Talk:Spam blacklist/Archives/2009-03

Add topic
Active discussions

Proposed additions

  This section is for completed requests that a website be blacklisted,

User wrote articles with the text from this cite in several wikis (see interwikis in [1].--Ahonc 13:44, 14 February 2009 (UTC)

Did they spam the domain? If they're just copying text from the site then blacklisting it isn't going to do anything to stop them.  — Mike.lifeguard | @en.wb 00:58, 15 February 2009 (UTC)

Some IPs for the first one:

The second one are completely other users (and no IPs). Is this coincidental, or really related? --Dirk Beetstra T C (en: U, T) 20:48, 15 February 2009 (UTC)

Thermoscan Co., Ltd

See WikiProject Spam item. MER-C 08:55, 19 February 2009 (UTC)

  Done - Andre Engels 10:44, 24 February 2009 (UTC)

I'm not really sure on the proper formatting for this, but User:Jorunn recommended this at this COIBot report. NuclearWarfare 04:54, 21 February 2009 (UTC)

  Added. Thanks. --Erwin(85) 09:21, 21 February 2009 (UTC)

Crosswiki spam by

Seen on bi:Mandala, bm:Mandala, bn:Mandala, bo:Mandala, br:Mandala, bs:Mandala, se:Mandala, ch:Mandala, ie:Mandala, pa:Mandala, my:Mandala, as:Mandala, az:Mandala, ba:Mandala, be:Mandala, bh:Mandala. User created an empty page with an image and that link.

Already to the bl   Added \mandalaseverler\.somee\.com\b

Best regards, --birdy geimfyglið (:> )=| 22:43, 21 February 2009 (UTC)

Apparently involved user:

Uploaded the image at commons + [2], best regards, --birdy geimfyglið (:> )=| 22:48, 21 February 2009 (UTC)

Should have been \bmandalaseverler\.somee\.com\b;   fixed  — Mike.lifeguard | @en.wb 04:39, 26 February 2009 (UTC)

Known spammed wikis: meta, commons, en:wp

Best regards, --birdy geimfyglið (:> )=| 12:38, 22 February 2009 (UTC)

  Added. Thanks. Not sure if it'll help against this type of spam though. --Erwin(85) 09:53, 25 February 2009 (UTC)
  Added \bfilipina4u\.proboards83\.com\b too  — Mike.lifeguard | @en.wb 04:41, 26 February 2009 (UTC)

Known spammed wikis: meta, commons, en:wp, best regards, --birdy geimfyglið (:> )=| 15:33, 22 February 2009 (UTC)

  Added. Thanks. Not sure if it'll help against this type of spam though. --Erwin(85) 10:14, 25 February 2009 (UTC)

Added xwiki by this user Finn Rindahl 23:25, 24 February 2009 (UTC)

  Added  — Mike.lifeguard | @en.wb 01:38, 26 February 2009 (UTC)

Added to YouTube-articles crosswiki- Finn Rindahl 19:43, 25 February 2009 (UTC)

  Added, af, be-x-old, bs, ca, cs, de, cy, da, and many others, he readds it after having been reverted and warned. Thanks and best regards, --birdy geimfyglið (:> )=| 19:49, 25 February 2009 (UTC)

A ton

Concerning (discussion and) sbl-diff:
Afaics there are some to "greedy" conditions now, e.g. \bad\.(?:com|biz|us|org|net)\b is blocked atm. So I suggest to exchange the entries by the longer list


if all domains mentioned in the thread should be blocked.

Perhaps it'd be best to state what the problem is. The example you cite doesn't seem to actually be a problem. If there is a real problem then it should be fixed. If not, then no solution is required.  — Mike.lifeguard | @en.wb 04:34, 26 February 2009 (UTC)
There was no spamming of "" (or .org, ...): So it should not be blocked. Apart from that there are many sites (which we don't know), which are blocked by this entry; See e.g. [3]. ("" is matched for any "foo"). AD is an abbreviation e.g. for "alzheimer desease".
Additional to that there's a third bug concerning "egypt..." (org vs. com). It was easier for me to build new regexps than searching for all bugs in the already built regexps. ;-)
And as a small thing: For performance reasons grouping of regexp should be done primarily at the rear of strings, and not at the beginning. -- seth 12:28, 26 February 2009 (UTC)
I think the work folks are doing to improve efficiency is good.. At the same time, I hope that as folks regroup stuff and alter regexes for efficiency that it will still be possible for non-regex admins to correlate blacklist entries with our blacklist logs. If not, then the efficiency gain may not be worth making the changes. --A. B. (talk) 19:05, 26 February 2009 (UTC)
Yes, the log is highly important. But by using [4] it should be no big problem to get the right entries (blacklist and log) for a given url. So actually we don't have to take care of transparency of the list itself. The more important thing is the log. -- seth 22:28, 26 February 2009 (UTC)

Just Do It :D  — Mike.lifeguard | @en.wb 01:50, 28 February 2009 (UTC)

Ok, see also this request. I hope that everything is alright now. -- seth 23:19, 1 March 2009 (UTC)

Not spammed all that much (and a domain that I have a website at), but due to its nature of being a free webhost, it could well be a potential candidate to list here. AC --Sunstar NW XP 14:27, 26 February 2009 (UTC)

  Thanks but no thanks.  — Mike.lifeguard | @en.wb 01:49, 28 February 2009 (UTC)

URL shortner.

--Jorunn 09:14, 1 March 2009 (UTC)

  Added. --Erwin(85) 09:19, 1 March 2009 (UTC)

Can be used to bypass the blacklist. Also, please blacklist the redirect: --Kanonkas 20:31, 3 March 2009 (UTC)

This requires the &l=1 parameter, so I suggest blacklisting \b(?:lmgtfy|letmegooglethatforyou)\.com.*[?&]l=1  — Mike.lifeguard | @en.wb 20:35, 3 March 2009 (UTC)
The analogue for Google is \bgoogle\.com.*[?&]btnI=1. Will look at some other search engines now...  — Mike.lifeguard | @en.wb 21:02, 3 March 2009 (UTC)
Thanks to seth, we've got \bgoogle\.(?:com|(?:com\.)?[a-z]{2})/.*[?&]btnl=1 instead for Google. I didn't find other search engines after a cursory check.  — Mike.lifeguard | @en.wb 21:16, 3 March 2009 (UTC)

  Added the regexes mentioned above.  — Mike.lifeguard | @en.wb 20:37, 5 March 2009 (UTC)

Finn Rindahl 13:27, 5 March 2009 (UTC)

Add them all, the top 10 is: (49), (12), (11), (9), (5), (5), (5), (3), (3), (2).


Report for on the way. Nice catch, Finn! --Dirk Beetstra T C (en: U, T) 13:32, 5 March 2009 (UTC)

Just   Added \bslovenia\.mons\.hr\b because was spamming it crosswiki. Gblocked that IP for 15 minutes to allow the blacklist to work everywhere, probably whole needs adding.
Best regards, --birdy geimfyglið (:> )=| 14:08, 5 March 2009 (UTC)
Yeah, changed it to \bmons\.hr\b  — Mike.lifeguard | @en.wb 20:34, 5 March 2009 (UTC)

Ongoing spam by that IP, seen on Commons, and tr.wikt, possibly also many others. He masscreates pages with the same offtopic content and the three links at the end. Plus he comes back after some time, see [5]. Already   Added the three and gblocked the IP for 15 minutes to allow the spamblacklist work everywhere.

Best regards, --birdy geimfyglið (:> )=| 00:07, 6 March 2009 (UTC)

Ehlibeytin soyu is involved, see de:Spezial:Beiträge/Ehlibeytin_soyu same content, same spam, best regards, --birdy geimfyglið (:> )=| 11:33, 6 March 2009 (UTC)

Also involved:

but I couldn't find any more domains.  — Mike.lifeguard | @en.wb 17:16, 10 March 2009 (UTC)

--Jorunn 01:01, 8 March 2009 (UTC)

  Added. At first I thought about adding only, because the new links are to and the old links to, but some checking made me decide that the old links are rather worthless too, so not much is lost if they happen to be forced to be removed. - Andre Engels 01:53, 8 March 2009 (UTC)
So I thought too, but then I saw that most of the older links also had been inserted by IPs.
The blacklist extention now only blocks new links, not links that is in the old text. So there is no imidiate need to remove links anymore. But there will still be a problem for regular users if the article gets blanked and the the text with a blacklisted link needs to be reverted, so blacklisted links should be removed anyway, especially if they have been spammed of course. Or they should be whitelisted locally where they are wanted.
This link is probably on-topic in (but the article was created by an IP, and only other IP have edited the article).
I've left a message on the talk page of one of the admins on ku.wikipedia.
--Jorunn 09:48, 8 March 2009 (UTC)

Url shortener. Track13 11:34, 9 March 2009 (UTC)

  Added  — Mike.lifeguard | @en.wb 13:50, 9 March 2009 (UTC)

France-related wikis on

We've been spammed with links to multiple wikis:

Spam domains

[6][7][ contact us link]

Related domains

  • Compare en.wikipedia's 15 December 2008 version of Gene Davis (painter) with the [ blog's 9 February 2009 entry] on the painter.
  • This was spammed to simple.wikipedia but not here


[9][10][ contact us link][11]

Google Adsense ID: 9359000462991404



Looking at the COIbot reports there's also been another (well-established) editor adding links to many of these wikis. --A. B. (talk) 23:15, 9 March 2009 (UTC)

  Added --A. B. (talk) 22:20, 10 March 2009 (UTC)

5 warnings, 2 blocks to date. --A. B. (talk) 03:52, 10 March 2009 (UTC)

  Added --A. B. (talk) 22:13, 10 March 2009 (UTC)

More Universe Daily links


Also see:



--A. B. (talk) 21:42, 10 March 2009 (UTC)

  Added --A. B. (talk) 21:51, 10 March 2009 (UTC)
Also spamming cy.wikipedia --A. B. (talk) 23:55, 10 March 2009 (UTC)

Additional Universe Daily information

In addition to the en.wikipedia spam documented in some of the links above, these and related domains have been spammed extensively across many Wikimedia projects:






en.wikipedia accounts identified to date:

More domains added by one or more of the IPs above:

--A. B. (talk) 05:21, 11 March 2009 (UTC)

  Added -- 24 additional domains listed immediately above. --A. B. (talk) 05:28, 11 March 2009 (UTC)

Ongoing crosswiki-spam,   Added "\bkayit\.co\.cc\b" already, and gblocked the IP 15 minutes so the spambl works. Seen on cv, tk, be, uz, be-x-old, best regards, --birdy geimfyglið (:> )=| 14:54, 13 March 2009 (UTC)

More IPs:

 — Mike.lifeguard | @en.wb 23:13, 15 March 2009 (UTC)

Spammed on many wikis, already   Added \bsandoftime-mv\.ucoz\.ru\b Best regards, --birdy geimfyglið (:> )=| 18:49, 13 March 2009 (UTC)

  Reverted also. —Dferg (talk) 19:05, 13 March 2009 (UTC)