User:Mathonius/Reports/"ENDVALUE" spam

From Meta, a Wikimedia project coordination wiki
Jump to navigation Jump to search

This is an effort to compile data about the "ENDVALUE" spambots (see this for example, variant). Please feel free to edit this page.

Wiki's[edit]

Abuse Filter[edit]

Ranges[edit]

IP's[edit]

Done a "run my eye down the list" and done the following blocks which seem to cover the bulk. Only for a month, however,

  • [16:08] <StewardBot> Billinghurst globally blocked 112.111.0.0/18 (anonymous only, expires 05:08, 24 February 2013) with the following comment: Cross-wiki spam: Please edit logged in from an account
  • [16:08] <StewardBot> Billinghurst modified the global block on 220.200.12.0/22 (anonymous only, expires 05:08, 24 February 2013) with the following comment: Cross-wiki spam: Please edit logged in from an account*
  • [16:10] <StewardBot> Billinghurst modified the global block on 36.248.0.0/18 (anonymous only, expires 05:08, 24 February 2013) with the following comment: Cross-wiki spam: Please edit logged in from an account
  • [16:10] <StewardBot> Billinghurst modified the global block on 220.249.128.0/18 (anonymous only, expires 05:08, 24 February 2013) with the following comment: Cross-wiki spam: Please edit logged in from an account
  • [16:11] <StewardBot> Billinghurst modified the global block on 64.241.220.0/22 (anonymous only, expires 05:08, 24 February 2013) with the following comment: Cross-wiki spam: Please edit logged in from an account
  • [16:16] <StewardBot> Billinghurst globally blocked 58.22.20.0/22 (anonymous only, expires 05:08, 24 February 2013) with the following comment: Cross-wiki spam: Please edit logged in from an account
    Note: Don't worry about the words use about modified, they are all fresh, I was just reusing a form.

Notes[edit]

Most of this spambot's IPs are from Fuzhou, China, otherwise it may be a open proxy.

  • The nature of this kind of bot is that it will be proxies - open/exploited/whatever. The only caveat is to be wary of blocking dynamic IPs (though some of those are not actually dynamic...)