and operated by CreateOnline Limited." printsplace.co.uk/About
SpamLinks
More
Accounts

--Hu12 (talk) 13:50, 6 January 2012 (UTC)

Google Plus, Facebook, Twitter

The above user created the template {{

talk
) 09:24, 9 January 2012 (UTC)

Please note that I've proposed promoting
talk
) 19:14, 9 January 2012 (UTC)
This discussion is redundant, see
Wikipedia:ELN#Google Plus, Facebook, Twitter. We do not consider the contributions of good faith Wikipedians to be spam. MER-C
05:44, 10 January 2012 (UTC)
Wikipedia:Templates_for_discussion/Log/2012_January_9#Template:Google.2B. worth looking at.--Hu12 (talk) 12:09, 10 January 2012 (UTC)

http://en.wikipedia.org/wiki/TMCR_95.3

http://en.wikipedia.org/wiki/TMCR_95.3

It appears that someone has made revisions to the page to claim that I, Gordon Sharpe, had resigned or was sacked. These edits are malicious and need to be removed please. I do not know how to revert the page and feel that an editor should look at this abuse.

The history shows: (cur | prev) 00:07, 27 December 2011‎ 86.161.0.169 (talk)‎ (7,241 bytes) (→Presenters (at July 2010)) (undo) (cur | prev) 18:07, 22 December 2011‎ 86.162.12.102 (talk)‎ (7,243 bytes) (→Presenters (at July 2010)) (undo) (cur | prev) 18:07, 22 December 2011‎ 86.162.12.102 (talk)‎ (7,241 bytes) (→Presenters (at July 2010)) (undo) (cur | prev) 12:25, 7 December 2011‎ 161.12.7.4 (talk)‎ (7,243 bytes) (→Presenters (at July 2010)) (undo)

The revisions alternate between Resigned and Sacked against my name. 

TrustAM (talk) 22:53, 9 January 2012 (UTC)
Gordon, best course of action for you is to make the correct change to the article per
Requests for page protection. thanks for reporting. --Hu12 (talk
) 01:34, 10 January 2012 (UTC)
Question. Would it be acceptable to remove the entry all together? I created it and am shown as the author but since the abuse took place I have made a difficult decision to leave the group, which I will simply put down to constructive dismissal here. Rather than have any future arguments over the content of the Wikipedia entry I feel it better to withdraw my contribution or have all reference to myself removed. Is this viable? I would remove it myself, but have had enough accusations thrown at me to last a lifetime. TrustAM (talk) 21:51, 10 January 2012 (UTC)

Long term Spamming catranslation.org

catranslation.org: Linksearch en (insource) - meta - de - fr - simple - wikt:en - wikt:fr • MER-C X-wiki • gs • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced - RSN • COIBot-Link, Local, & XWiki Reports - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.com

Accounts

SophiaKD (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)

es:Special:Contributions/SophiaKD

108.83.18.223 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)

cs:Special:Contributions/108.83.18.223
es:Contributions/108.83.18.223
fr:Special:Contributions/108.83.18.223
hu:Special:Contributions/108.83.18.223

--Hu12 (talk) 00:38, 11 January 2012 (UTC)

unifrance.org

unifrance.org: Linksearch en - meta - de - fr - simple - wikt:en - wikt:fr • MER-C Cross-wiki • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced • COIBot-Local - COIBot-XWiki - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.org • Live link: http://www.unifrance.org

Unifrance (edit | talk | history | protect | delete | links | watch | logs | views)

Unifrancefilms (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)

fr:Special:Contributions/Unifrancefilms

--Hu12 (talk) 19:48, 11 January 2012 (UTC)

Convicted Artist Magazine

Adsense google_ad_client = pub-6302538575241952

convictedartistmagazine.com: Linksearch en - meta - de - fr - simple - wikt:en - wikt:fr • MER-C Cross-wiki • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced • COIBot-Local - COIBot-XWiki - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.org • Live link: http://www.convictedartistmagazine.com

Accounts

"We are a true social art network...we invite you to visit and enjoy our site."

--Hu12 (talk) 20:37, 11 January 2012 (UTC)

highSCORE | New Music Center and Past Related

Promotes contemporary music and events, Associazione Culturale Biquadro

highscorenewmusic.com: Linksearch en - meta - de - fr - simple - wikt:en - wikt:fr • MER-C Cross-wiki • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced • COIBot-Local - COIBot-XWiki - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.org • Live link: http://www.highscorenewmusic.com

soundscape-pavia.com: Linksearch en - meta - de - fr - simple - wikt:en - wikt:fr • MER-C Cross-wiki • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced • COIBot-Local - COIBot-XWiki - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.org • Live link: http://www.soundscape-pavia.com redirects to highscorefestival.com
highscorefestival.com: Linksearch en - meta - de - fr - simple - wikt:en - wikt:fr • MER-C Cross-wiki • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced • COIBot-Local - COIBot-XWiki - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.org • Live link: http://www.highscorefestival.com
Other Paolo Fosso owned sites

dgform.com: Linksearch en - meta - de - fr - simple - wikt:en - wikt:fr • MER-C Cross-wiki • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced • COIBot-Local - COIBot-XWiki - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.org • Live link: http://www.dgform.com

DGform Multimedia (edit | talk | history | protect | delete | links | watch | logs | views)
Articles_for_creation/2006-06-23#DGform_Multimedia declined
Wikipedia:Articles for deletion/DGform Multimedia deleted
Accounts

--Hu12 (talk) 15:28, 12 January 2012 (UTC)

SwiftMQ

swiftmq.com: Linksearch en - meta - de - fr - simple - wikt:en - wikt:fr • MER-C Cross-wiki • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced • COIBot-Local - COIBot-XWiki - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.org • Live link: http://www.swiftmq.com

Accounts

--Hu12 (talk) 14:22, 13 January 2012 (UTC)

MCi Educational Group

mciedu.in: Linksearch en - meta - de - fr - simple - wikt:en - wikt:fr • MER-C Cross-wiki • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced • COIBot-Local - COIBot-XWiki - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.org • Live link: http://www.mciedu.in

User:MCI bihar

--Hu12 (talk) 15:06, 13 January 2012 (UTC)

sites.google.com spam

sites.google.com: Linksearch en - meta - de - fr - simple - wikt:en - wikt:fr • MER-C Cross-wiki • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced • COIBot-Local - COIBot-XWiki - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.org • Live link: http://www.sites.google.com

Pages
sites.google.com/site/eddixonhome: Linksearch en - meta - de - fr - simple - wikt:en - wikt:fr • MER-C Cross-wiki • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced • COIBot-Local - COIBot-XWiki - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.org • Live link: http://www.sites.google.com/site/eddixonhome
sites.google.com/site/cwzhangres: Linksearch en - meta - de - fr - simple - wikt:en - wikt:fr • MER-C Cross-wiki • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced • COIBot-Local - COIBot-XWiki - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.org • Live link: http://www.sites.google.com/site/cwzhangres
sites.google.com/site/cwzhangres: Linksearch en - meta - de - fr - simple - wikt:en - wikt:fr • MER-C Cross-wiki • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced • COIBot-Local - COIBot-XWiki - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.org • Live link: http://www.sites.google.com/site/cwzhangres
boliviatravelguide.net: Linksearch en - meta - de - fr - simple - wikt:en - wikt:fr • MER-C Cross-wiki • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced • COIBot-Local - COIBot-XWiki - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.org • Live link: http://www.boliviatravelguide.net
sites.google.com/site/bipolardatabase: Linksearch en - meta - de - fr - simple - wikt:en - wikt:fr • MER-C Cross-wiki • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced • COIBot-Local - COIBot-XWiki - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.org • Live link: http://www.sites.google.com/site/bipolardatabase



--Hu12 (talk) 15:53, 13 January 2012 (UTC)

RuleWorks.co.uk Spam

Adsense google_ad_client = pub-6608713301976140 (Track - Report - reverseinternet.com • meta: Track - Report)

ruleworks.co.uk: Linksearch en - meta - de - fr - simple - wikt:en - wikt:fr • MER-C Cross-wiki • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced • COIBot-Local - COIBot-XWiki - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.org • Live link: http://www.ruleworks.co.uk

--Hu12 (talk) 16:37, 13 January 2012 (UTC)

CESI S.p.A. multiple entries

Cribuz (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam) User page is spam page for CESI S.p.A.. User has created spam page CESI S.p.A. several times (I made it to be three) and has removed speedy tag at least once. TreacherousWays (talk) 17:13, 13 January 2012 (UTC)

cesi.it: Linksearch en (insource) - meta - de - fr - simple - wikt:en - wikt:fr • MER-C X-wiki • gs • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced - RSN • COIBot-Link, Local, & XWiki Reports - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.com
Article spam
Accounts
Cribuz (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
Damidani (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
85.20.88.10 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
IP whois checks out to be CESI CENTRO ELETTROTECNICO SPERIMENTALE ITALIANO, using multiple sock accounts clearly exist for the sole or primary purpose of promoting CESI. Pages deleted, accounts blocked.--Hu12 (talk) 17:57, 13 January 2012 (UTC)

myscrapbookinc.com

link
accounts

repeated addition of advert content into multiple articles by multiple SPA accounts. --- Barek (talk • contribs) - 06:41, 15 January 2012 (UTC)

newsintechnologys.com

links
accounts

Users adding highly spammish links or creating advert-only pages. --- Barek (talk • contribs) - 02:12, 17 January 2012 (UTC)

James Phyll related spamsites

Adsense google_ad_client = pub-934637620383421

Other related
Accounts

Persistent spamming multiple ad revenue related sites, BL'd--Hu12 (talk) 13:48, 20 January 2012 (UTC)

goarticles.com

link

I stumbled on this site, and found pretty extensive use both as ELs and as refs. The problem is that it doesn't qualify as either. The site accepts any submissions with no editorial review or oversite; even the author bios are not reviewed, simply accepted as submitted - so there's no possible way to confirm the person who actually wrote it has any expertise or legitimate credentials.

I've been reviewing the use, and can't spot any organized abuse (as yet); but it has been used heavily to link to press-release type content as well as to material that would otherwise fail as being original research.

I would appreciate assistance in reviewing the remaining links for where it's used within articles. --- Barek (talk • contribs) - 18:51, 20 January 2012 (UTC)

This domain is already on the XLinkBot revert list, I'll set it to revert reference additions as well. We should consider blacklisting. MER-C 08:02, 21 January 2012 (UTC)

linkspam template

{{ConnecticutHikingOrgsAndWebSites}}

Wikipedia:Templates_for_discussion#Template:ConnecticutHikingOrgsAndWebSites

--Hu12 (talk) 02:31, 21 January 2012 (UTC)

chruscikies.com

Spammer
Sample spam edits

Che829 (talk) 05:08, 25 January 2012 (UTC)


Patrick McCloskey (Registrant) Spam
  • http://planetpm.webring.com/chrusciki/chrusciki.html
  • http://homepage.mac.com/planetpm/chrusciki/chrusciki.html
  • http://planetpm.webring.com/fireballisland/fireballislandgame.html
  • http://planetpm.webring.com/queenholden/paperdolls.html
  • http://homepage.mac.com/planetpm/whichwitch/information.html
  • http://planetpm.webring.com/greenghost/greenghostgame.html
  • http://homepage.mac.com/planetpm/hauntedhouse/hauntedhousegame.html
  • http://planetpm.webring.com/gamehaunt/index.html
  • http://homepage.mac.com/planetpm/voiceofthemummy/index.html
  • http://planetpm.webring.com/darktower/darktowergame.html
  • http://homepage.mac.com/planetpm/buildthisbike/index.html
ECT....
Accounts

Lonterm additions of related Iframe spamlinks by "planetpm" (http://www.webring.com/profile?y=planetpm;def=y), E-mail ID [email protected] selling his stuff--Hu12 (talk) 20:12, 25 January 2012 (UTC)

guitaradda.com

Persistent addition of spamlink in article text, references and external links of articles

Gibson Guitar Corporation
.

Link
guitaradda.com: Linksearch en (insource) - meta - de - fr - simple - wikt:en - wikt:fr • MER-C X-wiki • gs • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced - RSN • COIBot-Link, Local, & XWiki Reports - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.com
Accounts and IP's
Ashley323 (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
125.63.81.160 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
125.63.81.196 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
Diffs
Started with this inline attempt,
All edits by this (new) user and their satellite IP's.

User and IPs notified on talk pages.

Can guitaradda.com be blacklisted? Otherwise this might not stop. TIA - DVdm (talk) 14:56, 25 January 2012 (UTC)

printingfairy.com

--Hu12 (talk) 20:51, 24 January 2012 (UTC)

continued
Bl'd--Hu12 (talk) 17:41, 28 January 2012 (UTC)

playbillvault.com

link
related AfD
accounts
related discussion thread at
WP:EL/N

Seeming

WP:SPA adding link in possible promotion of newly created website. The parent site is clearly notable, but this one has not established notability of its own as yet. --- Barek (talk • contribs
) - 18:56, 26 January 2012 (UTC)

Food-related websites


Mostly to
talk
) 21:35, 22 January 2012 (UTC)

Site ips are 64.31.55.250 and 216.245.202.26, see:

I have revertlisted the two server IPs on XLinkBot, which should revert everything that resides on these two IPs. If after a few warnings it does not stop, blacklist this all, and new stuff as soon as it appears. --Dirk Beetstra T C 17:35, 23 January 2012 (UTC)

Another related URL, also hosted by server at IP 216.245.202.26:
This time added to Dieting (edit | talk | history | protect | delete | links | watch | logs | views). Looks to be migrating to new articles as prior ones are semi-protected. --- Barek (talk • contribs) - 23:57, 23 January 2012 (UTC)
This pattern of spam domains isn't limited to food/dieting.. they've also hit Ageing and Wrinkle --Versageek 00:38, 24 January 2012 (UTC)
Braveheart28 (talk · contribs) just added this related link to Bodybuilding. Apparition11 Complaints/Mistakes 17:24, 24 January 2012 (UTC)
Quitaq (talk · contribs) has added the link above to a few weight loss related articles. --bonadea contributions talk 09:20, 25 January 2012 (UTC)

<- Now they're using URL shrinkers (I visited the site via this link & it's the same low quality cookie-cutter junk we've seen on the other domains):

This particular user was blocked for his user name (by User:January) & I've requested a meta-blacklist for the URL shrinker. --Versageek 19:57, 25 January 2012 (UTC)

WAAAY more - What I think is the full set until now:

Case 7

Case report by COIBot.

Links
Users
Site IPs

(Sorry, I don't feel like weeding out the duplicates here in this). Maybe we should consider to be a bit liberal with both blocks and blacklistings here, this is getting annoying (but I am afraid that this is going to be one of those examples where that is also not going to help). --Dirk Beetstra T C 13:24, 25 January 2012 (UTC)

Updated. --Dirk Beetstra T C 17:51, 25 January 2012 (UTC)


Sorted a bit of order in this chaos. Only two of the IP addresses seem to be close (within a /24), the others seem completely random. This will be impossible to stop. Turning hard override on on these links in XLinkBot, blacklisting is probably futile, as is blocking the accounts (I will proceed with indeffing the named accounts anyway). --Dirk Beetstra T C 18:01, 25 January 2012 (UTC)

All URLS, not including site IP's, have been plus Added to the Blacklist--Hu12 (talk) 18:03, 25 January 2012 (UTC)
Range User IP's
Some of the IP ranges, have no way to see if these range contribs are vandalism only in order to block. Would be nice to also block the server the sites are hosted on.. --Hu12 (talk) 18:34, 25 January 2012 (UTC)
I've done this for now. This is something that I have not used a lot in XLinkBot, the only thing it will now obey is 3RR and it will not revert established users .. we have one step more (where only whitelisted users will not be reverted, and the bot will also not obey 3RR anymore), but lets see where this brings us. Please keep an eye on XLinkBot reversions of these rules, I hope it will not go wrong.
I am working on a new off-wiki spam-collecting tool. It is, and needs to be, very manually operated, but I will save the result regularly in m:User:COIBot/case/case7 and (after enabling it further) also in Wikipedia:WikiProject Spam/case/case7. It is experimental, but it proves to be effective here. Diffs between versions will show which new links have been added, all reported here are in the last version).
Can someone see what is there on all these servers, and preemptively blacklist all that is hosted on this? --Dirk Beetstra T C 18:49, 25 January 2012 (UTC)
Well, I cant get in to see each one, but it looks massive;
  • 453 domains hosted on IP address 50.22.112.223
  • 5,201 domains hosted on IP address 64.31.55.250
  • 5,446 domains hosted on IP address 216.245.202.26
--Hu12 (talk) 20:52, 25 January 2012 (UTC)
The blacklist regex \b\d+\w*facts\.com\b would catch most of those above without any collateral damage. ~
talk
) 01:02, 26 January 2012 (UTC)

2itb.com hosting

I've been noticing sites being added hosted by 2itb.com with identical or near-identical style sheets as some of those being used above.

talk
) 03:04, 26 January 2012 (UTC)

Makes me wonder if they're using other hosting sites that we've not found yet. --

talk
) 03:38, 26 January 2012 (UTC)

Well ...

links
Servers
users
Site IPs

I've noted the user Gestaltdiscovery in this, which I also saw somewhere around on some of the webpages. --Dirk Beetstra T C 05:39, 26 January 2012 (UTC)

I've added 2itb.com to the spam blacklist. There are no articles currently using the link as a legitimate ref or EL, while the abuse is quite well documented above. --- Barek (talk • contribs) - 23:42, 28 January 2012 (UTC)

Commission Breakthrough Spamming

The thing which is tying all of the above spam domains & spammers together is a "online money making program" sold through commissionbreakthrough.com . According to online reviews of the program, the general concept is 1) set up any number of low content sites using this application, 2) spam Wikipedia, 3) Profit. Apparently there are a number of suckers who have bought into this plan. Let's see if we can abort the program at step 2!. --Versageek 06:19, 26 January 2012 (UTC)

See also: boldmoney.com/commission-breakthrough-exposed-is-it-a-scam.html --Dirk Beetstra T C 06:18, 26 January 2012 (UTC)

Yep. Seems to me that we're going to be most effective if we can focus on the website hosts.
Would it be helpful or feasible to try to figure out what method this software is using to get Wikipedia statistics? --
talk
) 16:54, 26 January 2012 (UTC)
There are a few YouTube videos that show the interface and the stats they are gathering.. If someone had a lot of time, we might be able to go after the repeat offenders by reporting them to clickbank.net for violating their terms of service (spamming isn't permitted).. but that would mean clicking through to the individual domains to get the clickbank IDs & compiling a report.

Here are a few more domains, not all have been spammed here yet:

--Versageek 04:49, 27 January 2012 (UTC)

Removed easyweightloss.2itb.com, mafiawarsecrets.2itb.com, typhoon42.com as duplicates of links above. Johnuniq (talk) 06:49, 27 January 2012 (UTC)

Is there any point in reporting the spam here? Here's one I just reverted:

I noticed that the spammed URL had the extension http___commissionbreakthrough.com_members_wp-content_uploads_2011_11_original_templatev1.html - maybe that's something that can help identify and quickrevert the links via XLinkBot. --bonadea contributions talk 10:09, 27 January 2012 (UTC)

It always helps to report it here, get a record of everything.
I already added \b2itb\.com\/http___commissionbreakthrough\.com\b on all the lists, I hope that does help (I'll check the detection now, you may have reverted before XLinkBot could). Unfortunately do not all links follow that pattern. --Dirk Beetstra T C 10:31, 27 January 2012 (UTC)
Two new ones very close together, but seemingly unrelated. I saw them on XLinkBot (and I had to tweak my regexes further) - I expected '\b2itb\.com(?:commissionbreakthrough)' and '\b2itb\.com(?!commissionbreakthrough)' to do the job as complementary rules. I have again adapted the rules. I am tempted to take the whole 2itb.com domain the hard way, accepting that some innocent additions of 2itb.com do run into a harsh warning, by far most is of the type of spam that we are discussing here. --Dirk Beetstra T C 11:30, 27 January 2012 (UTC)

I've been collecting some data, please see Wikipedia:WikiProject Spam/CommissionBreakthrough_Spam#Notes. I only did two of the servers, there obviously is more, way more. --Dirk Beetstra T C 15:19, 28 January 2012 (UTC)

MER-C 07:04, 29 January 2012 (UTC)
--bonadea contributions talk 10:19, 29 January 2012 (UTC)
--bonadea contributions talk 10:52, 29 January 2012 (UTC)

XLinkBot & '1 strike and you are out'

Regarding this case I have been upgrading LiWa3 and XLinkBot. The majority has been in tweaking the 'resolve IP' rules on LiWa3/XLinkBot, a feature that has not been used in a long long time. It now operates good (see e.g. the source of

youtube
}} and any other template now gets detected as the addition of an external link. It is heavy on the machine, but it works.

One new feature I have now added to XLinkBot is a kind of a '1 strike and you are out' option. Regexes on a special page read by XLinkBot will have their warning-level set to a preset level (if no higher level exists). In other words, the first warning given to an editor for the addition of a certain link will be that level, not a 'spam0'-level, even if there are no earlier warnings to that editor. The links are in User:XLinkBot/LevelOverrule. Note, setting the initial level to 6 or higher will skip any warnings to that editor and immediate reporting to AIV. Note: not tested yet, waiting for the first spammer to help me with this.

Some of the techniques I am using here (mainly aimed at the non-regular spam-fighting admins who encounter this rubbish), please apply them liberally to this as soon as it comes up. Blacklisting is here not enough, as new sites ánd hosting servers come up regularly.

  • I am determining the server where the domain is hosted on, and adding the rule 'resolve <ip of the server>' to User:XLinkBot/RevertList. That will from then on revert any domain that is hosted on that site (m:User:LiWa3 does have a slight lag for loading the rules, it does not update its revertlist before every edit, it may take about 5 minutes). Use that in stead of reverting the domain itself, the domain will change, the hosting server generally not (it saves you from figuring out what the next domain that is spammed is, and what the next IP of the user is). Do take care that some servers do contain a lot of good stuff as well, then it may give false positives. If unsure, poke someone on IRC in e.g. #wikipedia-spam-t to check with COIBot, or User:COIBot/Poke the IP of the server and wait for COIBot to save a linkreport for the IP - that will show you which sites have been added that reside on the server. If it is not possible to use 'resolve <ip>', you'll have to revertlist all the sites that you can find. Do not add both the sites ánd the 'resolve <ip>' rule, as that may conflict in determination of what XLinkBot has to do with reverting. Note that it is often worth to first add the rules to XLinkBot, and then start cleaning - by the time you warn the first IP, they are already somewhere else and may not see the warning (as if they care anyway).
  • This is plain spam. These editors do not listen to reverts, warnings or even blocks. They will re-add and re-add. It earns them money to have the links on Wikipedia. Therefore, besides adding the rule to
    WP:AGF
    anymore.
  • The new feature - '1 strike and you are out'. Consider adding the rule to
    WP:AGF
    anymore.
  • Do blacklist stuff anyway, I know they will change server, but at least this one is gone.

Happy reverting. --Dirk Beetstra T C 08:35, 26 January 2012 (UTC)

Relentless. Found these two IP's inserting their links despite them being blacklisted..[6][7].."rolls eyes".--Hu12 (talk) 15:43, 18 February 2012 (UTC)
That certainly is not going to earn them a lot of money - I hope you blocked them for a bit. Nothing much that we can do about that, though there is an inactive filter that is capable of blocking non-linking urls based on regexes, maybe that is an option.
It is relentless, it does not seem to stop anywhere soon, I noted that the advertising of this great piece of software are still actively going on, and editors get reverted on a very regular basis because of this rubbish. --Dirk Beetstra T C 18:26, 18 February 2012 (UTC)
Retrieved from "https://en.wikipedia.org/w/index.php?title=Wikipedia_talk:WikiProject_Spam/2012_Archive_Jan_1&oldid=1051270667"