Talk:Spam blacklist
- Information
- List of all projects
- Overviews
- Reports
- Wikimedia Embassy
- Project portals
- Country portals
- Tools
- Spam blacklist
- Title blacklist
- Email blacklist
- Rename blacklist
- Closure of wikis
- Interwiki map
- Requests
- Permissions
- Bot flags
- New languages
- New projects
- Username changes
- Translations
- Speedy deletions
This file is for use by, e.g., the Mediawiki SpamBlacklist extension
This list is high overhead and only for hard cases which can't be dealt with using routine blocking methods. If IP blocks don't work and the spam is regular or in lots of wikis, it's a good candidate for listing here.
If you haven't tried blocking and found it to be ineffective, it's not worth the great amount of time involved in verifying and adding a new entry, then dealing with any accidental blockings related to the listing. Administrators here will use their discretion in adding and removing entries by the guidelines laid out on this page.
If you are having problems with the spam list and aren't a spammer please include a link to the article you are having trouble saving and say which URL (without the leading http part) you are told is blocked. Any meta administrator can edit the spam blacklist.
For removals because they conflict with a known significant spammer, please include them in the whitelisting desired section so they can be specifically whitelisted later, while still keeping the generic block in place.
Requests for removal
Add new items to the end of this section. For each one, include:
- The URL the error message mentions without the http:// prefix.
- Links to the article or articles you were editing. Use a full URL if you're not sure how to write an interwiki link.
- See /completed removals for removals which have been processed (either removed or reasons given for choosing not to remove). If not removed, you can still use a plain text form of the link.
- Many of these should probably go into the whitelisting desired section - if it's just a single URL, that's probably where they belong.
balder.prohosting.com/mrod, essential to writing the en:Rodrigues Movement article. --213.114.31.89 16:49, 1 November 2005 (UTC)
www.101languages.net I never heard of such a website, but it is blocking me from editing the en:Polish_language article
- The link is no longer in the article. silsor 16:55, 7 November 2005 (UTC)
www.tamiflu is blocked. www.tamiflu.com is a legitimate site by Roche with information about their drug, and it is essential to writing the en:oseltamivir (en:Tamiflu) page. The link has been there, but suddenly someone put this spamfilter on and I can't save my new edits on a different topic! User:Pigkeeper (I don't know how to link to my wiki name, i don't have a metawiki name). 9 Nov 2005, 19:50
- Thanks for reporting this, I removed "tamiflu" from the list. I checked the other drug names as well but the only one that seems to have a real web site is "phentermine" for phentermine.com, and that site looks really suspicious (how can you have an "official" site for the generic name of the medication? silsor 20:40, 9 November 2005 (UTC)
bmpx.kicks-ass.net is blocked. It is a legitimate website about a media player, and is essential for updating en:Beep_Media_Player page (as well as all tranlsations of that page). User:AbelCheung (I don't have metawiki name too) 19:58, 2005/11/11 (UTC)
- It seems that kicks-ass.net was only spammed once here, so I've gone ahead and removed it. silsor 19:44, 12 November 2005 (UTC)
Requests for addition
Add new items to the end of the list. See /completed additions for additions which have been processed (either added or reasons given for choosing not to add).
If you do not provide enough information, nothing will happen.
For each request, include:
- Links to one or more page diffs which show the spam being added, preferably in many different wikis. We have to ensure that false requests aren't made for addition or deletion.
- Include the URLs being promoted - they won't be added without a link to them. We need to document why we added something.
- Do not include http://, even inside nowiki tags, otherwise we will run into the spam filter after the URL is added.
- If the spam is in non-English on a non-English wiki, explain it as best you can. If you need translation, use Meta:Babel.
Show restraint in requesting additions for:
- Spammers who spam once.
- Spammers who target only one article.
- Spammers who can be effectively blocked with IP blocks - use those instead.
www.anzwers.org
Interleaved with www.online-shopping.wb.st attacks on other projects, so it's probably the same spammer. Again, they have attacked at least two projects' talk pages with different IPs each time. Here are two diffs: [1] and [2]. (Donovan|Geocachernemesis|Interact) 02:15, 27 August 2005 (UTC)
- Any recent examples? silsor 17:23, 7 November 2005 (UTC)
158hk.org & 158hk.net & hksaa.net
spammed in ja.wp. [3] [4] [5] [6]. --Tietew 15:14, 28 August 2005 (UTC)
- Sorry for the long delay. Does this spam still happen? silsor 17:08, 8 November 2005 (UTC)
hotsex.bare.org
Spammed by 81.214.96.35 on pt.wikinews: [7] [8]. -- Get_It 20:55, 30 August 2005 (UTC)
- This should be handled by blocking 81.214.96.35. silsor 17:08, 8 November 2005 (UTC)
qm008.com
Spam Dan100 09:22, 4 September 2005 (UTC)
- One spam isn't enough to blacklist on. silsor 17:08, 8 November 2005 (UTC)
Tax protester spam
www losthorizons com
Commerical "tax protester" site, added by multiple IPs to multiple articles on WP, including w:Tax protester [9]; w:Brushaber v. Union Pacific Railroad [10]; and innumerable additions to w:Income tax (e.g., [11], [12], [13] [14])
joebanister blogspot com
Another tax protester site, added by multiple IPs to w:Income tax multiple times ([15], [16], [17]), sometimes along with www losthorizons com above. Also added to w:IRS ([18]) — Mateo SA 23:10, 19 September 2005 (UTC)
- Neither of these sites seem to have been added since September. silsor 17:08, 8 November 2005 (UTC)
cialis-online.bigclickmouse.com
Spam, spam, spammity spam![19] Garrett 14:31, 21 September 2005 (UTC)
- Are there any more examples of this spam? silsor 21:06, 12 October 2005 (UTC)
bjicp.com, gloveboxes.com.cn, gloveboxes.cn
Spam, spam, lovely spam, spa-a-a-a-am![20] Garrett 21:20, 22 September 2005 (UTC)
- Are there any more examples of this spam? silsor 21:06, 12 October 2005 (UTC)
5737.net
This user add this gambling website in his user page for advertise: [21] --Moses 16:31, 8 October 2005 (UTC)
- Only once? silsor 21:06, 12 October 2005 (UTC)
[*.web.com, *.big.de.com
Repeat spammer bot, particularly using casino-related (*.888.web.com), (*.pokera.web.com), www.play-online-casino.de.com, (*.big.de.com).
example wikispam. - Amgine/talk 15:28, 13 October 2005 (UTC)
- All specific domains added for now. silsor 15:52, 13 October 2005 (UTC)
Starting a laundry list from recent WN blocks:
| Domain | diff |
|---|---|
| sexclub69.zap3x.com/ | 1 |
| www.searchadv.com, www.buy-online-pharmacy-best.cheap-buy-free-online.com | 2 |
| www.rolelit.com | 3 |
| www.anzwers.or | 4 |
freesex31.zap3x.com
Spam spam lovely spam! [22] Garrett 02:56, 15 October 2005 (UTC)
- Has it happened more than once? silsor 16:49, 15 October 2005 (UTC)
Pagina
Every month there are a few more links to this link farm. One, Another. All go http:// [something like the pagename] .pagina.nl
- That doesn't look very serious at all, and isn't pagina a free host? silsor 14:41, 16 October 2005 (UTC)
- Pagina is a webdirectory/linkfarm. 68.39.174.238 03:50, 19 October 2005 (UTC)
www.kvdeutschland.q27.de
Nazi page which probably is illegal (not sure), set by an user of de: on many pages. Thanks, Rdb/de:Benutzer:Rdb 14:00, 18 October 2005 (UTC)
- Could you please provide some examples? silsor 05:45, 6 November 2005 (UTC)
From Seattleeva.org
See this spam we were so fortunate to recieve:
- [23] This one was kind enough to identify itself as spam: div id="wikiSpam"
rx-seote\.com
- [24] This one was kind enough to use the signature, doesn't look very botish.
<!pre> drugs\.com lrginc\.com Aciphex\.com Actonel\.com Actos\.com Acyclovir\.com Alendronate\.com Allegra\.com Altace\.com Amoxycillin\.com Atorvastatin\.com Augmentin\.com Avandia\.com Azithromycin\.com Bupropion\.com Bupropion\.com Carisoprodol\.com Cefixime\.com Celebrex\.com Celecoxib\.com Cephalexin\.com Cetirizine-HCL\.com Cialis\.com Cipro\.com Ciprofloxacin\.com Clarinex\.com Claritin\.com Clomid\.com Clomiphene\.com Cozaar\.com Desloratadine\.com Diflucan\.com Esomeprazole\.com Fexofenadine\.com Finasteride\.com Flomax\.com Fluconazole\.com Fluoxetine\.com Fosamax\.com Glucophage\.com Imitrex\.com Keflex\.com Lamisil\.com Levitra\.com Lipitor\.com Loratadine\.com Losartan\.com Meridia\.com Metformin\.com Montalukast\.com Nexium\.com Omeprazole\.com Orlistat\.com Pantoprazole\.com Paroxetine\.com Paxil\.com Pioglitazone\.com Pravachol\.com Pravastatin\.com Prilosec\.com Propecia\.com Proscar\.com Protonix\.com Prozac\.com Rabeprazole\.com Ramipril\.com Risedronate\.com Rosiglitazone\.com Sertraline\.com Sibutramine\.com Sildenafil\.com Singulair\.com Softtabs\.com Softtabs\.com Soma\.com Sumatriptan\.com Suprax\.com Tadalafil\.com Tamsulosin\.com Terbinafine\.com Tretinoin-Gel\.com Valacyclovir\.com Valtrex\.com Vardenafil\.com Viagra\.com Wellbutrin\.com Xenical\.com Zithromax\.com Zoloft\.com Zovirax\.com Zyban\.com Zyrtec\.com <!/pre>
- Thanks for reporting this. I added a few from the top, rx-seote.com and mx.gs. The others from the top appear to be legitimate hosting sites that had spam domains on them. The long list of pharmaceuticals is confusing; some of them are probably spammer-owned but there are others that appear to be legitimate (like viagra.com). Perhaps some spam links were listed alongside legitimate links in order to improve search engine rankings? Not adding for now. silsor 23:10, 31 October 2005 (UTC)
Bot 1 [_pw##_]
- [25] This looks like the bot mentioned here #there_seems_to_be_a_new_bot_in_town.
<!pre> mx\.gs sie\.pl omet\.pl czytelnia\.net fragism\.com spiritualitea\.net <!/pre>
- These have been reviewed by silsor, rearranged them for ease of later additions.
- [26] - New set from this bot --D0li0 00:52, 7 November 2005 (UTC)
flappie\.nl zwap\.to ubtt\.org xanga\.com diaryland\.com ojr\.org japanmediareview\.com
Bot 2 section replacer
Looks like a new Bot, it appear to be replacing the first section on user pages. --D0li0 00:58, 6 November 2005 (UTC)
viprape\.com
golft\.nl
- Added those two domains (a rape fetish site and domain hiding service). silsor 05:44, 6 November 2005 (UTC)
It's back.. Replacing sections again.
lau\.biz
fiberia\.com
- The fiberia link is now covered under "phentermine", and lau.biz is added. silsor 21:10, 8 November 2005 (UTC)
huter.t35.com
See some diffs: [31], [32], [33]... Thanks. Korg 02:07, 1 November 2005 (UTC)
- Reported to abuse department. silsor 23:05, 1 November 2005 (UTC)
- Thank you again. :) Korg 22:20, 4 November 2005 (UTC)
www.angelfire.com/poetry/seidel/
- Links to one or more page diffs which show the spam being added:
- URLs being promoted:
- www.angelfire.com/poetry/seidel/
--de:Benutzer:webmaster@sgovd.org / 84.61.2.19 23:48, 1 November 2005 (UTC)
support, de:Benutzer:He3nry/ --145.254.215.119 13:16, 3 November 2005 (UTC)
- Try protection first. silsor 15:22, 3 November 2005 (UTC)
- Well, protection is a bad solution because there are no other vandals, only the IP is trying to put in his link for several months... it's really getting annoying... 134.155.99.42 17:00, 5 November 2005 (UTC) de:Benutzer:Gunfighter-6
- We're trying protection now. I expect it to be a successful approach, but—as you may know—it has certain drawbacks like prohibiting normal users from editing the page.--80.136.149.131 18:41, 5 November 2005 (UTC)
- If he doesn't go away after the page has been protected for a reasonable amount of time then the link is a good candidate for addition. silsor 19:27, 5 November 2005 (UTC)
www5f.biglobe.ne.jp/~kokumin-shinbun/
Spammed in Ja.wikipedia. Spams are from multiple account (sockpuppets) and open proxies.
--Tietew 20:53, 5 November 2005 (UTC)
- Added. Would you mind saying what the site is about? silsor 05:41, 6 November 2005 (UTC)
joia.com
Pharmaceutical linkspam: [55], [56], [57], [58], [59], [60], [61], [62], [63], [64], [65], etc. :) Korg 00:42, 7 November 2005 (UTC)
- This appears to be a cracked site used for hosting drug spam. Added for now, should be removed later after the server has been taken down or cleaned out. silsor 16:55, 8 November 2005 (UTC)
- Ok, thanks. Korg 22:20, 8 November 2005 (UTC)
popular drug names used by spammer scripts
Just wanted to mention these keywords (of popular drugs) are massively used by spam scripts and probably never inside a legitimate URL:
hydrocodone
didrex
tamiflu
phentermine
adipex
a typical spam from this kind of bot always starts like this:
<div id="wiki123" style="overflow:auto; height: 1px;..
which causes the content to be hidden in article view, and its being followed by various changing URLs containg the above keywords.
- Added these - we'll see whether they cause any problems with legitimate URLs. silsor 16:55, 8 November 2005 (UTC)
lau.biz
please add lau.biz to the blacklist, see for example this edit. There have been a few more of those to the same user page, and probably elsewhere on the wiki. The editors IP seems to change for every edit. -- Duesentrieb 00:09, 9 November 2005 (UTC)
- Already done. silsor 04:28, 9 November 2005 (UTC)
- thanks -- Duesentrieb 11:28, 9 November 2005 (UTC)
fiberia.com
same as above -- Duesentrieb 11:28, 9 November 2005 (UTC)
villepin2007.org
Spams every day for months in fr:Dominique de Villepin. Thanks ! Turb 22:06, 9 November 2005 (UTC)
- Again and again : [66] [67] [68] [69] [70] [71]
- I think there needs to be a better reason to blacklist the site than the fact that it has been added to an article repeatedly. My French is not good enough to judge whether the link is good or bad, and even if it were, I would not try to make fr.wikipedia policy from here on meta by blacklisting the site. Is there a consensus among fr.wikipedia users to keep it out of the article? silsor 19:38, 12 November 2005 (UTC)
- imho, this link is non-encyclopedic and gives nothing to the encyclopaedia. And all others contributors that saw it had the same reflex, month after month. At this point, nothing more to do (except put away the link), but the webmaster seems to have a part of its day dedicated to put the link again and again. Me, and others, can continue during months to revert it, but blacklisting can be a solution to stop her or him (I have envisaged the blocking of the page during a few days to discourage her/him, but this article is linked to current news and changes a lot). I just have started a topic about it on w:fr:Discuter:Dominique de Villepin pointing to this page. Turb 19:34, 13 November 2005 (UTC)
- Added: I think the only way to automatically blacklist an url on fr: is for all project. Am I wrong ? Turb 19:40, 13 November 2005 (UTC)
green-tea.airmode.de/Green-tea.html
Added a couple times on Wikinews by anon ips. [72] (not a big issue, and very specific url, just annoying.) - Amgine 09:15, 11 November 2005 (UTC)
yea, please block. BTW: for some reason, commons:User talk:Notafish seems to be a favorite target for link spammers. -- Duesentrieb 13:23, 11 November 2005 (UTC)
crazymaidens.info
The link www.crazymaidens.info/* was added many times by a anon ip [73] at the main namespace. -- Get_It 17:51, 11 November 2005 (UTC)
- Added, pure spam. silsor 19:51, 12 November 2005 (UTC)
www.cyberlink.com
Spam coming in from multiple dynamic IPs. For example [74], [75] and several spam articles created, (now deleted) this, and this. These are all just from today. This is just a commercial website of an unnotable company, so there's no danger of collateral damage here, too. 134.10.44.224 08:10, 12 November 2005 (UTC)
- This isn't full-blown spam - should settle without intervention. Post again if they don't go away. silsor 19:51, 12 November 2005 (UTC)
Whitelisting desired
For individual URLs which can't be unblocked because they conflict with a significant spammer. Eventually the software will allow specifying exceptions to the general block rules.
Sites in domain "dynalias.net"
- (www.)fried.dynalias.net — my personal web site; I'd like to link it on my Wikipedia profile page! I understand that a lot of spam comes from the dynalias.net domain, but if you get anything from fried.dynalias.net you'll know who it's from (not that I'd ever do that, of course). Dave Fried 21:03, 30 May 2005 (UTC)
- Sorry, missed this request before. dynalias.net was added after being spammed by only one person on meta so I have removed it. silsor 19:54, 12 November 2005 (UTC)
Sites in domain "newmail.ru"
- www.nevskiy-district.newmail.ru — Site about Nevsky municipal districts of the St-Petersburg. --Kaganer 10:51, 8 August 2005 (UTC)
- www.andtan.newmail.ru/list/ - Site about spiders --de:Benutzer:Fristu (is there a whitelist)?
- newmail.ru now has been restricted to subdomains too. However, with the frequency of this kind of site being used for bad, whitelisting might be better. I don't know. - Andre Engels 13:06, 10 August 2005 (UTC)
http: // icehouse dot 4mg dot com/icehouse.html Icehouse
Can someone unblock this one? Thanks!
- 4mg.com might be unblocked if there were a useful site on it that somebody wanted to add to an article. silsor 23:35, 31 October 2005 (UTC)
Other talk
Please leave all other talk in this section. Archive at /archive.
feature request: customized spam blocklists for national subdomains/projects
Recently the administrators of ruwiki have proposed (see ru:Википедия:Форум) to introduce new MediaWiki pages MediaWiki:blacklist and MediaWiki:whitelist which would work as a substitute for the meta blacklist. The rationale is that meta blacklist updates come quite rarely.
In the case these messages are not initialized, the meta blacklist is used.--ACrush ?!/© 08:27, 14 September 2005 (UTC)
there seems to be a new bot in town
This wiki bot seems to have upgraded from attacking just front and the default help page (Help:Contents) to "remembering other pages it has found." By default the bot always tags it victim page and uses a 1px high div tag to hide it's actions.
the tag looks something like these:"[_pw15_]", "[_pw16_]", "[_pw17_]" and the bot has traditionally hit the site four to six times daily.
I did a google on just the tag an found massive numbers of wiki's and with the exeption of a Linux distro's wiki (SuSi if I recall) they all wiki's had been unaware of the attack. Using google to leave a message and remove the spam was too slow as theier were to many wiki and the repeate rate was too high.
FixTheLawco.uk reported a new varient which left all three tags given above as well as this message:
We leave content intact . We allow you to easily remove the additions We respect your pages and appologize for the spam We are the Ethical Spammers group - (this is an oximoron - two terms that are put together but are opposed meaning)
unlike prior uses of this bot they were a lot less offensive: see history
This is a good example of the original flavour: here you can also find stacks more by googleing [_pwxx_] where xx is any number you fancy.
--194.164.38.128 19:39, 5 November 2005 (UTC)
- Thank you very much for reporting this. I'm currently looking over patterns to block this bot on Wikimedia sites but this page still need specific spam reports to be effective. silsor 20:52, 8 November 2005 (UTC)
- Many of these spams are now blocked for people who use this spam blacklist due to addition of drug patterns and some domain hiding services. silsor 20:59, 8 November 2005 (UTC)
I did a little research. You can contact the guy who's doing this on YIM at TheMarketerDude or at themarketerdude@yahoo.com via email. 24.224.153.40 01:40, 13 November 2005 (UTC)
bug
If there's an underscore in the url, the blocker won't catch the url. For example, if you block fiberia\.com, blah_blah.fiberia.com can still get passed the blocker. 24.224.153.40 01:05, 12 November 2005 (UTC)
- Thanks a lot for reporting this. I opened a new bug on the bugzilla here. silsor 05:35, 12 November 2005 (UTC)