Wikipedia talk:WikiProject Spam - Wikipedia


1 person in discussion

Article Images
    When reporting spam, please use the appropriate template(s):
    As a courtesy, please consider informing other editors if their actions are being discussed.
    {{Link summary|example.com}} -- do not use "subst:" with this template - Do not include the "http://www." portion of the URL inside this template
    • {{IP summary}} - to report anonymous editors suspected of spamming:
    {{IP summary|127.0.0.1}} --- do not use "subst:" with this template
    • {{User summary}} - to report registered users suspected of spamming:
    {{User summary|Username}} -- do not use "subst:" with this template

    Also, please include links ("diffs") to sample spam edits.

    Indicators
    Reports completed:
     Done
    no No action
     Stale
    Defer discussion:
     Defer to XLinkBot
     Defer to Local blacklist
     Defer to Global blacklist
     Defer to Abuse filter
    Information:
     Additional information needed
    information Note:
    "Prints Place is operated by Printree, which is the online trading name for CreateOnline, which is owned and operated by CreateOnline Limited." printsplace.co.uk/About
    SpamLinks
    More
    Accounts

    --Hu12 (talk) 13:50, 6 January 2012 (UTC)Reply

    The above user created the template {{Google+}} and spammed it into multiple articles today. He also appears to be adding Facebook, Twitter and other social networking site links to multiple articles as well, against the spirit of WP:EL, especially Wikipedia:External links/Perennial websites Yworo (talk) 09:24, 9 January 2012 (UTC)Reply

    Please note that I've proposed promoting Wikipedia:External links/Perennial websites to a guideline. The discussion can be found here. Yworo (talk) 19:14, 9 January 2012 (UTC)Reply
    This discussion is redundant, see Wikipedia:ELN#Google Plus, Facebook, Twitter. We do not consider the contributions of good faith Wikipedians to be spam. MER-C 05:44, 10 January 2012 (UTC)Reply
    Wikipedia:Templates_for_discussion/Log/2012_January_9#Template:Google.2B. worth looking at.--Hu12 (talk) 12:09, 10 January 2012 (UTC)Reply

    http://en.wikipedia.org/wiki/TMCR_95.3

    It appears that someone has made revisions to the page to claim that I, Gordon Sharpe, had resigned or was sacked. These edits are malicious and need to be removed please. I do not know how to revert the page and feel that an editor should look at this abuse.

    The history shows: (cur | prev) 00:07, 27 December 2011‎ 86.161.0.169 (talk)‎ (7,241 bytes) (→Presenters (at July 2010)) (undo) (cur | prev) 18:07, 22 December 2011‎ 86.162.12.102 (talk)‎ (7,243 bytes) (→Presenters (at July 2010)) (undo) (cur | prev) 18:07, 22 December 2011‎ 86.162.12.102 (talk)‎ (7,241 bytes) (→Presenters (at July 2010)) (undo) (cur | prev) 12:25, 7 December 2011‎ 161.12.7.4 (talk)‎ (7,243 bytes) (→Presenters (at July 2010)) (undo)

    The revisions alternate between Resigned and Sacked against my name. 

    TrustAM (talk) 22:53, 9 January 2012 (UTC)Reply
    Gordon, best course of action for you is to make the correct change to the article per Wikipedia:COI#Non-controversial_edits. be sure to document the change on the articles talk page. see also Wikipedia:COI#Declaring_an_interest. if it continues excessively, may want to make a report over at Requests for page protection. thanks for reporting. --Hu12 (talk) 01:34, 10 January 2012 (UTC)Reply
    Question. Would it be acceptable to remove the entry all together? I created it and am shown as the author but since the abuse took place I have made a difficult decision to leave the group, which I will simply put down to constructive dismissal here. Rather than have any future arguments over the content of the Wikipedia entry I feel it better to withdraw my contribution or have all reference to myself removed. Is this viable? I would remove it myself, but have had enough accusations thrown at me to last a lifetime. TrustAM (talk) 21:51, 10 January 2012 (UTC)Reply

    catranslation.org: Linksearch en (insource) - meta - de - fr - simple - wikt:en - wikt:fr • Spamcheck • MER-C X-wiki • gs • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced - RSN • COIBot-Link, Local, & XWiki Reports - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.com

    Accounts

    SophiaKD (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · Spamcheck · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)

    es:Special:Contributions/SophiaKD

    108.83.18.223 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • Spamcheck • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)

    cs:Special:Contributions/108.83.18.223
    es:Contributions/108.83.18.223
    fr:Special:Contributions/108.83.18.223
    hu:Special:Contributions/108.83.18.223

    --Hu12 (talk) 00:38, 11 January 2012 (UTC)Reply

    unifrance.org: Linksearch en - meta - de - fr - simple - wikt:en - wikt:fr • MER-C Cross-wiki • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced • COIBot-Local - COIBot-XWiki - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.org • Live link: http://www.unifrance.org

    Unifrance (edit | talk | history | protect | delete | links | watch | logs | views)

    Unifrancefilms (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · Spamcheck · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)

    fr:Special:Contributions/Unifrancefilms

    --Hu12 (talk) 19:48, 11 January 2012 (UTC)Reply

    Adsense google_ad_client = pub-6302538575241952

    convictedartistmagazine.com: Linksearch en - meta - de - fr - simple - wikt:en - wikt:fr • MER-C Cross-wiki • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced • COIBot-Local - COIBot-XWiki - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.org • Live link: http://www.convictedartistmagazine.com

    Accounts

    "We are a true social art network...we invite you to visit and enjoy our site."

    --Hu12 (talk) 20:37, 11 January 2012 (UTC)Reply

    Promotes contemporary music and events, Associazione Culturale Biquadro

    highscorenewmusic.com: Linksearch en - meta - de - fr - simple - wikt:en - wikt:fr • MER-C Cross-wiki • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced • COIBot-Local - COIBot-XWiki - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.org • Live link: http://www.highscorenewmusic.com

    soundscape-pavia.com: Linksearch en - meta - de - fr - simple - wikt:en - wikt:fr • MER-C Cross-wiki • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced • COIBot-Local - COIBot-XWiki - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.org • Live link: http://www.soundscape-pavia.com redirects to highscorefestival.com
    highscorefestival.com: Linksearch en - meta - de - fr - simple - wikt:en - wikt:fr • MER-C Cross-wiki • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced • COIBot-Local - COIBot-XWiki - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.org • Live link: http://www.highscorefestival.com
    Other Paolo Fosso owned sites

    dgform.com: Linksearch en - meta - de - fr - simple - wikt:en - wikt:fr • MER-C Cross-wiki • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced • COIBot-Local - COIBot-XWiki - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.org • Live link: http://www.dgform.com

    DGform Multimedia (edit | talk | history | protect | delete | links | watch | logs | views)
    Articles_for_creation/2006-06-23#DGform_Multimedia declined
    Wikipedia:Articles for deletion/DGform Multimedia deleted
    Accounts

    --Hu12 (talk) 15:28, 12 January 2012 (UTC)Reply

    swiftmq.com: Linksearch en - meta - de - fr - simple - wikt:en - wikt:fr • MER-C Cross-wiki • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced • COIBot-Local - COIBot-XWiki - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.org • Live link: http://www.swiftmq.com

    Accounts

    --Hu12 (talk) 14:22, 13 January 2012 (UTC)Reply

    mciedu.in: Linksearch en - meta - de - fr - simple - wikt:en - wikt:fr • MER-C Cross-wiki • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced • COIBot-Local - COIBot-XWiki - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.org • Live link: http://www.mciedu.in

    User:MCI bihar

    --Hu12 (talk) 15:06, 13 January 2012 (UTC)Reply

    sites.google.com: Linksearch en - meta - de - fr - simple - wikt:en - wikt:fr • MER-C Cross-wiki • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced • COIBot-Local - COIBot-XWiki - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.org • Live link: http://www.sites.google.com

    Pages
    sites.google.com/site/eddixonhome: Linksearch en - meta - de - fr - simple - wikt:en - wikt:fr • MER-C Cross-wiki • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced • COIBot-Local - COIBot-XWiki - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.org • Live link: http://www.sites.google.com/site/eddixonhome
    sites.google.com/site/cwzhangres: Linksearch en - meta - de - fr - simple - wikt:en - wikt:fr • MER-C Cross-wiki • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced • COIBot-Local - COIBot-XWiki - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.org • Live link: http://www.sites.google.com/site/cwzhangres
    sites.google.com/site/cwzhangres: Linksearch en - meta - de - fr - simple - wikt:en - wikt:fr • MER-C Cross-wiki • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced • COIBot-Local - COIBot-XWiki - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.org • Live link: http://www.sites.google.com/site/cwzhangres
    boliviatravelguide.net: Linksearch en - meta - de - fr - simple - wikt:en - wikt:fr • MER-C Cross-wiki • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced • COIBot-Local - COIBot-XWiki - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.org • Live link: http://www.boliviatravelguide.net
    sites.google.com/site/bipolardatabase: Linksearch en - meta - de - fr - simple - wikt:en - wikt:fr • MER-C Cross-wiki • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced • COIBot-Local - COIBot-XWiki - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.org • Live link: http://www.sites.google.com/site/bipolardatabase


    --Hu12 (talk) 15:53, 13 January 2012 (UTC)Reply

    Adsense google_ad_client = "pub-6608713301976140

    ruleworks.co.uk: Linksearch en - meta - de - fr - simple - wikt:en - wikt:fr • MER-C Cross-wiki • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced • COIBot-Local - COIBot-XWiki - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.org • Live link: http://www.ruleworks.co.uk

    --Hu12 (talk) 16:37, 13 January 2012 (UTC)Reply

    Cribuz (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · Spamcheck · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam) User page is spam page for CESI S.p.A.. User has created spam page CESI S.p.A. several times (I made it to be three) and has removed speedy tag at least once. TreacherousWays (talk) 17:13, 13 January 2012 (UTC)Reply

    cesi.it: Linksearch en (insource) - meta - de - fr - simple - wikt:en - wikt:fr • Spamcheck • MER-C X-wiki • gs • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced - RSN • COIBot-Link, Local, & XWiki Reports - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.com
    Article spam
    Accounts
    Cribuz (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · Spamcheck · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
    Damidani (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · Spamcheck · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
    85.20.88.10 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • Spamcheck • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
    IP whois checks out to be CESI CENTRO ELETTROTECNICO SPERIMENTALE ITALIANO, using multiple sock accounts clearly exist for the sole or primary purpose of promoting CESI. Pages deleted, accounts blocked.--Hu12 (talk) 17:57, 13 January 2012 (UTC)Reply
    link
    accounts

    repeated addition of advert content into multiple articles by multiple SPA accounts. --- Barek (talk • contribs) - 06:41, 15 January 2012 (UTC)Reply

    links
    accounts

    Users adding highly spammish links or creating advert-only pages. --- Barek (talk • contribs) - 02:12, 17 January 2012 (UTC)Reply

    Adsense google_ad_client = pub-934637620383421

    Other related
    Accounts

    Persistent spamming multiple ad revenue related sites, BL'd--Hu12 (talk) 13:48, 20 January 2012 (UTC)Reply

    link

    I stumbled on this site, and found pretty extensive use both as ELs and as refs. The problem is that it doesn't qualify as either. The site accepts any submissions with no editorial review or oversite; even the author bios are not reviewed, simply accepted as submitted - so there's no possible way to confirm the person who actually wrote it has any expertise or legitimate credentials.

    I've been reviewing the use, and can't spot any organized abuse (as yet); but it has been used heavily to link to press-release type content as well as to material that would otherwise fail as being original research.

    I would appreciate assistance in reviewing the remaining links for where it's used within articles. --- Barek (talk • contribs) - 18:51, 20 January 2012 (UTC)Reply

    This domain is already on the XLinkBot revert list, I'll set it to revert reference additions as well. We should consider blacklisting. MER-C 08:02, 21 January 2012 (UTC)Reply

    {{ConnecticutHikingOrgsAndWebSites}}

    Wikipedia:Templates_for_discussion#Template:ConnecticutHikingOrgsAndWebSites

    --Hu12 (talk) 02:31, 21 January 2012 (UTC)Reply

    Mostly to Weight loss, which is now partial-protected. Given that they're changing the url and accounts/ips, I'm not sure what to do besides protecting the articles. --Ronz (talk) 21:35, 22 January 2012 (UTC)Reply

    Site ips are 64.31.55.250 and 216.245.202.26, see:

    I have revertlisted the two server IPs on XLinkBot, which should revert everything that resides on these two IPs. If after a few warnings it does not stop, blacklist this all, and new stuff as soon as it appears. --Dirk Beetstra T C 17:35, 23 January 2012 (UTC)Reply

    Another related URL, also hosted by server at IP 216.245.202.26:
    This time added to Dieting (edit | talk | history | protect | delete | links | watch | logs | views). Looks to be migrating to new articles as prior ones are semi-protected. --- Barek (talk • contribs) - 23:57, 23 January 2012 (UTC)Reply
    This pattern of spam domains isn't limited to food/dieting.. they've also hit Ageing and Wrinkle --Versageek 00:38, 24 January 2012 (UTC)Reply
    Braveheart28 (talk · contribs) just added this related link to Bodybuilding. Apparition11 Complaints/Mistakes 17:24, 24 January 2012 (UTC)Reply
    Quitaq (talk · contribs) has added the link above to a few weight loss related articles. --bonadea contributions talk 09:20, 25 January 2012 (UTC)Reply

    <- Now they're using URL shrinkers (I visited the site via this link & it's the same low quality cookie-cutter junk we've seen on the other domains):

    This particular user was blocked for his user name (by User:January) & I've requested a meta-blacklist for the URL shrinker. --Versageek 19:57, 25 January 2012 (UTC)Reply

    WAAAY more - What I think is the full set until now:

    Case 7

    Case report by COIBot.

    Links
    Users
    Site IPs

    (Sorry, I don't feel like weeding out the duplicates here in this). Maybe we should consider to be a bit liberal with both blocks and blacklistings here, this is getting annoying (but I am afraid that this is going to be one of those examples where that is also not going to help). --Dirk Beetstra T C 13:24, 25 January 2012 (UTC)Reply

    Updated. --Dirk Beetstra T C 17:51, 25 January 2012 (UTC)Reply


    Sorted a bit of order in this chaos. Only two of the IP addresses seem to be close (within a /24), the others seem completely random. This will be impossible to stop. Turning hard override on on these links in XLinkBot, blacklisting is probably futile, as is blocking the accounts (I will proceed with indeffing the named accounts anyway). --Dirk Beetstra T C 18:01, 25 January 2012 (UTC)Reply

    All URLS, not including site IP's, have been   Added to the Blacklist--Hu12 (talk) 18:03, 25 January 2012 (UTC)Reply
    Range User IP's
    Some of the IP ranges, have no way to see if these range contribs are vandalism only in order to block. Would be nice to also block the server the sites are hosted on.. --Hu12 (talk) 18:34, 25 January 2012 (UTC)Reply
    I've done this for now. This is something that I have not used a lot in XLinkBot, the only thing it will now obey is 3RR and it will not revert established users .. we have one step more (where only whitelisted users will not be reverted, and the bot will also not obey 3RR anymore), but lets see where this brings us. Please keep an eye on XLinkBot reversions of these rules, I hope it will not go wrong.
    I am working on a new off-wiki spam-collecting tool. It is, and needs to be, very manually operated, but I will save the result regularly in m:User:COIBot/case/case7 and (after enabling it further) also in Wikipedia:WikiProject Spam/case/case7. It is experimental, but it proves to be effective here. Diffs between versions will show which new links have been added, all reported here are in the last version).
    Can someone see what is there on all these servers, and preemptively blacklist all that is hosted on this? --Dirk Beetstra T C 18:49, 25 January 2012 (UTC)Reply
    Well, I cant get in to see each one, but it looks massive;
    • 453 domains hosted on IP address 50.22.112.223
    • 5,201 domains hosted on IP address 64.31.55.250
    • 5,446 domains hosted on IP address 216.245.202.26
    --Hu12 (talk) 20:52, 25 January 2012 (UTC)Reply
    The blacklist regex \b\d+\w*facts\.com\b would catch most of those above without any collateral damage. ~Amatulić (talk) 01:02, 26 January 2012 (UTC)Reply

    2itb.com hosting

    I've been noticing sites being added hosted by 2itb.com with identical or near-identical style sheets as some of those being used above. 68.48.177.208 (talk · contribs) has connected some of the dots for us, first linking a site hosted at 2itb.com with the commonly used stylesheet, then linking another url with a different style sheet. --Ronz (talk) 03:04, 26 January 2012 (UTC)Reply

    Makes me wonder if they're using other hosting sites that we've not found yet. --Ronz (talk) 03:38, 26 January 2012 (UTC)Reply

    Well ...

    links
    Servers
    users
    Site IPs

    I've noted the user Gestaltdiscovery in this, which I also saw somewhere around on some of the webpages. --Dirk Beetstra T C 05:39, 26 January 2012 (UTC)Reply

    Commission Breakthrough Spamming

    The thing which is tying all of the above spam domains & spammers together is a "online money making program" sold through commissionbreakthrough.com . According to online reviews of the program, the general concept is 1) set up any number of low content sites using this application, 2) spam Wikipedia, 3) Profit. Apparently there are a number of suckers who have bought into this plan. Let's see if we can abort the program at step 2!. --Versageek 06:19, 26 January 2012 (UTC)Reply

    See also: boldmoney.com/commission-breakthrough-exposed-is-it-a-scam.html --Dirk Beetstra T C 06:18, 26 January 2012 (UTC)Reply

    Yep. Seems to me that we're going to be most effective if we can focus on the website hosts.
    Would it be helpful or feasible to try to figure out what method this software is using to get Wikipedia statistics? --Ronz (talk) 16:54, 26 January 2012 (UTC)Reply
    There are a few YouTube videos that show the interface and the stats they are gathering.. If someone had a lot of time, we might be able to go after the repeat offenders by reporting them to clickbank.net for violating their terms of service (spamming isn't permitted).. but that would mean clicking through to the individual domains to get the clickbank IDs & compiling a report.

    Here are a few more domains, not all have been spammed here yet:

    --Versageek 04:49, 27 January 2012 (UTC)Reply

    Removed easyweightloss.2itb.com, mafiawarsecrets.2itb.com, typhoon42.com as duplicates of links above. Johnuniq (talk) 06:49, 27 January 2012 (UTC)Reply

    Is there any point in reporting the spam here? Here's one I just reverted:

    I noticed that the spammed URL had the extension http___commissionbreakthrough.com_members_wp-content_uploads_2011_11_original_templatev1.html - maybe that's something that can help identify and quickrevert the links via XLinkBot. --bonadea contributions talk 10:09, 27 January 2012 (UTC)Reply

    It always helps to report it here, get a record of everything.
    I already added \b2itb\.com\/http___commissionbreakthrough\.com\b on all the lists, I hope that does help (I'll check the detection now, you may have reverted before XLinkBot could). Unfortunately do not all links follow that pattern. --Dirk Beetstra T C 10:31, 27 January 2012 (UTC)Reply
    Two new ones very close together, but seemingly unrelated. I saw them on XLinkBot (and I had to tweak my regexes further) - I expected '\b2itb\.com(?:commissionbreakthrough)' and '\b2itb\.com(?!commissionbreakthrough)' to do the job as complementary rules. I have again adapted the rules. I am tempted to take the whole 2itb.com domain the hard way, accepting that some innocent additions of 2itb.com do run into a harsh warning, by far most is of the type of spam that we are discussing here. --Dirk Beetstra T C 11:30, 27 January 2012 (UTC)Reply

    I've been collecting some data, please see Wikipedia:WikiProject Spam/CommissionBreakthrough_Spam#Notes. I only did two of the servers, there obviously is more, way more. --Dirk Beetstra T C 15:19, 28 January 2012 (UTC)Reply

    XLinkBot & '1 strike and you are out'

    Regarding this case I have been upgrading LiWa3 and XLinkBot. The majority has been in tweaking the 'resolve IP' rules on LiWa3/XLinkBot, a feature that has not been used in a long long time. It now operates good (see e.g. the source of User_talk:68.190.12.40, it mentions the link and the rule, something that did not work optimally yet). I also started recently to parse parsed revids of pages in stead of wikitext. That means that {{youtube}} and any other template now gets detected as the addition of an external link. It is heavy on the machine, but it works.

    One new feature I have now added to XLinkBot is a kind of a '1 strike and you are out' option. Regexes on a special page read by XLinkBot will have their warning-level set to a preset level (if no higher level exists). In other words, the first warning given to an editor for the addition of a certain link will be that level, not a 'spam0'-level, even if there are no earlier warnings to that editor. The links are in User:XLinkBot/LevelOverrule. Note, setting the initial level to 6 or higher will skip any warnings to that editor and immediate reporting to AIV. Note: not tested yet, waiting for the first spammer to help me with this.

    Some of the techniques I am using here (mainly aimed at the non-regular spam-fighting admins who encounter this rubbish), please apply them liberally to this as soon as it comes up. Blacklisting is here not enough, as new sites ánd hosting servers come up regularly.

    • I am determining the server where the domain is hosted on, and adding the rule 'resolve <ip of the server>' to User:XLinkBot/RevertList. That will from then on revert any domain that is hosted on that site (m:User:LiWa3 does have a slight lag for loading the rules, it does not update its revertlist before every edit, it may take about 5 minutes). Use that in stead of reverting the domain itself, the domain will change, the hosting server generally not (it saves you from figuring out what the next domain that is spammed is, and what the next IP of the user is). Do take care that some servers do contain a lot of good stuff as well, then it may give false positives. If unsure, poke someone on IRC in e.g. #wikipedia-spam-t to check with COIBot, or User:COIBot/Poke the IP of the server and wait for COIBot to save a linkreport for the IP - that will show you which sites have been added that reside on the server. If it is not possible to use 'resolve <ip>', you'll have to revertlist all the sites that you can find. Do not add both the sites ánd the 'resolve <ip>' rule, as that may conflict in determination of what XLinkBot has to do with reverting. Note that it is often worth to first add the rules to XLinkBot, and then start cleaning - by the time you warn the first IP, they are already somewhere else and may not see the warning (as if they care anyway).
    • This is plain spam. These editors do not listen to reverts, warnings or even blocks. They will re-add and re-add. It earns them money to have the links on Wikipedia. Therefore, besides adding the rule to User:XLinkBot/RevertList, also add it to User:XLinkBot/OverrideList. That overrides basic settings in XLinkBot - it will revert everything as long as it is obeying 3RR and as long as the editor is not an established editor. It will re-revert, it will revert references, it will revert undo-actions, etc.). It will keep mainspace cleaner for you. Please don't do this with sites which also contain occasional good links, enabling this feature does not WP:AGF anymore.
    • The new feature - '1 strike and you are out'. Consider adding the rule to User:XLinkBot/LevelOverrule - up 'numoverrules', and add 2 lines: 'overrule#rule' (containing the revert-rule from the revertlist) and 'overrule#level' (level 1-6, XLinkBot's levels are wiki-levels+1 - e.g. level 1 is the friendly message, uw-spam4 is level 5, ). That will make XLinkBot start warning at the level specified in that setting when it warns an editor for adding that rule. Level 5 will hence give a new user a welcome template, and a uw-spam4 warning. If that editor reverts XLinkBot, or adds a link somewhere else, XLinkBot's next step is AIV. In principle, the levels could be set to '6' (or higher), XLinkBot would then go immediately to AIV without even bothering to warn the editor. Also here, this is not WP:AGF anymore.
    • Do blacklist stuff anyway, I know they will change server, but at least this one is gone.

    Happy reverting. --Dirk Beetstra T C 08:35, 26 January 2012 (UTC)Reply

    --Hu12 (talk) 20:51, 24 January 2012 (UTC)Reply

    continued
    Bl'd--Hu12 (talk) 17:41, 28 January 2012 (UTC)Reply
    Spammer
    Sample spam edits

    Che829 (talk) 05:08, 25 January 2012 (UTC)Reply

    Patrick McCloskey (Registrant) Spam
    • http://planetpm.webring.com/chrusciki/chrusciki.html
    • http://homepage.mac.com/planetpm/chrusciki/chrusciki.html
    • http://planetpm.webring.com/fireballisland/fireballislandgame.html
    • http://planetpm.webring.com/queenholden/paperdolls.html
    • http://homepage.mac.com/planetpm/whichwitch/information.html
    • http://planetpm.webring.com/greenghost/greenghostgame.html
    • http://homepage.mac.com/planetpm/hauntedhouse/hauntedhousegame.html
    • http://planetpm.webring.com/gamehaunt/index.html
    • http://homepage.mac.com/planetpm/voiceofthemummy/index.html
    • http://planetpm.webring.com/darktower/darktowergame.html
    • http://homepage.mac.com/planetpm/buildthisbike/index.html
    ECT....
    Accounts

    Lonterm additions of related Iframe spamlinks by "planetpm" (http://www.webring.com/profile?y=planetpm;def=y), E-mail ID Patrickm@alloymail.com selling his stuff--Hu12 (talk) 20:12, 25 January 2012 (UTC)Reply

    Persistent addition of spamlink in article text, references and external links of articles Electric guitar, Acoustic guitar, Bass guitar and Gibson Guitar Corporation.

    Link
    guitaradda.com: Linksearch en (insource) - meta - de - fr - simple - wikt:en - wikt:fr • Spamcheck • MER-C X-wiki • gs • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced - RSN • COIBot-Link, Local, & XWiki Reports - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.com
    Accounts and IP's
    Ashley323 (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · Spamcheck · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
    125.63.81.160 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • Spamcheck • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
    125.63.81.196 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • Spamcheck • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
    Diffs
    Started with this inline attempt,
    All edits by this (new) user and their satellite IP's.

    User and IPs notified on talk pages.

    Can guitaradda.com be blacklisted? Otherwise this might not stop. TIA - DVdm (talk) 14:56, 25 January 2012 (UTC)Reply

    link
    related AfD
    accounts
    related discussion thread at WP:EL/N

    Seeming WP:SPA adding link in possible promotion of newly created website. The parent site is clearly notable, but this one has not established notability of its own as yet. --- Barek (talk • contribs) - 18:56, 26 January 2012 (UTC)Reply

    Adsense pub-6687095943431616

    Spammers

    MER-C 07:41, 28 January 2012 (UTC)Reply