Talk:Spam blacklist/Archives/2008-09

Add topic
Active discussions

Proposed additions

  This section is for completed requests that a website be blacklisted

porno-izlee.com





Just 2 links until now, but I believe he is just beginning to add them, I put him on our bl. Best regards, --birdy geimfyglið (:> )=| 23:06, 13 August 2008 (UTC)

This can stay, I think.   Logged  — Mike.lifeguard | @en.wb 19:45, 15 August 2008 (UTC)

People may want to look into other things on the same server:

  • Top 10 domains on server porno-izlee.com (67.159.45.5): deniztube.com (153), mynewhaircut.net (52), ghanaclips.com (13), turkishi.com (7), youtubecity.net (6), DenizTube.com (5), porno-izlee.com (4), redindir.com (4), faveladodarocinha.com (3), 911researchers.com (2)








  • Top 10 editors who have added deniztube.com: 85.99.214.79 (108), 88.228.40.137 (10), 78.169.38.36 (8), 88.228.18.253 (7), LovelessGent (5), 78.169.46.60 (4), 85.99.215.176 (3), 78.169.48.172 (2), 88.228.36.165 (2), 88.228.37.67 (2).
























The top one has 108 linkadditions, and a range of wikis.

Seems to lead even further, ghanaclips.com has a different set of IP users (in a 41.210 range and some others), but that seems en only (but where did I see kokoliko.com recently).



















....

I need help to prune this out completely. --Dirk Beetstra T C (en: U, T) 17:16, 18 August 2008 (UTC)

Just a quick look, but I think the following could be added:
  • deniztube.com
  • youtube53.com
  • youtubecity.net
  • kokoliko.com
 — Mike.lifeguard | @en.wb 01:55, 29 August 2008 (UTC)

  Added  — Mike.lifeguard | @en.wb 13:40, 31 August 2008 (UTC)

legalmenu.com



Spammers




See WikiProject Spam item (permanent link). MER-C 12:54, 25 August 2008 (UTC)

  Added. --Erwin(85) 13:36, 26 August 2008 (UTC)

A Polish redirect site



Appears to have been used by Web-anatomy today: [1], from



  • The current uses might be legitimate.

--AVRS 15:24, 25 August 2008 (UTC)

Again: [2]



--AVRS 16:52, 25 August 2008 (UTC)

  Added and cleaned the main namespaces. --Erwin(85) 09:23, 26 August 2008 (UTC)

Suspicious site



An user reported that it might contain malware such trojan horses. Reported on the es-wiki.

--Dferg (talk) 19:53, 27 August 2008 (UTC)

No details here, and I don't see anything at the site itself.   Not done unless we know it is really malware.  — Mike.lifeguard | @en.wb 02:00, 29 August 2008 (UTC)

bfcoffgeorgebush-yu.Blogspot.Com

Seems to be a new spambot activity: seen here IP was:






I have not yet blocked the IP because I fear they will use multiple ones I already added the site to the bl. Maybe it should be removed later again, thanks, --birdy geimfyglið (:> )=| 13:53, 28 August 2008 (UTC)

i shortend and fixed the entry. "\b" matches a word boundary. -- seth 15:05, 28 August 2008 (UTC)
  Logged - this can stay blacklisted (& seems to contain malware?!)  — Mike.lifeguard | @en.wb 01:45, 29 August 2008 (UTC)

Affiliate spam










Contributions User:Tor sk.wikipedia

Only in 3 Wikipedias that I know, but I can not see how these links can ever be of any benefit to a Wikimedia wiki.

--Jorunn 14:44, 31 August 2008 (UTC)

  Added whole domains as above.  — Mike.lifeguard | @en.wb 14:50, 31 August 2008 (UTC)

sexyunderwear-weddingdress spam

Spam domains







Spam accounts




--A. B. (talk) 21:44, 2 September 2008 (UTC)

  Added & thanks again, A. B.  — Mike.lifeguard | @en.wb 00:30, 3 September 2008 (UTC)

Luna Musik Management, Guzman Construction

Spam domains







Spam account




Alemannic is certainly an odd choice of languages to spam; I suspect he chose it because it was at the top of the list of cross-wiki links for the en:Hip Hop article and then got interrupted.


Reference

--A. B. (talk) 16:22, 3 September 2008 (UTC)

  Added. Best to catch things early & these are not useful to our projects.  — Mike.lifeguard | @en.wb 21:22, 3 September 2008 (UTC)

seoloji.org spam

Spam domains























Spam accounts






--A. B. (talk) 02:48, 5 September 2008 (UTC)

  Added. Thanks. --Erwin(85) 08:31, 5 September 2008 (UTC)


Additional seoloji.org spam

I looked at the spam domains above a bit closer using the WhosOnMyServer tool. Several domains were hosted by commercial web-hosting services and their servers contain hundreds of unrelated domains. I did, however, identify one German server, 89.149.226.124, with a cluster of the spam domains above plus a few other Turkish domains. About half of those domains turned out to be related to the domains I reported above and several had also been spammed:

Also spammed









Other related domains

































Additional spam account


--A. B. (talk) 18:25, 5 September 2008 (UTC)

  Added the spammed ones.  — Mike.lifeguard | talk 18:03, 6 September 2008 (UTC)

Cosmoetica.com



See [3] and [4], a sockfarm of users all adding links to work by Dan Schneider, mostly from his website cosmoetica.com. 120 links cleaned from enWP and a number from other wikis (I'm on it but it's slow as I have to cross-check who added them). Where the links are added by anons, it is a stable subnet. Definitely a candidate for blacklisting on enWP and probably a candidate for meta blacklisting due to cross-wiki issues, albeit fairly limited by comparison wiht the extensive enWP abuse. JzG 21:54, 1 September 2008 (UTC)

Is this really something we want to be linking to regardless of who added it? Furthermore, it seems from the links you've provided that several domains are involved. Has blacklisting been discussed on enwiki yet?  — Mike.lifeguard | @en.wb 18:22, 2 September 2008 (UTC)
Yes, it's now blacklisted on enWP (and one of Schneider's socks promptly requested whitelisting). The list of socks is up to about 40 now [5], but primarily an enWP issue. Still, there is some cross-wiki activity and the guy is very determined to use Wikipedia to make his the "The Most Widely Read Interview Series In Internet History!" - to which I cynically respond: {{fact}}. JzG 18:05, 4 September 2008 (UTC)
  Added  — Mike.lifeguard | talk 16:37, 7 September 2008 (UTC)

Franchising spam

{{linksummary|fai.co.in}} {{linksummary|franchise.org.au}} Per luxo:85.121.14.131 and Cross-wiki vandalism report. Perhaps a tad stale. The IP has been reverted since then.  — Mike.lifeguard | talk 14:17, 4 September 2008 (UTC)

In his contributions I see spamming of




and not the domains you mentioned. Blacklist those? --Erwin(85) 08:40, 5 September 2008 (UTC)
Yes... Now to find out who is spamming those domains.  — Mike.lifeguard | talk 11:21, 5 September 2008 (UTC)
Sorry, no useful data in my database .. --Dirk Beetstra T C (en: U, T) 11:24, 5 September 2008 (UTC)

  Added. --Erwin(85) 11:39, 6 September 2008 (UTC)

ara-bux.com





Please see [6]. (Blocked at Commons) Cirt (talk) 09:55, 5 September 2008 (UTC)

  Added. Thanks. --Erwin(85) 10:00, 5 September 2008 (UTC)
Oh I think the domain is ara-bux.com, not bara... Cirt (talk) 10:01, 5 September 2008 (UTC)
\b is a special character in regex. It's used to make sure that e.g. \bbar\.com\b matches the spam domain bar.com, but not the good domain foobar.com. --Erwin(85) 10:12, 5 September 2008 (UTC)
Ah okay thank you. Cirt (talk) 10:27, 5 September 2008 (UTC)

Redirect domain

We should add \bnig\.gr\b  — Mike.lifeguard | talk 01:27, 15 September 2008 (UTC)

Is/was it used on any wikipedia? -- seth 06:46, 15 September 2008 (UTC)
  Added. I don't think there's a need for it to be used before blacklisting. It should never be used. I've added it to the bottom of the list. Do we still use # URL shorteners? Or any other section? --Erwin(85) 18:49, 15 September 2008 (UTC)
Well, if there's no need for links to be used before blacklisting, we could directly blacklist about 1 million websites (ad stuff, porn stuff, ...), what would probably become a problem of performance. -- seth 20:09, 15 September 2008 (UTC)
All url shorteners / redirectors are blacklisted by default, otherwise they can be used to bypass the blacklist. JzG 16:21, 22 September 2008 (UTC)

crosswiki spam







--Shizhao 02:15, 18 September 2008 (UTC)



in deleted contribs on Commons too.   Added all 3.  — Mike.lifeguard | talk 17:49, 18 September 2008 (UTC)

football-talents.org



















Already locally blocked on wiki-de (the german one). MoiraMoira 07:35, 19 September 2008 (UTC)

  Added. --Erwin(85) 08:58, 20 September 2008 (UTC)

URL shorteners











  •   Added as uncontroversial. useurl was being used to bypass the blacklist on en, memurl was used to bypass the blacklist on pt. Not sure about the others. JzG 12:57, 22 September 2008 (UTC)
  • (Likely) misused is memurl.com (see COIBot report), useurl.us was used only once, the other three are not used as far as I can see (bot-downtime and before start I can't see .. yet). --Dirk Beetstra T C (en: U, T) 10:56, 23 September 2008 (UTC)
Links which are not used (for spamming) should not be blacklisted imho, because otherwise we could easily increase the number of blacklisted domains by thousands. This will would lead to nothing but a speed-down. -- seth 15:36, 23 September 2008 (UTC)
Seth, redirects and url shorteners are always added, uncontroversially, because otherwise they can be used to bypass the blacklist. If the blacklist gets too ig it won't be because of a few tens of redirect sites. Many of the ones on the list I linked are already linked anyway. And actually I think all of these had at least one link somewhere which was bypassing a blacklisted domain or linking a domain which should have been linked direct. JzG 22:42, 23 September 2008 (UTC)
We (c/sh)ould set up a list of these, as it would be nice to know when they get abused (as with the blacklist, also my bots would run into problems keeping an eye on all of them .. I am slowly running into that limit with them). I do believe that these should NEVER be used (as opposed to porn/other commercial stuff, where, if notable (now or in the future), there may be proper use of it. --Dirk Beetstra T C (en: U, T) 15:55, 23 September 2008 (UTC)

wikio.com





commercial news site spammed wikiwide. This morning crosswiki on Silvio BerlusconiMoiraMoira 07:38, 19 September 2008 (UTC)

Is dynamic address from Italy, tomorrow 151.30.24.255 replaced all the linkspam I removed - see here MoiraMoira 08:08, 20 September 2008 (UTC)
I many IP ranges (Matucana (49), 80.200.248.206 (40), 80.200.248.203 (21), 80.200.248.201 (21), 80.200.248.207 (20), 80.200.248.200 (12), 151.30.30.144 (11), 80.200.248.204 (9), 151.30.24.255 (8), 84.253.141.209 (6)) and one account. This does not look good. All to the page of Silvio Berlusconi, and seen that there are many reports per language, nowhere wanted.
Consider   Added. --Dirk Beetstra T C (en: U, T) 08:36, 20 September 2008 (UTC)
There may be useful content here as well, but as the majority of the links is 'pushed' to Silvio Berlusconi, I'd keep it here until it gets questioned .. --Dirk Beetstra T C (en: U, T) 08:50, 20 September 2008 (UTC)

snopes.com

The following discussion is closed.


This is a commentary and opinion website, not based on any sort of research, but is basically a resource for people looking up urban legends. Although the site owners have a long history of supposedly investigating the claims of hearsay, jokes, and legends, it is largely driven by what amounts to yet another unverified source. The reason for the blacklist is that at first glance the site appears like an authority on any number of late-breaking legends, where in reality it is just a veiled opinion of the author(s) on whatever the topic might be. In short, the site appears to be an encyclopedia of urban legends, but it is in fact a mixture of comedy, opinion, hearsay, and legend itself. This puts it in the same category as a number of self-published blogs. Uruiamme 21:17, 20 September 2008 (UTC)

It's hardly an unreliable source. The site owners use other sources for their work, that's normally listed at the end of an article. Has this been spammed anywhere? I don't believe the owners make a profit from the site, and it only runs adverts to keep it going. Stuff should only be put on this list if it's actually spammed. Majorly talk 21:21, 20 September 2008 (UTC)
  •   Declined, no evidence of spamming, stated reason is out of scope for this blacklist absent evidence of abuse. That and the inconvenient fact that Snopes is probably the most widely trusted urban legend reference. JzG 11:37, 21 September 2008 (UTC)
I hardly thought that this would be given such a cursory look. I know that the snopes.com people are reputable, but my point was that they are neither peer reviewed nor unbiased. The people who run many blogs are reputable, so that seems hardly much of a positive. But that is not my main contention. The main issue is that there is at least one area of self-published content available on the forums there, which surely you aren't implying has the same reputation as the portion full of site-owner content? In other words, it is rife with the typical forum/blogging things, and it does have its own sub domain. I assumed someone might independently discover that. Uruiamme 05:15, 22 September 2008 (UTC)
Please read the header above. This list is for controlling abusive linking of websites, not to enforce one side's view in a dispute over the reliability of a certain source. Feel free to bring this up on the talk pages for the articles where you believe the link is being incorrectly used. JzG 12:44, 22 September 2008 (UTC)
  Not done per JzG.  — Mike.lifeguard | talk 19:29, 22 September 2008 (UTC)

Merlin Wikia

On the English Wikipedia site an IP user 82.42.175.146, has been adding spam links to www.merlin.wikia.com I propose that this link get's blacklisted as the IP user had posted it to several user talkpages, which goes against the Wikipedia Policies. Dark Mage 18:25, 21 September 2008 (UTC)

If this is a problem only on en.wikipedia it should be dealt with on the local blacklist en:MediaWiki talk:Spam-blacklist. This blacklist is for spam across many wikis.
Any Wikia wiki can be linked to with interwikis, so a blacklisting of merlin.wikia.com will be very easy to outflank. --Jorunn 09:11, 22 September 2008 (UTC)
I actually don't see any linkadditions to merlin.wikia.com/by 82.42.175.146 (so maybe it is already used as an interwiki?). --Dirk Beetstra T C (en: U, T) 10:36, 23 September 2008 (UTC)
  Declined per Jorunn - this would be pointless.  — Mike.lifeguard | talk 20:21, 28 September 2008 (UTC)

sourmath.com



This is a malicious link added to en.Wikipedia.[7] It doesn't seem to harbor a virus but it's semi-pornographic images(?- hard to tell I didn't look for long!) and the code resizes your browser window and makes it bounce around the screen. Only added once on en.wikipedia as far as I can tell but seems to have no legitimate use and ought to be cross-wiki blacklisted as other malicious sites are. -- SiobhanHansa 21:53, 23 September 2008 (UTC)

Unquestionably malicious.   Added & thanks.  — Mike.lifeguard | talk 22:08, 23 September 2008 (UTC)
There have been other additions, see the coibot report, needing research:




(All on:


). Waiting for the reports (are queued). --Dirk Beetstra T C (en: U, T) 09:51, 24 September 2008 (UTC)
  Added more - good catch.  — Mike.lifeguard | talk 16:15, 24 September 2008 (UTC)

Proposed removals

  This section is for archiving proposals that a website be unlisted.

Lluisllach.pl

lluisllach.pl is a fine site, referring to a Geocities page. No spam, no porn. There are many pages about Lluis Llach, and the link was accepted by the Polish one. Bloking really does not seem necessary. The preceding unsigned comment was added by 212.39.28.26 (talk • contribs) 12:17, 16 Aug 2008 (UTC)

The site (as you have spelt it) does not appear to be blacklisted here. Thanks --Herby talk thyme 12:23, 16 August 2008 (UTC)
the sbl is case-insensitive, the entry is
\blluisllach\.pl\b
for a given url you can use [8] (beta state) to find the corresponding entries. -- seth 13:53, 16 August 2008 (UTC)
Thanks seth - that way it is here because of this report. It was reverted, links placed again so listed. Looks valid to me. For anyone who doesn't look at it the appeal is by the Ip that was responsible for the link placement. Cheers --Herby talk thyme 13:55, 16 August 2008 (UTC)
  • I think we should decline - geocities pages are of no use to the encyclopaedia. Rather the reverse, in fact. 80.176.82.42 23:07, 16 August 2008 (UTC)
  Declined per Herby and original report.  — Mike.lifeguard | @en.wb 23:16, 16 August 2008 (UTC)

ezinearticles.com



i was about to use http://ezinearticles.com/?MMORPG-Crafting-Skills&id=1383381 as reference for an article, but its blacklisted - is there any special reason? --62.99.197.106 21:22, 28 August 2008 (UTC)

The reason is here, though I couldn't find the conclusion of that discussion quickly (and the log entry doesn't specify an oldid :\ not sure how that happened).  — Mike.lifeguard | @en.wb 02:24, 29 August 2008 (UTC)
OK, the full discussion is archived. Given the self-published nature of that domain, and the issues with POV-pushing over a long period of time, I am happy to have this remain on the global blacklist rather than enwiki's local list. You may choose to request whitelisting for a specific use at w:MediaWiki talk:Spam-whitelist.   Declined based on the original report.  — Mike.lifeguard | talk 23:15, 6 September 2008 (UTC)
For the record, this was cross-wiki spammed. For example (this is just a small sample):
Here are some prior discussions:
--A. B. (talk) 04:11, 7 September 2008 (UTC)

x.y.z.info

Concerning regexp [0-9]+\.[-\w\d]+\.info/?[-\w\d]+[0-9]+[-\w\d]*\].
A few days ago I removed this entry, but was told afterwards, that every removing needs a de-list discussion. So here I go ([#double/wrong entries|again]).
Short: This entry never worked and does not seem to be needed, so imho it's the best to remove the entry.
Long: In the beginning of 2006 there had been this request, which was added immediately. It was modified some time later. But all versions of the entry never matched anything, because the spamblock extension does not work on link descriptions, but only on the link itself. So there will never be a match on whitespace or square brackets.
Now there are 2 possibilities: 1. fix the regexp or 2. remove it permanently.
The original request said that the urls were something like (integer number).(letter).(name).info (which could perhaps be translated into \d+\.[a-z]\.\w+\.info). But if one looks at the present sbl, one can't see even one entry like this. So probably there's no need to block those domains anylonger. The only possibiliy is that entries like "cinn\.info" and "ephraim\.info" are of this format but were inserted without third-level domains. However, a short look into the history of the sbl discussion does not verify that.
Altogether I suggest to leave the entry removed. -- seth 09:59, 7 September 2008 (UTC)

This entry (if done properly) is probably too broad; recommend removal.  — Mike.lifeguard | talk 19:35, 8 September 2008 (UTC)
  Not done then.  — Mike.lifeguard | talk 12:12, 13 September 2008 (UTC)

Caracal pistol, italian Wiki article





[QUOTE]

Hello Erwin, I would like to know the reason of Caracal info european site being listed on spamlist/blacklist and the removal of the link of the italian article. I am the author of all Wikipedia articles in 16 languages related to the first pistol made in United Arab Emirates known as Caracal pistol and I regularly post the latest news on Caracal-pistol.info website to keep readers informed of the latest developments since day one. Sincerely Edmond HUET Quickload 09:55, 6 September 2008 (UTC)

Hi, as far as I can see there's only a small amount of information available on the web site. Most links point to your Domains for sale section. That and adding it to multiple wiki's caused me to blacklist it. Feel free to request removal from the blacklist at Talk:Spam blacklist. --Erwin(85) 11:38, 6 September 2008 (UTC)

Hi, Small amount of information? Maybe, you should click on the 10 buttons on the left when you are on any one of the pages http://www.caracal-consulting.com/caracal-pistol-datas/caracal-pistol-datas.html There is no other site on the web and all the available infos related to Caracal pistol can be found on this site.

[END QUOTE]

Hello, I request removal from blacklist, above quote explains why. Ask for more info if needed. Quickload 09:12, 7 September 2008 (UTC)

Clearly that domain is not blacklisted at meta.  — Mike.lifeguard | talk 16:23, 7 September 2008 (UTC)
caracal-pistol.info however is. Given your conflict of interest in this case, the cross-wiki additions and our norm of declining de-listing requests from site owners, this request is   Declined.  — Mike.lifeguard | talk 16:30, 7 September 2008 (UTC)


OK, given the related domains, and additions by Quickload, I think this may have turned into a request for listing. I'm normally not a fan of listing related domains, but Quickload seems to have a COI here, and is adding sites cross-wiki. Looking for input here. Related domains listed below.  — Mike.lifeguard | talk 16:35, 7 September 2008 (UTC)

Related domains