Talk: Spam Blacklist

Report a spammer here

The spam blacklist extension is now working on all Wikia. You can request new URLs be added to the filter by listing them here. Please state the IP (or username) used to spam and the wiki it happened on.

Legitimate Links

A few people here are asking about how to get around blacklisting to use a genuine link on a wiki page, just add an html comment in the middle of the url, eg http://yourblockedsite.com gives http://yourblockedsite.com --58.169.242.223 16:34, 29 July 2006 (UTC)

No longer works. :( Paranoid 07:26, 3 August 2006 (UTC)

When to Add to the Blacklist?

Should we add URLs after one instance of a spam attack, or wait for more? Also, I'm not sure how much of the URL is best? Advice please? As a specific example, should I add the two URLs just posted (and already removed) to the Central Wikicity's home page? I don't want to slow the loading of every saved page, but I'd rather not have to clean-up the same URLs again. --CocoaZen 17:50, 2 Jun 2005 (UTC)

It depends what they are and whether they are definitely spam. Something like this is an obvious spam attack, but someone adding one innapropriate URL to a page is often not. If you're unsure, you can also add it temporarily. It might be worth checking Google for other wikis with the spam URL. If +wiki Google: SpamURL.com +wiki has hits, then it should be blacklisted. If an edit adds dozens of different URLs, adding just one of those to the blacklist will normally prevent future attacks since the edits are being made by bots who won't know to just remove the blacklisted URL from their edit. Angela (talk) 00:00, 8 Jun 2005 (UTC)

Checking contribs across wikis

I now have a somewhat buggy script that will check edits across multiple wikis. It doesn't work perfectly, but can be used for finding cases of the same user spamming multiple Wikicities, so please report the username or IP of spammers here as well as links to the diffs where they spammed. Angela (talk) 02:49, 21 Jul 2005 (UTC)

Any chance of an alphanumeric list?

Maybe a one-off extraction as a first port of call? Maybe no value?? (Some of us are a bit ignorant about these things) Robin Patterson 01:40, 1 Sep 2005 (UTC)

Please clarify. An alphanumeric list of what? Are you suggesting that the blacklist be ordered?

That might be a good idea.

If that is what you meant, I'd like to understand the potential benefit. We only add sites when they become problems. After they've been put on the list, they shouldn't be able to be a problem. Is that what you mean? What value do you think it would have? I wouldn't have any problem with it, but don't really want to go to the work of organizing what we have without a reason.

Another potential problem with alphabetizing is that it depends on how much of the url is used. Sometimes we have to make a choice about whether to post xyz.objectionable-site.tla or the more generic objectionable-site.tla that would also cover abc.objectionable-site.com. As you can see, each choice would appear in a different place in an alphabetized list.

Again, it's not that I'm disagreeing with your suggestion, it's just that I don't understand it. Maybe someone else will have a better response. --CocoaZen 02:09, 1 Sep 2005 (UTC)

I don't mind, but I often update the page from the version on Meta, so I don't promise to keep it alphanumeric, but someone else can if they find it useful. Angela (talk) 15:25, 2 Sep 2005 (UTC)

Hydrocodone sites - block all?

There are multiple hydrocodone sites which have been spammed. Would it make sense to blacklist all sites with "hydrocodone."? Normally it would be overkill, and it seems to me that assuming good will works well for most cases, but after multiple violations, I'm proposing this stronger measure. If someone comes up with a non-advertising, legitimate site, we could remove this blanket block. --CocoaZen 03:37, 6 Oct 2005 (UTC)

Yes, blocking all those is fine. Just don't block cialis. I considered doing so before until I realised it"s the middle of the word "socialism" which has legitamate links, especially on the socialism wiki. :) Angela

Wow, that explains some odd looking stuff I've seen elsewhere - just depends if someting can be identified as a delimited word, though the perishers usually mis-spell stuff like that to get though spam filters Ace of Risk

Atspace

Real Life Soap wikicity; porn link spam by 195.16.125.192

I've blocked those 4 subdomains. If atspace.com continues to show nothing but spammy domains, it might be worth blocking them totally. Angela (talk) 06:44, 23 Oct 2005 (UTC)

Blocking IP addresses

I don't know the name of this stupid guy, but he has put thousands porno websites on the first pages of svt.wikicities.com (french wiki on biology) . I already erase his stuff, i hope this kind of people can be blacklisted, even if we don't know his name

IP addresses can be banned (not blacklisted). Any administrator for your Wikicity can do that. Pieces of inappropriate URLs can be blacklisted. This makes it so that no one can save a page with those URLs. I think Angela may have already added ones from this attack, but I'll check and add some, if she hasn't. Thank you for reporting the problem. --CocoaZen 23:11, 23 Oct 2005 (UTC)

Is it not possible to connect the wikis in such a way that when an IP is blocked on one wiki it is autmatically blocked on other wikis ? At least the wikis that share the same subject like MA. -- Q 21:18, 17 May 2006 (UTC)

Fiberia

http://alaska.wikicities.com/index.php?title=Talk:Alaska&diff=0&oldid=528 This one was just a single link to a pharmaceutical. Removed. Blocked.--Doug 06:04, 8 Nov 2005 (UTC)

This was fiberia again, which should be blocked already. Angela (talk) 22:55, 9 Nov 2005 (UTC)

Weird. It's not getting blocked because of the underscore in the url.. – Jello² 00:55, 11 Nov 2005 (UTC)

Reported at MediaWiki bug 3934. Angela (talk)

Creatures Wiki

...

Also 219.93.174.100. Do you blacklits the IP or the site that they link to? If its the link, it is about levitra

I blacklist the URL on all wikis. Individual wikis can blacklist the IP. Angela (talk) 14:16, 3 Dec 2005 (UTC)

It seems to me that there has been a recent influx of spammers signing up accounts with an IP-looking username, like this one: http://creatures.wikia.com/index.php?title=User_talk%3AGreenReaper&diff=26412&oldid=26410 - "User:200.122.153.2"

Can anything be implemented at a Wikia level to curb this kind of spambot? - Malkin 09:42, 23 April 2006 (UTC)

The spam blacklist is meant to curb it. User:200.122.153.2 was an IP, not a username. Angela (talk)

Oops. :$ - Malkin 09:16, 22 June 2006 (UTC)

www.ringtones-dir.com - from this IP: 130.227.200.43 http://creatures.wikia.com/index.php?title=Carrot&diff=prev&oldid=35480 . - Malkin 01:05, 30 June 2006 (UTC)

Added. Cheers --Splarka (talk) 01:18, 30 June 2006 (UTC)

4.nfhtt.info/ , 4.eaeaq.info/ from this IP: 61.135.145.204 no-prescription-drugs.org/ from IP: 219.124.240.37 , hometown.aol.com/kolakq/ 219.124.240.37 hometown.aol.com/fokann/ 211.195.220.53 - All of these can be seen here: http://creatures.wikia.com/index.php?title=Talk:Creatures_Wiki_Homepage&action=history - Malkin 01:29, 1 July 2006 (UTC)

added nfhtt.info eaeaq.info no-prescription-drugs.org hometown.aol.com/fokann --Splarka (talk) 04:23, 1 July 2006 (UTC)

tqgaq.info/ - IP: 222.112.19.180 http://creatures.wikia.com/index.php?title=User_talk%3AGreenReaper&diff=35529&oldid=35528 Thanks :) - Malkin 13:40, 1 July 2006 (UTC)

musicjj.beeplog.com/ - IP: 61.249.27.45 http://creatures.wikia.com/index.php?title=Talk%3ACreatures_Wiki_Homepage&diff=35534&oldid=35533 - Malkin 01:17, 2 July 2006 (UTC)

hometown.aol.com/cup2006fifa/ IP: 85.220.140.68 http://creatures.wikia.com/index.php?title=Talk%3ACreatures_Wiki_Homepage&diff=35741&oldid=35740 - Malkin 13:14, 10 July 2006 (UTC)

tender.masterbell.net/index.php?target=price IP: 83.149.236.103

ooqwe.info/ IP: 200.169.132.122 http://creatures.wikia.com/index.php?title=Talk%3ACreatures_Wiki_Homepage&diff=35787&oldid=35773

ksqww.info/ IP: 125.14.208.227 http://creatures.wikia.com/index.php?title=Talk%3ACreatures_Wiki_Homepage&diff=35920&oldid=35919 - Malkin 09:11, 16 July 2006 (UTC)

Added. Angela (talk) 12:48, 16 July 2006 (UTC)

Alaska (again)

Spam from ip and ip which was first commented with "Problem?" and then on the second edit "Reported vandalism." I didn't know how to use the rollback feature so after a few tries I simply re-edited the last good version and saved it. The vandalism happened on Talk:Alaska, same as the other times. --Doug 03:17, 23 Nov 2005 (UTC)

If you're logged in, you should see a "rollback" link when you look at the user's contributions, or at a diff page. Angela (talk) 14:16, 3 Dec 2005 (UTC)

overzealous spam filter

Reverting the latest vandalism here was troublesome, because of the above link being blacklisted. I tried to enclose it in tags so it doesn't register on the spam filter but had to end up breaking the link. This may need to be looked into at some point. nae'blis _(talk) 19:28, 14 Dec 2005 (UTC)

I think it's useful that the spam is blocked even on talk pages like this. It's easy enough to just type lucky.to without the preceeding http:// that makes it a link. --Angela (talk) 23:33, 15 Dec 2005 (UTC)

netfirms.com

Please remove this URL from the blacklist, or change it to at least exclude "supernovawd.netfirms.com" before running this script on Memory Alpha/en again. The subdomain specified above belongs to a MA contributor and should not be considered spam. See also Memoryalpha:User talk:Spam cleanup script. Thanks. -- Memoryalpha:User:Cid Highwind)

netfirms isn't currently blocked. Angela (talk)

Removing Domains

Hello, there. I'm having some trouble with the blacklist. It seems you have added certain domains which are owned by dyndns.org which a lot of people use. Domains like is-a-geek.com and kicks-ass.net. This block is preventing me from listing my personal website in my Wikifur article. Can someone help me out?

See Spam cleanup script. The easiest way is to use a tinyurl.com link instead of the kicks-ass one. Angela (talk) 09:10, 22 January 2006 (UTC)

I'm actually using is-a-geek.com, not kicks-ass.net, which I noticed was removed from the block list. Any way is-a-geek removed, as well? Threyon (talk)

There are far too many subdomains of is-a-geek that are being spammed. I think this one should stay in. I suggest you move to a web host that doesn't permit spammers. Angela (talk)

narod.ru

On my wikicity, I have a legitimate need to link to a legitimate site hosted on narod.ru. The Spam cleanup script keeps deleting the entire contents of the page (not just the link to a blacklisted domain). FIX THIS BUG! The wikicity is at [1] and the page is at [2] --Lowland Boxman 19:00, 8 February 2006 (UTC)

Lowland Boxman - It's not a bug; it's a feature. ;-)

Ok, I just had to say that.

This sounds like what the spam blacklist is supposed to do. When someone tries to post content with the blacklisted domain, in this case "narod . ru", the post will not be saved. It should not be blanking other content. If it is, that is a bug. If you need to link to that domain, maybe we can be more specific about what parts of it are blocked.

--CocoaZen 02:08, 9 February 2006 (UTC)

More...

I just checked the page you referred to, and the spam clean-up program did what it should. On the first pass through, it took the page back to the edit before the first time that domain was added. Then you added back all that content, including the site that it recognizes as spam, so it just removed it again.

In order to keep that content on your page, I think the spam list needs to be adjusted. If spam has come from too many sub-sites in that domain, I don't know what the decision will be. Maybe the program can be adjusted to allow for an exception for the sub-site of "skomorokhi . narod . ru", if no spam has been posted to the sub-site. --CocoaZen 02:20, 9 February 2006 (UTC)

The [3] page also needs to link to narod.ru. narod.ru is a popular free hosting service in Russia and most of the sites there are legitimate. Blacklisting the whole second-level domain just because a few spammers used it is a bad decision. Paranoid 05:16, 9 February 2006 (UTC)

Until a compromise can be found, you can just put in the text of the domain. Eg, you can just put in a <nowiki>www.narod.ru</nowiki> entry, that isn't stopped by the blacklist (The blacklist only stops links, as spammers must link to get google ranking points). Splarka 05:46, 9 February 2006 (UTC)

I tried enclosing the link within <nowiki></nowiki>, but when I tried to save, I got:

Spam protection filter

The page you wanted to save was blocked by the spam filter. This is probably caused :by a link to an external site.

The following text is what triggered our spam filter: http:// skomorokhi . narod . :ru

In fact, I had to insert those spaces around the dots in order to mention it on this talk page! --Lowland Boxman 19:01, 9 February 2006 (UTC)

As I said, leave off the http:// and it works: skomorokhi.narod.ru Splarka 22:06, 9 February 2006 (UTC)

That's not exactly what you said; you said to enclose it in <nowiki></nowiki> tags. The "http://" inside <nowiki></nowiki>tags is not a link! Anyway, it's worked-around now. BTW, do we have logs of the Spam cleanup script's activity to determine which subdomains of narod.ru the real spammers are using? If it's just a few, they should be explicitly added to the blacklist and narod.ru should be removed. --Lowland Boxman 22:38, 10 February 2006 (UTC)

I said you can just put in the text of the domain and The blacklist only stops links. http:// prefixed to an address (making a URI) is a link, even if it is wrapped in <nowiki>. I said (or demonstrated actually) that all you had to do was wrap only the address in nowiki to show it. My error was in assuming you knew that meant to leave off the http://. I said enclose it meaning (and showing even) just the address, not the link. Splarka 23:54, 10 February 2006 (UTC)

PS: You'll have to ask Tim or Angela as to the extent of the abuse of that domain, but it has appeared on several wikicities (see above). 221.3.235.96 and 202.58.85.8 only spammed with best-windows2005.narod.ru here at central, but I can't easily check all ~800 other wikicities myself. If that was the only domain, it would probably be ok to edit the entry. Splarka 23:54, 10 February 2006 (UTC)

There are 50,000 potentially spammed wiki pages with narod.ru on them [4]. Please host your sites somewhere that does not support spammers in this way. The level of spam from narod.ru is completely unacceptable. There are hundreds of alternative hosts that are better at removing these spam domains. Angela (talk) 23:59, 10 February 2006 (UTC)

If it were my site to host, I would host it elsewhere. I'm just trying to link to it because it had some relevant information. http://inside.nowikitags.is.not.a.link --Lowland Boxman 14:52, 13 February 2006 (UTC)

You can link to it using a tinyurl instead. Angela (talk)

Legitimate site blocked

An apparently legitimate site was blocked from Muppet Wiki by the spam cleanup script. I can't actually post the link here, because it'll be blocked, so I'll post it in pieces: http: // e. domain dlx. com/jerrynelson/. "Domain dlx.com" is on the spam blacklist, but the site is legitimate. Is there anything that can be done about that, or is just bad luck that that website is being hosted on a domain where people are spamming from? -- Danny Toughpigs 15:50, 24 February 2006 (UTC)

The spam blacklist only blocks posting embedded links. You can just report bad domains by omitting the http://, eg: e.domaindlx.com/jerrynelson/ .... that domain was added by Angela, and it seems to be a common spam domain on wikis [5] under several prefixes (k. ccc. www.cc. users. etc). It probably should not be removed. Splarka 03:00, 25 February 2006 (UTC)

I'll try just blocking some subdomains of it and see how problematic it is. Please report any new subdomains that are spammed. Angela (talk) 07:36, 27 February 2006 (UTC)

That helped, thanks! -- Danny Toughpigs 16:12, 28 February 2006 (UTC)

80.77.82.216

Hosting spam here -- Scarecroe 21:44, 28 February 2006 (UTC)

As they aren't being put in as embedded links they can't be blacklisted. :/ Splarka 22:18, 28 February 2006 (UTC)

They can now. Please let me know and I can add them to $wgspamregex in default settings. Angela (talk) 14:52, 5 April 2006 (UTC)

March 6, L5R Wiki

We're getting hit repeatedly today. So far, IPs 24.191.96.110, 69.132.38.151, 64.184.59.173, 69.246.172.124, and 67.160.111.204. Just so people know. --~WestonWyse ^! 17:10, 6 March 2006 (UTC)

In the future, be sure to let us know what urls they are spamming (omit the http). Splarka 03:39, 7 March 2006 (UTC)

Horrid spammer/vandal at Radio Control

Just placed a perma-whammy on User:Y♥Θ⌠VΓ&åV5*3Σl╒$Ω■∩ at the R/C wiki. Hang on and I'll be right back with the link he put on one of the articles. - Lucky 6.9 05:07, 26 March 2006 (UTC)

The idiot tried linking to a picture that (mercifully) he didn't take the time to upload. Picture was xxx-anal-porn-again.jpg. - Lucky 6.9 05:09, 26 March 2006 (UTC)

If this happens with the same file name again, let me know and I can add the phrase to the $wgspamregex (which is on the server and blocks words, not just URLs). Angela (talk) 14:52, 5 April 2006 (UTC)

The blanker strikes again: Petdiabetes wiki

These IPs <snip>

Thanks, and I hope I didn't include any innocent friends in the list. --Steve and Jock 14:56, 26 March 2006 (UTC)

Thanks for reporting all those IPs. It makes it very easy for me to check for pages they've blanked on other Wikia. Angela (talk) 14:52, 5 April 2006 (UTC)

Similar to page blanking on sca21?

I was looking around to see if could get any more advice about spates of vandalism to sustainable community action wiki when saw this, and found one same ip address used to vandalise both sca and the above wiki (only looked through about 5 addresses). We've had 6 sets of vandalsim since 6 March, and seemingly getting a little more frequent. Typically 14 to 17 different IP addresses delete most of (except first few characters) of about 15 - 20 pages. Wondered if anything more could be done about this? perhaps along the lines suggested on Community portal#Petdiabetes too? Or is there some way of / any point in blocking all the known addresses to all wikis? Philralph 18:10, 26 March 2006 (UTC)

They change IP almost every time, so blocking wouldn't help much. I think implementing captchas for some wikis would be a good thing to try out, once we've upgraded to MediaWiki 1.6. Angela (talk) 14:52, 5 April 2006 (UTC)

Several new spammers at Radio Control

Ladies and gentlemen, four more IP's for your pleasure, now blocked for spamming.

67.83.143.58
71.128.213.118
198.53.37.235
24.6.23.1

A couple more Comcast addresses are among this august group. Is it time to start blocking these ranges? - Lucky 6.9 18:49, 26 March 2006 (UTC)

It's up to individual wikis whether they want to block ranges, but I'd rather try softer approaches, like using captchas. Angela (talk) 14:52, 5 April 2006 (UTC)

Petitiononline.com

I met the director of PetitionOnline today, and as I was listening to his talk I realised where I'd heard of petitiononline.com before... in this blacklist. It's a genuine site, not a spam site, but because they host so many petitions, there are going to be some people who spam sites in an attempt to get more votes on their petition. Kevin Matthews assured me they do act to remove problem sites if they know about them, so I'm going to try removing this from the blacklist. If there is any more wikispam linking to this site, please report the individual subdomains here so that those can be both blacklisted and reported to their site.Angela (talk) 06:27, 11 April 2006 (UTC)

LouisVuitton Site Blocked

I've blocked the louisvuittonreplica site after a third vandalism attack. They occurred over a period of a few months; all posted by an IP beginning with 80.68. I hope that will be enough to stop it, but in case they try to continue, some of the other urls are (http:// is removed so they won't be links) louisvuittonpurses.blogs.eurosport.com, louisvuittonbags.blogs.eurosport.com, louisvuittonreplica.blogs.eurosport.com, fakelouisvuitton.blog. If there's a better way to block these, please improve the block. (I figured blocks.eurosport would be too broad?) --CocoaZen 22:50, 30 April 2006 (UTC)

div-spammer

There is a pattern in latest spam. All URLs were within tags like <div style="overflow:auto;height:1px;">. And can't we train the spam-detector to be smart enough to recognise about 20+ external URLs in a row to be spam? We are one step behind if we define each URL one after the other although there is other evidence. — Florian™ ^talk 01:56, 21 May 2006 (UTC)

All divs seem to contain the text "Excuse for my post but I do not have money to buy meal to my children. Forgive me please." Maybe a check on some words to block the poster ? -- Q 14:41, 4 June 2006 (UTC)

This particular spammer seems to use bot-nets and hijacked computers to have a distributed spam-attack on random pages. Please do something clever to stop it! This spammer was successful for nearly a dozen of times until we blocked his URLs. It would be smater to have a logic like number of URLs per edit on anonymous users. Maybe this spammer used a distinct use-agent for requests (see apache-log). And, like Q says, it's always the same sad excuse for beeing an a..hole. — Florian™ ^talk 15:46, 4 June 2006 (UTC)

User: Fuckface

For his attacks on the Star Wars Fanon wiki on virtually everryone. I would like to have him banned. MaulYoda 20:53, 30 May 2006 (UTC)

The Spam Blacklist is only for blocking spammed links, and won't do anything to stop a page move vandal. I've pokled some staff to have him blocked. Splarka 21:27, 30 May 2006 (UTC)

Those can now be reported at Cross wiki user blocks. Angela (talk)

cygnus-x1.net

Spamming Memory Alpha for a long time from various IPs. Jaz 19:59, 4 June 2006 (UTC)

Added. Angela (talk) 22:23, 4 June 2006 (UTC)

There seem to be a lot of false positives for this. Are you sure that site isn't wanted on Memory Alpha? Angela (talk) 02:49, 17 June 2006 (UTC)

Another request

perso.wanadoo.es, from IP address 89.0.34.10 on Wookieepedia. —Silly Dan _(talk) 10:59, 10 June 2006 (UTC)

Added. Szoferka 11:01, 10 June 2006 (UTC)

I'm not sure about this one. I ran the spam cleanup script today and there were a lot of false positives. Genuine users seem to be linking to that site quite a lot. Are you sure it's worth blacklisting it? Angela (talk) 05:07, 17 June 2006 (UTC)

194.164.78.173

Came, created a random page "Bypass Steam", and added this link http://www.mgforums.com/forums/showthread.php?t=33001 to the HowTo Wiki

Inyuki 15:53, 12 June 2006 (UTC)

This seems like a one off, so I shan't blacklist it yet since it could have been a confused newbie rather than a spammer. Angela (talk) 05:08, 17 June 2006 (UTC)

130.126.37.246

Came to HowTo Wiki, and added a line "This is a silly, useless, bad joke of a stub" the talk page http://en.howto.wikia.com/wiki/Talk:How_to_create_Heavy_water without adding any other reference.

Inyuki 15:57, 12 June 2006 (UTC)

That isn't spam. Spam means external links being added, usually by bots, in an attempt to increase the page rank of their own sites in Google. This just seems like someone giving an opinion. Angela (talk) 05:10, 17 June 2006 (UTC)

Jotspot

vse-ok\.jot\.com

A bunch of different spam addresses from this domain, posted by 64.190.54.194 on Muppet Wiki. Thanks! -- Danny (talk) 13:19, 16 June 2006 (UTC)

Added. Szoferka 13:49, 16 June 2006 (UTC)

dir1\.jot\.com

posted by 213.113.123.15 on Muppet Wiki. -- Danny (talk) 19:01, 16 June 2006 (UTC)

Added. Szoferka 19:14, 16 June 2006 (UTC)

Unfortunately, I've had to block the whole of jot.com for now. I contacted their customer service who just told me they'd delete spam sites they knew about, but they don't appear to be monitoring new wikis quickly enough to see if they are spam. Almost all the spam over the last 2 days has come from jot.com, including these domains:

fortop\.jot\.com lastt\.jot\.com vse-ok\.jot\.com podarki-prishli\.jot\.com valium\.jot\.com levitra\.jot\.com dir1\.jot\.com hochu\.jot\.com mymedia\.jot\.com xenical\.jot\.com brin-durak\.jot\.com

Jimbo Wales has contacted their founder about it, but I'd suggest leaving the whole site blocked for now until these attacks die down. Angela (talk) 05:14, 17 June 2006 (UTC)

I lost my account because of spammer!!!!

First he said me,i took my father's creditcard,help me and be p2p.he wanted me password and log in name pf mine.and he changed my password :(((((( please help me his user name is:paogiver

There is no user on Wikia with that username. Are you sure you're talking about this site? Angela (talk) 05:35, 22 June 2006 (UTC)

yandex.ru

Why is Yandex blacklisted? This is one of the most popular search engines for Russian-speaking users. Please delete this from list. Edward Chernenko^{o a} 11:20, 24 June 2006 (UTC)

It's been removed now, so feel free to revert the removal of it on your wiki. Angela (talk) 11:35, 24 June 2006 (UTC)

Possible Bots

IP Numbers--Diabetes in Pets Wiki

211.205.186.190

222.53.117.168

24.129.219.161

219.93.174.102

The hits seem to be random pages and are numeric spam. Pages are:

http://petdiabetes.wikia.com/wiki/Diabetes_in_Pets:Community_Portal (2)

http://petdiabetes.wikia.com/wiki/Talk:Main_Page(2)

http://petdiabetes.wikia.com/wiki/User:67.15.179.13 (1)

IPs trace to Asia (3) & US respectively. No idea what the significance of the numbers is.

We hope 03:48, 25 June 2006 (UTC)

Take a look at Forum:String of numbers type vandalism; there are two ideas about what these numbers are. Szoferka 03:51, 25 June 2006 (UTC)

All 24 digit numbers are now blocked in globalsettings.php, which should prevent this for now. Please let me know if they start using a different string length. Angela (talk) 07:26, 25 June 2006 (UTC)

got this 23 digit number:

http://peace.wikia.com/index.php?title=WikiNode&curid=678&diff=10394&oldid=10207

8 7 1 0 9 4 7 1 7 7 9 1 7 3 3 0 6 6 1 6 1 7 5

from 211.205.186.190

(had to put a space between the digits or the spam filter stops it ...

apparent the first 20 digits trigger it. ???)

-ts-^talk 23:49, 25 June 2006 (UTC)

Yes, I found another 23 digit one yesterday so I knocked the limit down to 20. Let me know if anything shorter than that comes up. Angela (talk) 03:17, 26 June 2006 (UTC)

Luke Skywalker

The Luke Skywalker entry seems to have been sabotaged. The article has been replaced with text like:

$$$_-<JUMBOCHICKEN BITCH!>-_$$$ $$$_-<JUMBOCHICKEN BITCH!>-_$$$ $$$_-<JUMBOCHICKEN BITCH!>-_$$$ $$$_-<JUMBOCHICKEN BITCH!>-_$$$ $$$_-<JUMBOCHICKEN BITCH!>-_$$$ $$$_-<JUMBOCHICKEN BITCH!>-_$$$

Thank you for your assistance.

Han Solo

The Han Solo page also appears to have been sabotaged.

Oh, what wiki do you came from? Szoferka 15:26, 28 June 2006 (UTC)

Creatures Wiki (again)

cilik.blox.pl here ...Talk:Creatures_Wiki_Homepage&oldid=35536 by 203.158.215.2

That's in the blacklist now. Angela (talk) 09:04, 3 July 2006 (UTC)

aabbccdd.org

Currently blocking org domains with 4 sets of 2 letters using:

(aa|bb|cc|dd|ee|ff|gg|hh|ii|jj|kk|ll|mm|nn|oo|pp|qq|rr|ss|tt|uu|vv|ww|xx|yy|zz){4}\.org

Tried ((\w)\2){4}\.org but the blacklist didn't seem to like it. --Splarka (talk) 00:48, 4 July 2006 (UTC)

Viagra spam

We got four pages with Viagra spam this morning... Thanks! -- Danny (talk) 12:24, 11 July 2006 (UTC)

All rox.pl should be blocked already. Szoferka 12:27, 11 July 2006 (UTC)

Creatures wiki

http://creatures.wikia.com/index.php?title=Talk%3ACreatures_Wiki_Homepage&diff=35832&oldid=35831 - new URL, not one we've seen before. Same exact type of bot and behavior though. ElasticMuffin 14:12, 14 July 2006 (UTC)

I'll add it to the blacklist. Angela (talk) 14:17, 14 July 2006 (UTC)

Ringtones spam

On Wookieepedia, from 80.134.0.27 : free-ringtone\.ifrance\.com —Silly Dan _(talk) 02:32, 15 July 2006 (UTC)

I'll add that now. Angela (talk) 05:03, 15 July 2006 (UTC)

na-hummer.jot.com

I got some porn spam on Muppet Wiki -- here's the link... Thanks! -- Danny (talk) 17:13, 15 July 2006 (UTC)

Already listed, but thanks for reporting it. I've also contacted jot.com suggesting they remove the site. Angela (talk) 17:15, 15 July 2006 (UTC)

hometown.aol.com

http://creatures.wikia.com/index.php?title=Talk:Creatures_Wiki_Homepage&curid=56&diff=35895&oldid=35840 - I think this is not the first time we've got hometown.aol.com ones that also contain 'viagra'. ElasticMuffin 01:54, 16 July 2006 (UTC)

hometown.aol.com was blocked before and there were a huge number of false positives. I had to revert the spam cleanup script on dozens of wikis. I've blocked hometown.aol.com/viagriu instead. Angela (talk) 06:09, 16 July 2006 (UTC)

Another one just a little bit ago, except it's hometown.aol.com/pharmacevt. Maybe hometown.aol.com/*pharm*/ or similar? ElasticMuffin 20:01, 19 July 2006 (UTC)

Added. Angela (talk) 08:02, 20 July 2006 (UTC)

pictures.1ebalo.org

Currently spamming Memory-alpha EN and NL. Spam contains links to pictures which starts with 'pictures.1ebalo.org' -- Q

Added. Angela (talk) 12:48, 16 July 2006 (UTC)

More Creatures spam

A new batch of linkspam on Creatures wiki, this time mywebpage.netscape.com/WowVia/* (the * representing several things like cheap-viagara.htm and the like). Here's an example diff. ElasticMuffin 20:26, 24 July 2006 (UTC) Also, more from this morning that I just noticed, all from tramadol.tfitj.info/*. ElasticMuffin 20:42, 24 July 2006 (UTC)

Both of those are added now. Angela (talk) 13:06, 25 July 2006 (UTC)

And another from mywebpage.netscape.com. The poor main talk page is taking a beating. :( ElasticMuffin 12:43, 26 July 2006 (UTC)

Thanks. I've added mywebpage.netscape.com/vicodyoury. Angela (talk) 13:02, 26 July 2006 (UTC)

Hi, we had another one yesterday. ElasticMuffin 12:47, 31 July 2006 (UTC)

And another just now. ElasticMuffin 13:02, 31 July 2006 (UTC)

Alternative History

IP: 66.135.34.11 has been putting spam on Althistory. Louisiannan 23:30, 27 July 2006 (UTC)

Strange he can, this url is already blocked. Szoferka 23:37, 27 July 2006 (UTC)

Looks like it was added there about 1 hour before being blacklisted: [6] [7]. --Splarka (talk) 02:43, 28 July 2006 (UTC)

Oh, right. Szoferka 02:52, 28 July 2006 (UTC)

Chechnya spam on Wookieepedia

From user:202.107.241.198: created a spam article with links to basayev\.in41\.ws, apparently something to do with Chechnya. —Silly Dan _(talk) 01:18, 1 August 2006 (UTC)

Blacklisted \.in41\.ws, probable spam host. --Splarka (talk) 01:42, 1 August 2006 (UTC)

Another good site blocked

http:// web.archive.org/web/20040212142552/http:// www.anzwers.org/free/tech/movies.html

Spam filter creates too many problems as it is. There should be ways to whitelist certain URLs for wiki admins. And the damn page that is shown when a suspicious link is added doesn't even link to any relevant pages explaining what the blacklist is. Paranoid 07:34, 3 August 2006 (UTC)

The whitelist problem has been addressed on MediaWiki. We should have MediaWiki:Spam-whitelist messages in the next upgrade (see Wikipedia:MediaWiki:Spam-whitelist for example). --Splarka (talk) 08:05, 3 August 2006 (UTC)

More spam on Wookieepedia

www\.trade-soft\.biz, from User:84.19.185.156. —Silly Dan _(talk) 18:21, 3 August 2006 (UTC)

Psych spam on Uncyc.

From the URL: 1new43\.1kioskoo\.org through multiple IP proxies. All spammer links contain the word "Psychology" or "Psychiatrist"--Flammable 18:30, 3 August 2006 (UTC)

More Uncyc Spam

All spam contains one of the following urls:

http://*.1oblyaoo.org/
http://*.1mandaoi.org
http://*.1lisokoo.org

The spam has come from multiple spam proxies. More updates as events warrant. Hinoa 18:39, 3 August 2006 (UTC)