Wikipedia talk:WikiProject Spam - Wikipedia


10 people in discussion

Article Images
    When reporting spam, please use the appropriate template(s):
    As a courtesy, please consider informing other editors if their actions are being discussed.
    {{Link summary|example.com}} -- do not use "subst:" with this template - Do not include the "http://www." portion of the URL inside this template
    • {{IP summary}} - to report anonymous editors suspected of spamming:
    {{IP summary|127.0.0.1}} --- do not use "subst:" with this template
    • {{User summary}} - to report registered users suspected of spamming:
    {{User summary|Username}} -- do not use "subst:" with this template

    Also, please include links ("diffs") to sample spam edits.

    Indicators
    Reports completed:
     Done
    no No action
     Stale
    Defer discussion:
     Defer to XLinkBot
     Defer to Local blacklist
     Defer to Global blacklist
     Defer to Abuse filter
    Information:
     Additional information needed
    information Note:
    Mostly to Weight loss, which is now partial-protected. Given that they're changing the url and accounts/ips, I'm not sure what to do besides protecting the articles. --Ronz (talk) 21:35, 22 January 2012 (UTC)Reply

    Site ips are 64.31.55.250 and 216.245.202.26, see:

    I have revertlisted the two server IPs on XLinkBot, which should revert everything that resides on these two IPs. If after a few warnings it does not stop, blacklist this all, and new stuff as soon as it appears. --Dirk Beetstra T C 17:35, 23 January 2012 (UTC)Reply

    Another related URL, also hosted by server at IP 216.245.202.26:
    This time added to Dieting (edit | talk | history | protect | delete | links | watch | logs | views). Looks to be migrating to new articles as prior ones are semi-protected. --- Barek (talk • contribs) - 23:57, 23 January 2012 (UTC)Reply
    This pattern of spam domains isn't limited to food/dieting.. they've also hit Ageing and Wrinkle --Versageek 00:38, 24 January 2012 (UTC)Reply
    Braveheart28 (talk · contribs) just added this related link to Bodybuilding. Apparition11 Complaints/Mistakes 17:24, 24 January 2012 (UTC)Reply
    Quitaq (talk · contribs) has added the link above to a few weight loss related articles. --bonadea contributions talk 09:20, 25 January 2012 (UTC)Reply

    <- Now they're using URL shrinkers (I visited the site via this link & it's the same low quality cookie-cutter junk we've seen on the other domains):

    This particular user was blocked for his user name (by User:January) & I've requested a meta-blacklist for the URL shrinker. --Versageek 19:57, 25 January 2012 (UTC)Reply

    WAAAY more - What I think is the full set until now:

    Case 7

    Case report by COIBot.

    Links
    Users
    Site IPs

    (Sorry, I don't feel like weeding out the duplicates here in this). Maybe we should consider to be a bit liberal with both blocks and blacklistings here, this is getting annoying (but I am afraid that this is going to be one of those examples where that is also not going to help). --Dirk Beetstra T C 13:24, 25 January 2012 (UTC)Reply

    Updated. --Dirk Beetstra T C 17:51, 25 January 2012 (UTC)Reply


    Sorted a bit of order in this chaos. Only two of the IP addresses seem to be close (within a /24), the others seem completely random. This will be impossible to stop. Turning hard override on on these links in XLinkBot, blacklisting is probably futile, as is blocking the accounts (I will proceed with indeffing the named accounts anyway). --Dirk Beetstra T C 18:01, 25 January 2012 (UTC)Reply

    All URLS, not including site IP's, have been   Added to the Blacklist--Hu12 (talk) 18:03, 25 January 2012 (UTC)Reply
    Range User IP's
    Some of the IP ranges, have no way to see if these range contribs are vandalism only in order to block. Would be nice to also block the server the sites are hosted on.. --Hu12 (talk) 18:34, 25 January 2012 (UTC)Reply
    I've done this for now. This is something that I have not used a lot in XLinkBot, the only thing it will now obey is 3RR and it will not revert established users .. we have one step more (where only whitelisted users will not be reverted, and the bot will also not obey 3RR anymore), but lets see where this brings us. Please keep an eye on XLinkBot reversions of these rules, I hope it will not go wrong.
    I am working on a new off-wiki spam-collecting tool. It is, and needs to be, very manually operated, but I will save the result regularly in m:User:COIBot/case/case7 and (after enabling it further) also in Wikipedia:WikiProject Spam/case/case7. It is experimental, but it proves to be effective here. Diffs between versions will show which new links have been added, all reported here are in the last version).
    Can someone see what is there on all these servers, and preemptively blacklist all that is hosted on this? --Dirk Beetstra T C 18:49, 25 January 2012 (UTC)Reply
    Well, I cant get in to see each one, but it looks massive;
    • 453 domains hosted on IP address 50.22.112.223
    • 5,201 domains hosted on IP address 64.31.55.250
    • 5,446 domains hosted on IP address 216.245.202.26
    --Hu12 (talk) 20:52, 25 January 2012 (UTC)Reply
    The blacklist regex \b\d+\w*facts\.com\b would catch most of those above without any collateral damage. ~Amatulić (talk) 01:02, 26 January 2012 (UTC)Reply

    2itb.com hosting

    I've been noticing sites being added hosted by 2itb.com with identical or near-identical style sheets as some of those being used above. 68.48.177.208 (talk · contribs) has connected some of the dots for us, first linking a site hosted at 2itb.com with the commonly used stylesheet, then linking another url with a different style sheet. --Ronz (talk) 03:04, 26 January 2012 (UTC)Reply

    Makes me wonder if they're using other hosting sites that we've not found yet. --Ronz (talk) 03:38, 26 January 2012 (UTC)Reply

    Well ...

    links
    Servers
    users
    Site IPs

    I've noted the user Gestaltdiscovery in this, which I also saw somewhere around on some of the webpages. --Dirk Beetstra T C 05:39, 26 January 2012 (UTC)Reply

    I've added 2itb.com to the spam blacklist. There are no articles currently using the link as a legitimate ref or EL, while the abuse is quite well documented above. --- Barek (talk • contribs) - 23:42, 28 January 2012 (UTC)Reply

    Commission Breakthrough Spamming

    The thing which is tying all of the above spam domains & spammers together is a "online money making program" sold through commissionbreakthrough.com . According to online reviews of the program, the general concept is 1) set up any number of low content sites using this application, 2) spam Wikipedia, 3) Profit. Apparently there are a number of suckers who have bought into this plan. Let's see if we can abort the program at step 2!. --Versageek 06:19, 26 January 2012 (UTC)Reply

    See also: boldmoney.com/commission-breakthrough-exposed-is-it-a-scam.html --Dirk Beetstra T C 06:18, 26 January 2012 (UTC)Reply

    Yep. Seems to me that we're going to be most effective if we can focus on the website hosts.
    Would it be helpful or feasible to try to figure out what method this software is using to get Wikipedia statistics? --Ronz (talk) 16:54, 26 January 2012 (UTC)Reply
    There are a few YouTube videos that show the interface and the stats they are gathering.. If someone had a lot of time, we might be able to go after the repeat offenders by reporting them to clickbank.net for violating their terms of service (spamming isn't permitted).. but that would mean clicking through to the individual domains to get the clickbank IDs & compiling a report.

    Here are a few more domains, not all have been spammed here yet:

    --Versageek 04:49, 27 January 2012 (UTC)Reply

    Removed easyweightloss.2itb.com, mafiawarsecrets.2itb.com, typhoon42.com as duplicates of links above. Johnuniq (talk) 06:49, 27 January 2012 (UTC)Reply

    Is there any point in reporting the spam here? Here's one I just reverted:

    I noticed that the spammed URL had the extension http___commissionbreakthrough.com_members_wp-content_uploads_2011_11_original_templatev1.html - maybe that's something that can help identify and quickrevert the links via XLinkBot. --bonadea contributions talk 10:09, 27 January 2012 (UTC)Reply

    It always helps to report it here, get a record of everything.
    I already added \b2itb\.com\/http___commissionbreakthrough\.com\b on all the lists, I hope that does help (I'll check the detection now, you may have reverted before XLinkBot could). Unfortunately do not all links follow that pattern. --Dirk Beetstra T C 10:31, 27 January 2012 (UTC)Reply
    Two new ones very close together, but seemingly unrelated. I saw them on XLinkBot (and I had to tweak my regexes further) - I expected '\b2itb\.com(?:commissionbreakthrough)' and '\b2itb\.com(?!commissionbreakthrough)' to do the job as complementary rules. I have again adapted the rules. I am tempted to take the whole 2itb.com domain the hard way, accepting that some innocent additions of 2itb.com do run into a harsh warning, by far most is of the type of spam that we are discussing here. --Dirk Beetstra T C 11:30, 27 January 2012 (UTC)Reply

    I've been collecting some data, please see Wikipedia:WikiProject Spam/CommissionBreakthrough_Spam#Notes. I only did two of the servers, there obviously is more, way more. --Dirk Beetstra T C 15:19, 28 January 2012 (UTC)Reply

    MER-C 07:04, 29 January 2012 (UTC)Reply
    --bonadea contributions talk 10:19, 29 January 2012 (UTC)Reply
    --bonadea contributions talk 10:52, 29 January 2012 (UTC)Reply

    XLinkBot & '1 strike and you are out'

    Regarding this case I have been upgrading LiWa3 and XLinkBot. The majority has been in tweaking the 'resolve IP' rules on LiWa3/XLinkBot, a feature that has not been used in a long long time. It now operates good (see e.g. the source of User_talk:68.190.12.40, it mentions the link and the rule, something that did not work optimally yet). I also started recently to parse parsed revids of pages in stead of wikitext. That means that {{youtube}} and any other template now gets detected as the addition of an external link. It is heavy on the machine, but it works.

    One new feature I have now added to XLinkBot is a kind of a '1 strike and you are out' option. Regexes on a special page read by XLinkBot will have their warning-level set to a preset level (if no higher level exists). In other words, the first warning given to an editor for the addition of a certain link will be that level, not a 'spam0'-level, even if there are no earlier warnings to that editor. The links are in User:XLinkBot/LevelOverrule. Note, setting the initial level to 6 or higher will skip any warnings to that editor and immediate reporting to AIV. Note: not tested yet, waiting for the first spammer to help me with this.

    Some of the techniques I am using here (mainly aimed at the non-regular spam-fighting admins who encounter this rubbish), please apply them liberally to this as soon as it comes up. Blacklisting is here not enough, as new sites ánd hosting servers come up regularly.

    • I am determining the server where the domain is hosted on, and adding the rule 'resolve <ip of the server>' to User:XLinkBot/RevertList. That will from then on revert any domain that is hosted on that site (m:User:LiWa3 does have a slight lag for loading the rules, it does not update its revertlist before every edit, it may take about 5 minutes). Use that in stead of reverting the domain itself, the domain will change, the hosting server generally not (it saves you from figuring out what the next domain that is spammed is, and what the next IP of the user is). Do take care that some servers do contain a lot of good stuff as well, then it may give false positives. If unsure, poke someone on IRC in e.g. #wikipedia-spam-t to check with COIBot, or User:COIBot/Poke the IP of the server and wait for COIBot to save a linkreport for the IP - that will show you which sites have been added that reside on the server. If it is not possible to use 'resolve <ip>', you'll have to revertlist all the sites that you can find. Do not add both the sites ánd the 'resolve <ip>' rule, as that may conflict in determination of what XLinkBot has to do with reverting. Note that it is often worth to first add the rules to XLinkBot, and then start cleaning - by the time you warn the first IP, they are already somewhere else and may not see the warning (as if they care anyway).
    • This is plain spam. These editors do not listen to reverts, warnings or even blocks. They will re-add and re-add. It earns them money to have the links on Wikipedia. Therefore, besides adding the rule to User:XLinkBot/RevertList, also add it to User:XLinkBot/OverrideList. That overrides basic settings in XLinkBot - it will revert everything as long as it is obeying 3RR and as long as the editor is not an established editor. It will re-revert, it will revert references, it will revert undo-actions, etc.). It will keep mainspace cleaner for you. Please don't do this with sites which also contain occasional good links, enabling this feature does not WP:AGF anymore.
    • The new feature - '1 strike and you are out'. Consider adding the rule to User:XLinkBot/LevelOverrule - up 'numoverrules', and add 2 lines: 'overrule#rule' (containing the revert-rule from the revertlist) and 'overrule#level' (level 1-6, XLinkBot's levels are wiki-levels+1 - e.g. level 1 is the friendly message, uw-spam4 is level 5, ). That will make XLinkBot start warning at the level specified in that setting when it warns an editor for adding that rule. Level 5 will hence give a new user a welcome template, and a uw-spam4 warning. If that editor reverts XLinkBot, or adds a link somewhere else, XLinkBot's next step is AIV. In principle, the levels could be set to '6' (or higher), XLinkBot would then go immediately to AIV without even bothering to warn the editor. Also here, this is not WP:AGF anymore.
    • Do blacklist stuff anyway, I know they will change server, but at least this one is gone.

    Happy reverting. --Dirk Beetstra T C 08:35, 26 January 2012 (UTC)Reply

    Relentless. Found these two IP's inserting their links despite them being blacklisted..[1][2].."rolls eyes".--Hu12 (talk) 15:43, 18 February 2012 (UTC)Reply
    That certainly is not going to earn them a lot of money - I hope you blocked them for a bit. Nothing much that we can do about that, though there is an inactive filter that is capable of blocking non-linking urls based on regexes, maybe that is an option.
    It is relentless, it does not seem to stop anywhere soon, I noted that the advertising of this great piece of software are still actively going on, and editors get reverted on a very regular basis because of this rubbish. --Dirk Beetstra T C 18:26, 18 February 2012 (UTC)Reply

    Adsense google_ad_client = pub-6687095943431616 (Track - Report - reverseinternet.com • meta: Track - Report)

    Spammers

    MER-C 07:41, 28 January 2012 (UTC)Reply

    Continued
    Razagm1234 (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · Spamcheck · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
    39.52.60.169 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • Spamcheck • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
    BL'd--Hu12 (talk) 05:57, 5 February 2012 (UTC)Reply
    link
    accounts

    Multiple SPA users blindly adding the link into college/university articles - frequently adding it multiple times into the same article in their spamming of the link. --- Barek (talk • contribs) - 19:45, 1 February 2012 (UTC)Reply

    Continued/More accounts
    --Hu12 (talk) 14:40, 2 February 2012 (UTC)Reply
    Ongoing persistent multi IP spamming, evading blocks..  Added to the BL--Hu12 (talk) 14:56, 2 February 2012 (UTC)Reply

    Marcos.alejandro (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · Spamcheck · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam) User re-created deleted spam article in user sandbox. Not sure how long such an article should be allowed to sit before being deleted. TreacherousWays (talk) 20:09, 1 February 2012 (UTC)Reply

    Please note that the original article was created with a "notable" tag in what I suspect was an effort to avoid a "speedy" delete by generating a deletion discussion. The editor may be more experienced than the edit count suggests. TreacherousWays (talk) 20:15, 1 February 2012 (UTC)Reply

    Sorry, TreacherousWays, it was not my intention to insult you or avoid a "speedy delete". I'm a first time Wikipedia user, not really sure what I am doing. I'm trying to figure it out; I thought that creating a draft in the user sandbox before submitting it for review by the Wiki community was the was to do it. Can you help me out? Marcos.alejandro (talk) 21:15, 1 February 2012 (UTC)Reply

    I am not insulted. I will take a moment to answer your question, and I will make every effort to be sincere. The article reads like advertising copy or something that would be printed in a trade journal for a fee. It sounds as if you have strong ties to the firm, and will be unable to write a neutral article on it. Since you are a new editor and inexperienced with wikipedia formatting, markup, and copyright violations (such as with the Blackcherry logo you uploaded) I suggest that you start by making minor edits to general articles in your area of interest and gaining more experience than you already have. TreacherousWays (talk) 21:38, 1 February 2012 (UTC)Reply
    Info Multiple SPAM recreations
    commons:Special:Contributions/Marcos.alejandro
    Clearly Using Wikipedia for advertising purposes. The sand box should be deleted also per WP:NOTADVERTISING, WP:NOTWEBHOST, WP:ARTSPAM, WP:FAKEARTICLE, WP:COI and WP:SPAM --Hu12 (talk) 14:11, 2 February 2012 (UTC)Reply

    Adsense google_ad_client = pub-8523705932903605 (Track - Report - reverseinternet.com • meta: Track - Report)

    Clear violations of WP:NOT, WP:COI, WP:SPAM and WP:CIVIL [3].--Hu12 (talk) 20:11, 1 February 2012 (UTC)Reply

    90.170.97.10 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • Spamcheck • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot) ibrujula.net: Linksearch en (insource) - meta - de - fr - simple - wikt:en - wikt:fr • Spamcheck • MER-C X-wiki • gs • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced - RSN • COIBot-Link, Local, & XWiki Reports - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.com

    Interestingly at MediaWiki talk:Abusefilter-warning-AFC. Regards, mabdul 12:03, 2 February 2012 (UTC)Reply

    Adsense google_ad_client = pub-9516002939708878 (Track - Report - reverseinternet.com • meta
    Track - Report)
    Accounts

    --Hu12 (talk) 13:45, 2 February 2012 (UTC)Reply

    Another
    --Hu12 (talk) 05:52, 5 February 2012 (UTC)Reply
    Still spamming vibergratis.com,   Added that one to the BL...--Hu12 (talk) 12:35, 10 February 2012 (UTC)Reply

    --Hu12 (talk) 13:21, 2 February 2012 (UTC)Reply

    continued, Block evasion;
    Range blocking 2 weeks 117.205.144.0/20 (talk • contribs • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot), omitted 117.240.243.2 to reduce collateral blocks.Indeff user account. --Hu12 (talk) 16:42, 3 February 2012 (UTC)Reply
    Block evasion, continued promotion under 117.240.243.2, blocking.--Hu12 (talk) 12:58, 10 February 2012 (UTC)Reply

    For the ongoing Commission Breakthrough spam case above, we needed ways to quickly identify ClickBank IDs of the spammers. The bots are now gradually adapted to be able to handle that, and therefore I we have worked on two new templates, working in the same line as the well known {{LinkSummary}}, {{UserSummary}} and {{IPSummary}}:

    The templates create a redlinks to a non-existing ID report (which I may start making some day, but that is not planned), but more importantly, they have 'track' button. That track button shows which locations link to that non-existing ID report, so that the report can be found. If multiple domains have been spammed with the same AdSense, and COIBot has created reports for all of them (and has detected the AdSense ID), then all those reports will be found using the track-link.

    LiWa3 detects the additions, and tells COIBot to save LinkReports for links which have a ClickBank or Adsense ID. COIBot does now save the reports with detection of those IDs as well. Further parts of the bots that need to be adapted are still waiting, but they have less priority than this.

    We have not tested it, but XLinkBot can revert on the basis of ClickBank ID or AdSense ID. The line in the revertlist is respectively:

    clickbank <id> adsense <id>

    (where '<id>' is to be replaced with the id of the link). Please use it with care while testing (we need real spammers to test, so please add rules), remove the rule when the bot is not handling it correctly, and poke me when the bot apparently does not see the additions, I will then try to go through the logs and see where it fails.

    Based on these principles, other similar systems could also be detected when that is deemed interesting (it is heavy on the machines to do so .. but we do have the outside pages loaded anyway). Other suggestions, and additions and upgrades to the tracking templates are welcome. --Dirk Beetstra T C 13:48, 2 February 2012 (UTC)Reply

    There is also {{GoogleAnalyticsSummary}} - Google Analytics ID: UA-123456 - (Track - Report - reverseinternet.com • Meta: Track - Report) to be used without the leading UA-. Be aware that Google Analytics is not always a unique publisher ID. MER-C 00:20, 3 February 2012 (UTC)Reply
    Very nice.--Hu12 (talk) 02:52, 3 February 2012 (UTC)Reply
    Would that one be found with 'm/google_ad_client[=\s]*\"ua-(.*?)\"/si' ?? It would be easy to add that one, would it be useful to have the bot report that? (I am not a specialist in these identifiers and how they are used, &c.)
    I had to stop COIBot saving AdSense reports .. it could not keep up at all, there are too many sites using that. For AdSense, you'll have to follow the irc-feeds. Sorry 'bout that. --Dirk Beetstra T C 20:41, 3 February 2012 (UTC)Reply
    No. See e.g. http://www.atimes.com/atimes/South_Asia/NA12Df01.html (UA-3625887). It's a less useful version of AdSense. Theoretically, it's supposed to be publisher specific, but I've seen entire webhosts and websites with the same SEO tagged with the same GA number. MER-C 04:53, 4 February 2012 (UTC)Reply
    • No "real" website, instead they are using Wikipedia as their "official Website page" see Basic Information in this section-> website.
    Accounts

    --Hu12 (talk) 15:40, 2 February 2012 (UTC)Reply

    BL'd--Hu12 (talk) 23:58, 3 February 2012 (UTC)Reply

    Jude Calvert-Toulmin (edit | talk | history | protect | delete | links | watch | logs | views)

    Wikipedia:Articles_for_deletion/Jude_Calvert-Toulmin

    --Hu12 (talk) 01:05, 4 February 2012 (UTC)Reply

    Is healthaffairs.org considered an RS - especially in light of how many of the 264+ links are to its blog? I am blocking the user above because their name matches a similar website but in looking at all the external links I am not sure if we have a massive case of refspam, or a valid publication with valid references.  7  01:31, 4 February 2012 (UTC)Reply

    link
    accounts

    A handful of accounts whose primary edits have been to add the url into multiple articles. --- Barek (talk • contribs) - 09:12, 4 February 2012 (UTC)Reply

    Google Analytics ID: UA-28509934 - (Track - Report - reverseinternet.com • Meta: Track - Report)

    Spammers

    MER-C 06:20, 5 February 2012 (UTC)Reply

    Continued:
      Defer to Local blacklist MER-C 06:40, 16 February 2012 (UTC)Reply

    Google Analytics ID: UA-1987560 - (Track - Report - reverseinternet.com • Meta: Track - Report)

    Spam pages
    Sites spammed
    Spammers

      Defer to Local blacklist MER-C 12:47, 5 February 2012 (UTC)Reply

    --Hu12 (talk) 15:23, 5 February 2012 (UTC)Reply

    Continued after blocks
    BL'd--Hu12 (talk) 12:48, 10 February 2012 (UTC)Reply

    Google Analytics ID: UA-4535973 - (Track - Report - reverseinternet.com • Meta: Track - Report)

    Spammers

    --Hu12 (talk) 13:13, 7 February 2012 (UTC)Reply

    torontotenantsassociations.ca: Linksearch en (insource) - meta - de - fr - simple - wikt:en - wikt:fr • Spamcheck • MER-C X-wiki • gs • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced - RSN • COIBot-Link, Local, & XWiki Reports - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.com

    Spammers

    Attack site which has persistently been added to the article on Federation of Metro Tenants Associations, apparently for several years. Most recently spammer has been substituting this link for the organization's own web page. Vale of Glamorgan (talk) 01:45, 8 February 2012 (UTC)Reply

    past case Wikipedia_talk:WikiProject_Spam/2008_Archive_Mar_3#BrainWare_Consulting_.28India.29

    Blacklisting--Hu12 (talk) 02:44, 8 February 2012 (UTC)Reply

    Adsense google_ad_client = pub-4199830769381843 (Track - Report - reverseinternet.com • meta: Track - Report)
    Google Analytics ID: UA-1890273 - (Track - Report - reverseinternet.com • Meta: Track - Report)

    Related domains
    Spammers

    MER-C 13:27, 9 February 2012 (UTC)Reply

    Continued:
      Defer to Local blacklist MER-C 06:32, 16 February 2012 (UTC)Reply

    Adsense google_ad_client = pub-8593514738061150 (Track - Report - reverseinternet.com • meta: Track - Report)

    nudos.org: Linksearch en (insource) - meta - de - fr - simple - wikt:en - wikt:fr • Spamcheck • MER-C X-wiki • gs • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced - RSN • COIBot-Link, Local, & XWiki Reports - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.com
    diccionariomedico.net: Linksearch en (insource) - meta - de - fr - simple - wikt:en - wikt:fr • Spamcheck • MER-C X-wiki • gs • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced - RSN • COIBot-Link, Local, & XWiki Reports - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.com
    Spam Accounts

    --Hu12 (talk) 22:13, 11 February 2012 (UTC)Reply

    Meta BL requested--Hu12 (talk) 23:00, 11 February 2012 (UTC)Reply

    --Hu12 (talk) 05:09, 14 February 2012 (UTC)Reply

    112.196.104.130 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • Spamcheck • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
    125.62.105.141 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • Spamcheck • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
    59.94.243.11 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • Spamcheck • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
    wikibooks.org:Special:Contributions/59.94.243.11

    --Hu12 (talk) 13:31, 14 February 2012 (UTC)Reply

    Tvkcyadav (talk · contribs · deleted contribs · logs · filter log · block user · block log)

    Spam from yesterday. Kobac (talk) 13:55, 14 February 2012 (UTC)Reply

    Details;
    " , i am tvk chaitanya from india, ...i am a part time blogger. " [5] tvk chaitanya [blogger.com/profile/08958284424799428465] [plus.google.com/116471718001277755104/posts]
    Article Spam
    Tvkchaitanya.net (edit | talk | history | protect | delete | links | watch | logs | views)
    Spam Accounts
    Tvkyadav (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · Spamcheck · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
    Tvkcyadav (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · Spamcheck · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
    Multi article, Multi related domain spamming block evasion and sockpuppetry...if thats not enough, he seems to like giving himself barnstars..[6][7]--Hu12 (talk) 14:17, 14 February 2012 (UTC)Reply
    Vandalised report[8]--Hu12 (talk) 05:03, 15 February 2012 (UTC)Reply
    Continued Block evasion and spamming..
    BL'd  Done--Hu12 (talk) 20:55, 16 February 2012 (UTC)Reply

    "Publish articles, videos, reviews and how to guides and share them with the world...Generate revenue from your articles, and begin building a long term passive income stream...Share Info Barrel with your family and friends and generate even more money when they publish content."[infobarrel.com/signup.php]

    InfoBarrel links
    • Have no editorial oversight (see WP:RS) and articles are essentially self-published
    • Offers its authors financial incentives to increase page views
    • Fails Wikipedia's core content policies:

    --Hu12 (talk) 13:59, 14 February 2012 (UTC)Reply

    Some Abuse, COI Author spam..
    "rfcamat" (Raymund Camat is a ...blogger, online marketer, and SEO specialist)
    "noryanna"
    "adancingfool"
    --Hu12 (talk) 16:21, 16 February 2012 (UTC)Reply
    Others
    --Hu12 (talk) 00:38, 20 February 2012 (UTC)Reply

    70.66.17.81 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • Spamcheck • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot) Very likely works for Think Tank (software). Added promotional message to the talk page of the article about the company, and added a link to an unrelated article. In my opinion, should be blocked. --Agent 78787 (Talk) 23:17, 14 February 2012 (UTC)Reply

    mythinktank.net: Linksearch en - meta - de - fr - simple - wikt:en - wikt:fr • MER-C Cross-wiki • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced • COIBot-Local - COIBot-XWiki - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.org • Live link: http://www.mythinktank.net
    Appears the IP has been blocked--Hu12 (talk) 05:09, 15 February 2012 (UTC)Reply

    Adsense google_ad_client = pub-0113917178445006 (Track - Report - reverseinternet.com • meta: Track - Report)

    Related domains
    Spammers

    MER-C 11:28, 16 February 2012 (UTC)Reply

    Adsense google_ad_client = pub-977417802249188 (Track - Report - reverseinternet.com • meta: Track - Report)
    Google Analytics ID: UA-8906098 - (Track - Report - reverseinternet.com • Meta: Track - Report)
    Google Analytics ID: UA-5169663 - (Track - Report - reverseinternet.com • Meta: Track - Report)

    This user "Piero79" has been adding an external (spam) link to Wikipedia, on multiple articles, in a seeming ad hoc fashion, for the last few months. I've just found it. And I've been trying to delete them. But there are too many for me to find and delete. Help ! OldSquiffyBat (talk) 13:12, 16 February 2012 (UTC)Reply

    I've had a query about this user on my talk page. MER-C 13:26, 16 February 2012 (UTC)Reply
    Thankyou for that. I've just asked that same user (Modernist) to help me with this. But I think I'm out of my depth as I dont understand the rules and templates and all that sort of stuff. I'd do better to leave it to more experienced folk like you and Modernist! My apologies. OldSquiffyBat (talk) 13:35, 16 February 2012 (UTC)Reply
    I've now noticed that Piero79's earlier edits - which appeared to be 'proper' edits (ie. not just adding an External Link) - are in fact just the same sort of thing, ie. adding that same external link into the body of articles. It may have been added to as many as 200+ articles. Is there some way to remove this link from all articles without manually doing so? From what I can tell the editor has only used Wikipedia to plug this external link and, presumably, uses it to generate income of some sort. OldSquiffyBat (talk) 10:46, 20 February 2012 (UTC)Reply
    Looks as if the site may just be a clever Non noteable Made for advertising scrapper site. Most everything is an "excerpt from..." or "Previously published..". Piero79 seems to be WP:REFSPAMing mostly John A. Walker content. Other evidence shows that... this recent article added to artdesigncafe.com... is simply more scrapped content when one looks at Googles previously cached search results evidence. On a side note, i find it odd that for advertising inquires for artdesigncafe.com.. need to be "prepaid via PayPa" to a Gmail account[9]. Would seem to fail WP:EL and clearly not a WP:RS.--Hu12 (talk) 13:20, 20 February 2012 (UTC)Reply
    Spammers

    --Hu12 (talk) 16:39, 16 February 2012 (UTC)Reply

    Account

    Website

    I have noticed a lot of links to this website being added into articles for "Urban" music articles, primarily pertaining to music videos for singles. I haven't given it a full investigation due to lack of time, but it looks like the aforementioned IP is the main source for these links. One of the biggest issues is that in looking through their edit history, I've found several cases where they replace a more established source (such as MTV) with their own links. It also seems common that what was previously referenced (such as the director) isn't even mentioned on the "new source." Looking at the talk page for this IP, I see 'warnings' about adding links to "Adwiin" (though at the time, a blogspot link) dating back to 2009. It looks as though the vast majority of edits done on this IP have been to add a link to this website.

    Due to my lack of time to fully invest in this issue, and honestly, due to my lack of full understanding of the "process"... can someone else more experienced and with the time run this issue down? – Mizery Made (talk · contribs) 02:37, 17 February 2012 (UTC)Reply

    --Hu12 (talk) 17:30, 17 February 2012 (UTC)Reply

    links
    accounts

    --Hu12 (talk) 17:45, 18 February 2012 (UTC) Site owner; Mattias Engdahl{sites.google.com/site/thescotspeerage/system/app/pages/recentChanges}{sites.google.com/site/thescotspeerage/system/app/pages/recentChanges}Reply

    Long term spammer continues for sole and primary purpose of promoting links to his own sites in violation of WP:COI, WP:SPAM, WP:NOT, WP:RS and WP:OR. --Hu12 (talk) 21:28, 18 February 2012 (UTC)Reply

    Related remark: geocities has been on the revertlist of XLinkBot for a long time. While there certainly is (was) good information on geocities, a lot of it was added with COI and/or SPAM problems, and the sites often (but not always) suffered from WP:NOT/WP:RS/WP:OR type of problems - they are personal websites, anyone can make a site there, and the rate of something suitable is not that big. Same goes for e.g. webs.com.

    In that respect, I think it is a good plan to revertlist any of that type of sites - it will remind (new) editors early on that external linking is subject to rules on Wikipedia, while allowing them to re-insert the links, and allowing established editors to use it normally. Exceptions can be whitelisted on XLinkBot, persistent editors can be blocked and their links be blacklisted if unsuitable - they have been warned early on. In that light, MER-C has already revertlisted 'sites.google.com' recently - I would suggest that similar free webhosts simply get blanked revertlisted. For admins: the revertlist is the first door at the left. --Dirk Beetstra T C 06:40, 19 February 2012 (UTC)Reply

    Template:UserSummary

    Template:IPSummary

    Template:IPSummary

    These accounts have recently created and edited an article about the forthcoming book, Encyclopedia of Conifers. As of right now, the article reads like an advertisement, even including a foreword from the book.

    The accounts have also added external links to the book's website on several conifer-related Wikipedia articles and uploaded pictures from the book that do not appear to have a free license. Miguel.v (talk) 05:05, 19 February 2012 (UTC)Reply

    Removed some copyvio, I don't think I've got it all. MER-C 06:21, 19 February 2012 (UTC)Reply

    siargaoislands.net

    Template:AdSenseSummary

    Spammers
    • Inline spammer, see [10]
    • Inline spammer, see [11]
    • Inline spammer, see [12]
    • Inline spammer, see [13]

    siargaosurf.com

    Template:GoogleAnalyticsSummary

    Spammers

    Template:Deferblack (all). MER-C 12:22, 19 February 2012 (UTC)Reply

    Referred from AIV - seems like a pretty sizeable refspam campaign to me.  7  09:35, 20 February 2012 (UTC)Reply

    Accounts
    Long term hit and run IP's..BL'd--Hu12 (talk) 19:37, 22 February 2012 (UTC)Reply

    Template:UserSummaryTheroadislong (talk) 21:17, 21 February 2012 (UTC)Reply

    Also:
    MER-C 10:47, 22 February 2012 (UTC)Reply

    Template:IPSummary Not sure this is spam as such as the links are to other Wikipedia pages, but this user seems to be habitually inserting irrelevant/tenuously connected links into a variety of pages (for example, Gap link on Chanel), and a few minutes ago reinstated links on at least one page (Ferrari) after their first edit was reversed. Mabalu (talk) 12:07, 22 February 2012 (UTC)Reply

    Another from 2010
    --Hu12 (talk) 18:28, 22 February 2012 (UTC)Reply