Talk:Spam blacklist/Archives/2009-03

From Meta, a Wikimedia project coordination wiki
Jump to navigation Jump to search
Warning! Please do not post any new comments on this page. This is a discussion archive first created in March 2009, although the comments contained were likely posted before and after this date. See current discussion or the archives index.

Contents

Proposed additions

Symbol comment vote.svg This section is for completed requests that a website be blacklisted

parowozownia.pilska.prv.pl, www.parowozownia.ovh.org

User wrote articles with the text from this cite in several wikis (see interwikis in [1].--Ahonc 13:44, 14 February 2009 (UTC)

Did they spam the domain? If they're just copying text from the site then blacklisting it isn't going to do anything to stop them.  — Mike.lifeguard | @en.wb 00:58, 15 February 2009 (UTC)




Some IPs for the first one:












The second one are completely other users (and no IPs). Is this coincidental, or really related? --Dirk Beetstra T C (en: U, T) 20:48, 15 February 2009 (UTC)

Thermoscan Co., Ltd













See WikiProject Spam item. MER-C 08:55, 19 February 2009 (UTC)

Yes check.svg Done - Andre Engels 10:44, 24 February 2009 (UTC)

baixllobregat.tv

I'm not really sure on the proper formatting for this, but User:Jorunn recommended this at this COIBot report. NuclearWarfare 04:54, 21 February 2009 (UTC)

Added Added. Thanks. --Erwin(85) 09:21, 21 February 2009 (UTC)

www.mandalaseverler.somee.com/en/

Crosswiki spam by



Seen on bi:Mandala, bm:Mandala, bn:Mandala, bo:Mandala, br:Mandala, bs:Mandala, se:Mandala, ch:Mandala, ie:Mandala, pa:Mandala, my:Mandala, as:Mandala, az:Mandala, ba:Mandala, be:Mandala, bh:Mandala. User created an empty page with an image and that link.

Already to the bl Added Added \mandalaseverler\.somee\.com\b


Best regards, --birdy geimfyglið (:> )=| 22:43, 21 February 2009 (UTC)

Apparently involved user:



Uploaded the image at commons + [2], best regards, --birdy geimfyglið (:> )=| 22:48, 21 February 2009 (UTC)

Should have been \bmandalaseverler\.somee\.com\b; Yes check.svg fixed  — Mike.lifeguard | @en.wb 04:39, 26 February 2009 (UTC)

www.filipina4u.net








Known spammed wikis: meta, commons, en:wp

Best regards, --birdy geimfyglið (:> )=| 12:38, 22 February 2009 (UTC)

Added Added. Thanks. Not sure if it'll help against this type of spam though. --Erwin(85) 09:53, 25 February 2009 (UTC)
Added Added \bfilipina4u\.proboards83\.com\b too  — Mike.lifeguard | @en.wb 04:41, 26 February 2009 (UTC)

www.ghumlo.com






Known spammed wikis: meta, commons, en:wp, best regards, --birdy geimfyglið (:> )=| 15:33, 22 February 2009 (UTC)

Added Added. Thanks. Not sure if it'll help against this type of spam though. --Erwin(85) 10:14, 25 February 2009 (UTC)

cropcirclesdatabase.org





Added xwiki by this user Finn Rindahl 23:25, 24 February 2009 (UTC)

Added Added  — Mike.lifeguard | @en.wb 01:38, 26 February 2009 (UTC)

www.ciill.com





Added to YouTube-articles crosswiki- Finn Rindahl 19:43, 25 February 2009 (UTC)

Added Added, af, be-x-old, bs, ca, cs, de, cy, da, and many others, he readds it after having been reverted and warned. Thanks and best regards, --birdy geimfyglið (:> )=| 19:49, 25 February 2009 (UTC)

A ton

Hi!
Concerning (discussion and) sbl-diff:
Afaics there are some to "greedy" conditions now, e.g. \bad\.(?:com|biz|us|org|net)\b is blocked atm. So I suggest to exchange the entries by the longer list

\b10bux\.net
\b5centminimum\.com
\ba-n-cash\.com
\baaa-mails\.com
\bad(?:5\.biz(?:ad-fortune\.com)?|-fortune\.com|onlyptc\.us|qds\.com|sbux\.org|smaker\.net|sneed\.com|vertisingcentral\.biz)
\baglocomails\.com
\bahacash\.com
\balertpay\.com
\bal(?:lcashmail|lyousubmitters|miyachts|tsurf|wayspay)\.com
\bam(?:erican-mails|igoemail|ity-cash)\.com
\ban(?:-cash|nies-biz|s-advertising)\.com
\bap(?:ache|pealing|ple|polo)mails?\.com
\bar(?:ab-gpt|abbux|adiasgarden|cane-mails|csurvey|cticmails|rowheadptr)\.com
\basonewishes\.com
\ba(?:tom[-s]|uction-e)mails\.com
\bawsurveys\.com
\bba(?:byloncash|n-mail|nboocash|ybux)\.com
\bbank-mails\.(?:com|net)
\bbe(?:anybux|arshare-mails|autymails|eptr|etrmails|stflymails|ta-cash|ttybucks|yondemails)\.com
\bbest-hyip\.be
\bbgpaymails?\.com
\bbi(?:gdollar-mails|ggestdollars|gluck-mails|gpaymail|lliondollarmails|zbizs|zsonline)\.com
\bblacklistptc\.blogspot\.com
\bblue(?:maniacs|rwebmail)\.com
\bbo(?:a-|bo|ffopaid|rat|ss-)mails?\.com
\bbondjamesbond\.net
\bbournemouthbreeze\.com
\bbravevolitation\.com
\bbu(?:gcash|sinessptr)\.com
\bbux(?:\.to|a\.in|euro\.com|galore\.com|junction\.com|out\.com)
\bcamel-mails\.com
\bca(?:n-discount|ndy-mail|nnabismails|t-mails|t-ptr|tch-cash)\.com
\bcash(?:-kitty|4(?:all|hits)|n?bux|eden|fiesta|nclicks|origin|out|pointclicks|posse|read|sea)\.(?:com|co\.cc|org|net)
\bcasino-mails\.com
\bcgcash\.info
\bch(?:arm-mail|erokeeptr|icago-ptr)\.(?:biz|com)
\bchobit[-s]?mails\.(?:com|net)
\bclass(?:-act-clicks|ical-mail)\.com
\bclick(?:-mails|-monkey|-wizard|2earnmoney|4coins|buxx?|cent|evolution|fantasy|ingmoney4u|oly|s(?:-4-cash)?|topsites)\.(?:biz|com|net|org)
\bclixy\.net
\bclo(?:nebux|set-clickers|udmails|verclicks)\.(?:com|net)
\bco(?:ast-?mail|inclicks|lor-mail|mpactmails|okie-mails|operativemail|pymails|smicwealth|splaymails|verclicks|wboy-mail)\.(?:com|info)
\bcr(?:abmails|ash-cash|azy-4-cash|azyclicks|eam-mails)\.(?:com|us)
\bcy-mails\.com
\bearn3\.com
\begyptp(?:ost\.org|tc\.com)
\bhardbuxs\.co\.cc
\bisabelmarco\.com
\bneobux\.to
\bp2cdaily\.com
\bperfectbux\.com
\brocashbux\.info
\broudycash\.com
\bsandraclicks\.com
\bthinkbux\.com

if all domains mentioned in the thread should be blocked.

Perhaps it'd be best to state what the problem is. The example you cite doesn't seem to actually be a problem. If there is a real problem then it should be fixed. If not, then no solution is required.  — Mike.lifeguard | @en.wb 04:34, 26 February 2009 (UTC)
There was no spamming of "ad.com" (or .org, ...): So it should not be blocked. Apart from that there are many sites (which we don't know), which are blocked by this entry; See e.g. [3]. ("foo-ad.org" is matched for any "foo"). AD is an abbreviation e.g. for "alzheimer desease".
Additional to that there's a third bug concerning "egypt..." (org vs. com). It was easier for me to build new regexps than searching for all bugs in the already built regexps. ;-)
And as a small thing: For performance reasons grouping of regexp should be done primarily at the rear of strings, and not at the beginning. -- seth 12:28, 26 February 2009 (UTC)
I think the work folks are doing to improve efficiency is good.. At the same time, I hope that as folks regroup stuff and alter regexes for efficiency that it will still be possible for non-regex admins to correlate blacklist entries with our blacklist logs. If not, then the efficiency gain may not be worth making the changes. --A. B. (talk) 19:05, 26 February 2009 (UTC)
Yes, the log is highly important. But by using [4] it should be no big problem to get the right entries (blacklist and log) for a given url. So actually we don't have to take care of transparency of the list itself. The more important thing is the log. -- seth 22:28, 26 February 2009 (UTC)

Just Do It :D  — Mike.lifeguard | @en.wb 01:50, 28 February 2009 (UTC)

Ok, see also this request. I hope that everything is alright now. -- seth 23:19, 1 March 2009 (UTC)

freeunlimitedweb.com

Not spammed all that much (and a domain that I have a website at), but due to its nature of being a free webhost, it could well be a potential candidate to list here. AC --Sunstar NW XP 14:27, 26 February 2009 (UTC)



X mark.svg Thanks but no thanks.  — Mike.lifeguard | @en.wb 01:49, 28 February 2009 (UTC)

no2low.com

URL shortner.



--Jorunn 09:14, 1 March 2009 (UTC)

Added Added. --Erwin(85) 09:19, 1 March 2009 (UTC)

lmgtfy.com





Can be used to bypass the blacklist. Also, please blacklist the redirect: letmegooglethatforyou.com --Kanonkas 20:31, 3 March 2009 (UTC)

This requires the &l=1 parameter, so I suggest blacklisting \b(?:lmgtfy|letmegooglethatforyou)\.com.*[?&]l=1  — Mike.lifeguard | @en.wb 20:35, 3 March 2009 (UTC)
The analogue for Google is \bgoogle\.com.*[?&]btnI=1. Will look at some other search engines now...  — Mike.lifeguard | @en.wb 21:02, 3 March 2009 (UTC)
Thanks to seth, we've got \bgoogle\.(?:com|(?:com\.)?[a-z]{2})/.*[?&]btnl=1 instead for Google. I didn't find other search engines after a cursory check.  — Mike.lifeguard | @en.wb 21:16, 3 March 2009 (UTC)

Added Added the regexes mentioned above.  — Mike.lifeguard | @en.wb 20:37, 5 March 2009 (UTC)

mons.hr







Finn Rindahl 13:27, 5 March 2009 (UTC)

Add them all, the top 10 is: croatia.mons.hr (49), slovenia.mons.hr (12), travel.mons.hr (11), porec.mons.hr (9), greece.mons.hr (5), ceska.mons.hr (5), portugal.mons.hr (5), spanjolska.mons.hr (3), eslovenia.mons.hr (3), svicarska.mons.hr (2).


















see



















Report for mons.hr on the way. Nice catch, Finn! --Dirk Beetstra T C (en: U, T) 13:32, 5 March 2009 (UTC)

Just Added Added \bslovenia\.mons\.hr\b because 195.29.222.206 was spamming it crosswiki. Gblocked that IP for 15 minutes to allow the blacklist to work everywhere, probably whole mons.hr needs adding.
Best regards, --birdy geimfyglið (:> )=| 14:08, 5 March 2009 (UTC)
Yeah, changed it to \bmons\.hr\b  — Mike.lifeguard | @en.wb 20:34, 5 March 2009 (UTC)

www.hacibektas.de/ www.karacaahmet.com/ www.alevi.com/



Ongoing spam by that IP, seen on Commons, and tr.wikt, possibly also many others. He masscreates pages with the same offtopic content and the three links at the end. Plus he comes back after some time, see [5]. Already Added Added the three and gblocked the IP for 15 minutes to allow the spamblacklist work everywhere.

Best regards, --birdy geimfyglið (:> )=| 00:07, 6 March 2009 (UTC)




Ehlibeytin soyu is involved, see de:Spezial:Beiträge/Ehlibeytin_soyu same content, same spam, best regards, --birdy geimfyglið (:> )=| 11:33, 6 March 2009 (UTC)

Also involved:






but I couldn't find any more domains.  — Mike.lifeguard | @en.wb 17:16, 10 March 2009 (UTC)

silav.net





































--Jorunn 01:01, 8 March 2009 (UTC)

Added Added. At first I thought about adding only en.silav.net, because the new links are to en.silav.net and the old links to www.silav.net, but some checking made me decide that the old links are rather worthless too, so not much is lost if they happen to be forced to be removed. - Andre Engels 01:53, 8 March 2009 (UTC)
So I thought too, but then I saw that most of the older silav.net links also had been inserted by alicedsl.de IPs.
The blacklist extention now only blocks new links, not links that is in the old text. So there is no imidiate need to remove links anymore. But there will still be a problem for regular users if the article gets blanked and the the text with a blacklisted link needs to be reverted, so blacklisted links should be removed anyway, especially if they have been spammed of course. Or they should be whitelisted locally where they are wanted.
This link is probably on-topic in ku:Silav.net (but the article was created by an alicedsl.de IP, and only other alicedsl.de IP have edited the article).
I've left a message on the talk page of one of the admins on ku.wikipedia.
--Jorunn 09:48, 8 March 2009 (UTC)

tinyarro.ws

Url shortener. Track13 11:34, 9 March 2009 (UTC)



Added Added  — Mike.lifeguard | @en.wb 13:50, 9 March 2009 (UTC)

France-related wikis on wikidot.com

We've been spammed with links to multiple wikis:

Spam domains


[6][7][artists.wikidot.com contact us link]




























Related domains


  • Compare en.wikipedia's 15 December 2008 version of Gene Davis (painter) with the [a-to-z-artists.blogspot.com/2009/02/gene-davis.html blog's 9 February 2009 entry] on the painter.
  • This was spammed to simple.wikipedia but not here












[8]



[9][10][artists.wikidot.com contact us link][11]





















Google Adsense ID: 9359000462991404


Accounts






[13][14]

Looking at the COIbot reports there's also been another (well-established) editor adding links to many of these wikis. --A. B. (talk) 23:15, 9 March 2009 (UTC)

Added Added --A. B. (talk) 22:20, 10 March 2009 (UTC)

livetribun.com





5 warnings, 2 blocks to date. --A. B. (talk) 03:52, 10 March 2009 (UTC)

Added Added --A. B. (talk) 22:13, 10 March 2009 (UTC)

More Universe Daily links

References:

Also see:

Domains:

















Accounts




--A. B. (talk) 21:42, 10 March 2009 (UTC)

Added Added --A. B. (talk) 21:51, 10 March 2009 (UTC)
Also spamming cy.wikipedia --A. B. (talk) 23:55, 10 March 2009 (UTC)

Additional Universe Daily information

In addition to the en.wikipedia spam documented in some of the links above, these and related domains have been spammed extensively across many Wikimedia projects:
Wikipedia:

Commons:

Meta-Wiki:

Wikinews:

Wikiquote:

Wiktionary:

en.wikipedia accounts identified to date:

More domains added by one or more of the IPs above:

















































--A. B. (talk) 05:21, 11 March 2009 (UTC)

Added Added -- 24 additional domains listed immediately above. --A. B. (talk) 05:28, 11 March 2009 (UTC)

kayit.co.cc





Ongoing crosswiki-spam, Added Added "\bkayit\.co\.cc\b" already, and gblocked the IP 15 minutes so the spambl works. Seen on cv, tk, be, uz, be-x-old, best regards, --birdy geimfyglið (:> )=| 14:54, 13 March 2009 (UTC)

More IPs:






 — Mike.lifeguard | @en.wb 23:13, 15 March 2009 (UTC)

sandoftime-mv.ucoz.ru





Spammed on many wikis, already Added Added \bsandoftime-mv\.ucoz\.ru\b Best regards, --birdy geimfyglið (:> )=| 18:49, 13 March 2009 (UTC)

Reverted Reverted also. —Dferg (talk) 19:05, 13 March 2009 (UTC)















































Added Added those domains.  — Mike.lifeguard | @en.wb 23:23, 15 March 2009 (UTC)

www.evrekaegitim.com