Jump to content

Talk:Wikiproject:Antispam/Archives/2023/Bulk text reference addition spam

Add topic
From Meta, a Wikimedia project coordination wiki

Nanașu47, Dellmatron et. al

[edit]




























Spammers

There's a lot more. MER-C 16:41, 3 June 2023 (UTC)Reply


































Spammers

Second batch. MER-C 10:25, 11 June 2023 (UTC)Reply

Thanks @MER-C! I assume it's better to wait with global blacklisting until en:Wikipedia:Sockpuppet investigations/Dellmatron is done and the full extent of SEO sockpuppets is visible? By the way there are more SEO links related to Frandish (CA · xwiki · sc · COIBot report), Onicahad (CA · xwiki · sc · COIBot report), Gailesh (CA · xwiki · sc · COIBot report) and Inspame (CA · xwiki · sc · COIBot report):




























Johannnes89 (talk) 19:54, 12 June 2023 (UTC)Reply

Batch 4

[edit]






































Yeah, there's more. I need to break this up to be manageable. MER-C 18:56, 14 June 2023 (UTC)Reply

Batch 5

[edit]




































































Already blacklisted


Spammers

I wrote a program to fetch the domains added by these accounts. The list was 1300 long and had a lot of noise in it. I'm sick of wading through this spam, so I'll call this done. MER-C 18:49, 27 June 2023 (UTC)Reply

Noting that Creetey spammed both AvaTrade (see section above) and yavitrina.ru. MER-C 16:23, 1 July 2023 (UTC)Reply
Accounts to this point locked. MER-C 18:26, 24 July 2023 (UTC)Reply

Batch 6

[edit]

MER-C 18:26, 24 July 2023 (UTC)Reply

alpha-performance.com etc.

[edit]
















Spammers

This has all the signs of a spiralling cross-wiki investigation, which I do not have the time for right now. This appears to be Dellmatron-like spamming (see above). MER-C 19:00, 2 June 2024 (UTC)Reply








Yeah, it's them. Sigh. MER-C 18:41, 4 June 2024 (UTC)Reply








Yawn. MER-C 18:35, 5 June 2024 (UTC)Reply

Accounts locked until here. MER-C 16:36, 8 June 2024 (UTC)Reply
Spam cleaned and nominated for global blacklist up to here. MER-C 16:47, 22 June 2024 (UTC)Reply










More. MER-C 16:36, 8 June 2024 (UTC)Reply

What about...
--Matěj Suchánek (talk) 17:36, 8 June 2024 (UTC)Reply
Yes, that's also them. MER-C 18:15, 8 June 2024 (UTC)Reply














More. MER-C 11:18, 9 June 2024 (UTC)Reply

Accounts locked until here. MER-C 18:56, 9 June 2024 (UTC)Reply










More. MER-C 18:56, 9 June 2024 (UTC)Reply










More. MER-C 18:42, 10 June 2024 (UTC)Reply

Done Cleaned them all except frwiki for which I've requested help of a French speaker, global lock requested as well. A09|(pogovor) 21:21, 10 June 2024 (UTC)Reply
Done. Same on eswiki. Also made a request to add some links to the spam blacklist. Nacaru · Talk ✉ 00:12, 11 June 2024 (UTC)Reply
































Next batch. MER-C 18:55, 11 June 2024 (UTC)Reply








Next batch. MER-C 19:02, 14 June 2024 (UTC)Reply






Created Wikiproject:Antispam/Archives/2023/Bulk text reference addition spam. I've been blocked on ca.wp for trying to revert this shit despite linking here - any tips? MER-C 10:46, 15 June 2024 (UTC)Reply

Unlocked. They looked like good edits and some of the users are not listed (or I couldn't find them!). Sorry for the inconvenience. Beusson (talk) 17:46, 15 June 2024 (UTC)Reply
Thank you for unblocking, no problem. MER-C 19:50, 15 June 2024 (UTC)Reply

We just blocked Nnardeli (CA · xwiki · sc · COIBot report) on cswiki.
I am also suspicious about Chananme (CA · xwiki · sc · COIBot report), but that could be a different initiative. --Matěj Suchánek (talk) 15:34, 21 June 2024 (UTC)Reply

Nnardeli is them. Chananme is of concern but I also think this is likely a different case. MER-C 18:37, 21 June 2024 (UTC)Reply
































This spam is getting slightly harder to find. MER-C 18:37, 21 June 2024 (UTC)Reply








































MER-C 12:28, 23 June 2024 (UTC)Reply




























MER-C 19:03, 25 June 2024 (UTC)Reply
































MER-C 12:02, 27 June 2024 (UTC)Reply

[edit]

I still need to delve deeper down the rabbit hole to uncover the spam links, but it's worth noting that they're active again:

- XXBlackburnXx (talk) 10:01, 24 December 2024 (UTC)Reply

2nd batch of accounts:
XXBlackburnXx (talk) 10:18, 24 December 2024 (UTC)Reply

New domains already blacklisted:



New domains:

















New spammers:

I think done with this batch. MER-C 11:15, 26 December 2024 (UTC)Reply

Oh thank you. That's extremely helpful!~ XXBlackburnXx (talk) 05:10, 27 December 2024 (UTC)Reply
domains have been listed. Now pending global locks: Steward_requests/Global#Global_lock_for_spam_accounts. XXBlackburnXx (talk) 07:07, 27 December 2024 (UTC)Reply
Next batch:
XXBlackburnXx (talk) 17:48, 27 December 2024 (UTC)Reply

New domains already blacklisted:





New domains:











































New spammers:

Ugh, only up to G on my candidate domain list, and that's not including any new domains from these new spammers. MER-C 15:56, 28 December 2024 (UTC)Reply










MER-C 19:49, 28 December 2024 (UTC)Reply

New domains already blacklisted:



New domains:























































Spammers:

That's the first list of candidate domains done, now to get another from the spammers I listed above. MER-C 13:11, 30 December 2024 (UTC)Reply










































Spammers:

And with that, we are done with this lot. MER-C 17:54, 31 December 2024 (UTC)Reply

now the real challenge begins: cleaning it up without getting blocked... XXBlackburnXx (talk) 21:59, 2 January 2025 (UTC)Reply

Old domains revisited

[edit]










@XXBlackburnXx: - we need to ensure everything gets blacklisted, because they will come back (that is, if they stopped at all). MER-C 16:26, 4 January 2025 (UTC)Reply

Follow-up spam:












I think I'm done with this batch. MER-C 17:08, 4 January 2025 (UTC)Reply
Reverted most of their edits. Best, — Jules* talk 17:44, 5 January 2025 (UTC)Reply

As suspected, they did not stop. MER-C 13:55, 22 February 2025 (UTC)Reply

I tried local CU, but it's all proxy usage, and they're being smart by matching the geolocation to the wiki's language. So, I don't think CheckUser will help here unfortunately. XXBlackburnXx (talk) 05:18, 20 March 2025 (UTC)Reply

New set (old spammers)

[edit]

Can I have a bit of background here, 2 spammers in this batch and 2 spammers in the previous batch show up in relation to a delist request on en.wikipedia. The domains spammed are not on the domainlist (dotdash Meredith websites) in these reports. Is this an SEO company spamming? Dirk Beetstra T C (en: U, T) 04:31, 19 March 2025 (UTC)Reply

Wow, it really helps to yell at your admin corps .. application of the law of unintended consequences: 3 more spammers related to the same subfamily of dotdash Mereditch websites are adding a link to the exact same page using the 3 different accounts, edits on their own wiki. I guess we are up for a broader cleanup. Just tell me and I will add them in a report here (@MER-C:/@XXBlackburnXx:) Dirk Beetstra T C (en: U, T) 05:33, 19 March 2025 (UTC)Reply

Yes, likely a company in a low-income country. This spammer adds many references, including quite a lot of incidental garbage. For instance, in [1] the spammed domain is zamberg.com [2]. So I think this is a separate case.
Two more accounts: Gabynar (CA · xwiki · sc · COIBot report) and Dementai (CA · xwiki · sc · COIBot report). MER-C 17:26, 19 March 2025 (UTC)Reply

@MER-C: OK, here goes. I have no data on Dementai whatsoever (yet, probably, I am suffering from a massive backlog on LiWa3, probably a month worth of parsing in the backlog, it keeps up with current in the meanwhile though). Unless you know what I am talking about, how did you know I would be interested in these two?









(shutdown, people are sent to Parents.com via soft-redirect)





Except for parents.com already blacklisted on en.wikipedia (and the ones that parrot en.wiki blacklist). Avoidable sources, but unfortunately widely used. Do we just (globally) blacklist this stuff to stop this? --Dirk Beetstra T C (en: U, T) 18:05, 19 March 2025 (UTC)Reply

Screwed up the ping to user:MER-C earlier, so here goes. Dirk Beetstra T C (en: U, T) 18:09, 19 March 2025 (UTC)Reply
I see the verywell stuff as a different case - those domains are being added are incidental. What I am looking out for in this case is like this:






MER-C 19:52, 19 March 2025 (UTC)Reply
Sure, but incidental, different accounts using the same links on different wikis .. Dirk Beetstra T C (en: U, T) 20:30, 19 March 2025 (UTC)Reply






MER-C 19:42, 20 March 2025 (UTC)Reply

Next batch

[edit]


















Recycled spam:









MER-C 19:09, 3 May 2025 (UTC)Reply

MER-C 16:18, 6 May 2025 (UTC)Reply


MER-C 11:13, 10 May 2025 (UTC)Reply
@MER-C:@XXBlackburnXx:






































































































Less recent (pre-2025)

Latest: November 7, 2024



Latest: October 24, 2024



Latest: October 15, 2024



Latest: October 8, 2024



Latest: September 15, 2024



Latest: September 9, 2024



Latest: August 5, 2024



Latest: August 3, 2024



Latest: July 24, 2024



Latest: July 18, 2024



Latest: July 17, 2024



Latest: July 9, 2024



Latest: April 14, 2024



Latest: April 9, 2024



Latest: April 4, 2024



Latest: March 24, 2024



Accounts/IPs

ClumsyOwlet (talk) 18:58, 15 July 2025 (UTC)Reply

Extra stuff I have found so far:
Template:Spamlink
Template:Spamlink
Template:Spamlink
MER-C 17:24, 20 July 2025 (UTC)Reply
Template:Ping New stuff
Template:Spamlink
Template:Spamlink
Template:Spamlink
Template:Cot

Template:Cob

ClumsyOwlet (talk) 20:54, 24 July 2025 (UTC)Reply
More accounts. MER-C 15:56, 24 August 2025 (UTC)Reply
MER-C 18:39, 26 August 2025 (UTC)Reply

MER-C 18:46, 28 August 2025 (UTC)Reply

Done with the domains, all blacklisted. 355 unmatched accounts... MER-C 18:20, 29 August 2025 (UTC)Reply
I'm going to archive this due to size. MER-C 10:44, 30 August 2025 (UTC)Reply