Wikipedia talk:WikiProject Spam/2007 Archive Dec 2

From Wikipedia, the free encyclopedia

Contents

Publisher Spam, Incisive Media Investments Ltd. (2)

Note: this company owns searchenginewatch.com and searchenginestrategies.com. Finding all the sock accounts, and methods of insertion will not all be obvious spam. I don't believe this is a complete list of sites ect., however I do believe this will take months to unravel the complexity of Incisive Media's integration within Wikipedia. --Hu12 12:10, 26 April 2007 (UTC)

Spam sock accounts

Riskbooks (talk · contribs · deleted contribs · logs · block user · block log)
80.83.156.199 (talkcontribsdeleted contribsWHOISRDNStraceRBLshttpblock userblock log)
67.86.94.12 (talk • contribsdeleted contribsWHOISRDNStraceRBLshttpblock userblock log)
ElliottFox (talk · contribs · deleted contribs · logs · block user · block log)
87.80.180.218 (talk • contribsdeleted contribsWHOISRDNStraceRBLshttpblock userblock log)
Natknight (talk · contribs · deleted contribs · logs · block user · block log)
81.174.184.188 (talk • contribsdeleted contribsWHOISRDNStraceRBLshttpblock userblock log)
Lemurtree (talk · contribs · deleted contribs · logs · block user · block log)
Vpriest (talk · contribs · deleted contribs · logs · block user · block log)
Legalweek (talk · contribs · deleted contribs · logs · block user · block log) changed to Solicitor1 (talk · contribs · deleted contribs · logs · block user · block log)
Investorguru (talk · contribs · deleted contribs · logs · block user · block log)
69.146.65.6 (talkcontribsdeleted contribsWHOISRDNStraceRBLshttpblock userblock log)
86.142.72.153 (talk • contribsdeleted contribsWHOISRDNStraceRBLshttpblock userblock log)
86.133.113.66 (talk • contribsdeleted contribsWHOISRDNStraceRBLshttpblock userblock log)
86.155.103.213 (talk • contribsdeleted contribsWHOISRDNStraceRBLshttpblock userblock log)
Broontoon (talk · contribs · deleted contribs · logs · block user · block log)
Jstapleton (talk · contribs · deleted contribs · logs · block user · block log)
76.243.198.170 (talk • contribsdeleted contribsWHOISRDNStraceRBLshttpblock userblock log)

Incisive Media articles
Incisive Media sites

http://spam.re-world.com http://spam.structuredproductsonline.com http://spam.fxweek.com http://spam.baselalert.com http://spam.riskwaters.com http://spam.incisivemedia.com http://spam.incisivecommunications.com http://spam.cift.com http://spam.risk.net http://spam.asiarisk.com.hk http://spam.energyrisk.com http://spam.creditmag.com http://spam.life-pensions.com http://spam.opriskandcompliance.com http://spam.structuredproductsonline.com http://spam.risknews.net http://spam.riskbooks.com http://spam.journalofcomputationalfinance.com http://spam.journalofrisk.com http://spam.journalofcreditrisk.com http://spam.journalofoperationalrisk.com http://spam.imdreference.com http://spam.imdindex.com http://spam.insidemarketdata.com http://spam.irdonline.com http://spam.incisive-events.com http://spam.activehome.co.uk http://spam.computeractive.co.uk http://spam.gizmodo.com http://spam.pcmag.co.uk http://spam.pcw.co.uk http://spam.webactivemagazine.co.uk http://spam.whatpc.co.uk http://spam.accountancyage.com http://spam.bestpracticemagazine.co.uk http://spam.financialdirector.co.uk http://spam.managementconsultancy.co.uk http://spam.accountancyagejobs.com http://spam.computingcareers.co.uk http://spam.inqjobs.co.uk http://spam.computing.co.uk http://spam.computingbusiness.co.uk http://spam.channelweb.co.uk http://spam.theinquirer.net http://spam.itweek.co.uk http://spam.vnunet.com http://spam.marketing.vnu.co.uk http://spam.dealingwithtechnology.com http://spam.dwt-event.com http://spam.searchenginewatch.com http://spam.searchenginestrategies.com http://spam.watersonline.com http://spam.waters-conferences.com http://spam.hfitechnology.com http://spam.bjp-online.com http://spam.postmagazine.co.uk http://spam.legalweek.com http://spam.professionalbroking.co.uk http://spam.reinsurancemagazine.com http://spam.insuranceage.com http://spam.covermagazine.co.uk http://spam.insurance-directories.com http://spam.investmentweek.co.uk http://spam.intinv.com http://spam.realadviser.co.uk http://spam.masteringmoney.com http://spam.yourmoney.com http://spam.ymitv.co.uk http://spam.yourmortgage.co.uk http://spam.mortgageedge.co.uk http://spam.mortgagesolutions-online.com http://spam.unquote.co.uk http://spam.deutscheunquote.com http://spam.franceunquote.com http://spam.nordicunquote.com http://spam.beneluxunquote.com http://spam.southerneuropeunquote.com http://spam.hedgefundsreview.com http://spam.financialmarketingonline.com http://spam.wealthmagazineonline.com http://spam.ifaonline.co.uk http://spam.privateequityinsight.com http://spam.professionalpensions.com

Incisive Media site search

Seems to have begun again. A few new accounts added --Hu12 (talk) 09:29, 18 December 2007 (UTC)

I'd feed these to shadowbot. MER-C 12:53, 18 December 2007 (UTC)
Added more above--Hu12 (talk) 14:15, 19 December 2007 (UTC)

http://spam.parliamentaryyearbook.co.uk

parliamentaryyearbook.co.uk: Linksearch en - meta - de - fr - simple - wikt:en - wikt:fr • Reports: Links on en - COIBot - Meta: SRB-XWiki - COIBot-XWiki - Eagle's spam report search • Interwiki link search, big: 20 - 57 • Linkwatcher: search • Wikipedia: en - fr - de • Google: searchVeinor pagesmeta • Yahoo: backlinks • Domain: domaintoolsAboutUs.orgDomainsDB.netAlexaOnSameHost.comWhosOnMyServer.com

Spammers

MER-C 12:41, 18 December 2007 (UTC)

Is there any reason to think it [1]] would not be a reliable source ? DGG (talk) 03:04, 19 December 2007 (UTC)
I didn't do the reverting, but it's fairly obvious that these links are blatant vanispamcruftisement. I wouldn't object to established editors citing these as references but when someone comes along with a username similar to the site spammed, adds nothing but links to that site and ignores warnings to stop... MER-C 03:25, 19 December 2007 (UTC)

Porn star impersonation sites

Had a couple sites turn up - will investigate for more sites owned by same spammer.

Account
Sites linked

Reported by Videmus Omnia Talk 03:12, 19 December 2007 (UTC)

This is ugly - it's our old friend the cookie-cutter porn linkspammer. Preliminary investigating shows he's apparently registered hundreds of impersonation sites using GoDaddy, with different IPs for each site. I've left a note on A.B.'s talk page, but I'm not sure how to proceed here. Videmus Omnia Talk 03:26, 19 December 2007 (UTC)
The links are apparently being added by IPs from Istanbul, and sites are registered to a company named Incoming America LLC. Videmus Omnia Talk 03:37, 19 December 2007 (UTC)
I'd start by monitoring for domains which resolve in 208.72.247.0/24, belonging to: MarquisNet in Las Vegas all three listed above are hosted in that range.--Versageek 04:09, 19 December 2007 (UTC)
Here are some harvested from the screens of the sites above:

for the bored spam-hunter to follow up :) --Versageek 04:23, 19 December 2007 (UTC)

Running a honeypot forum for PHSDL, I have some users submit pornangraphic pictures of celeberties. Some of the pcitures are real. Celeberties are people, and people have history. I do not know if WikiPedia should be a reposetory for this information, but news is news. And if we are to be viewed authoritative by Interent Global Village we should not be calling these people Spammers. How do we go about this? Do we set up one article page for these people to report their findings, so they do not stick their pornagraphicly related links to celeberty articles? How will we know if the picture or the story is true? This issue need to be examined, we are not Sock_puppetry for the celeberties. So we need to reference the good and the contreversial. Igor Berger (talk) 04:45, 19 December 2007 (UTC)
In this case, as in most cases - spam is defined not so much by the content of the site.. as by the behavior of the individuals adding the links.. In addition, typically all of the sites are owned by a single company or individual and run on the same server-farm.. add these factors together - and the big picture shows someone who is using Wikipedia to promote their own interests. This is the essense of spamming.. --Versageek 05:10, 19 December 2007 (UTC)
Looks like we were following a parallel track - I dug up a bunch of sites (many of which duplicate yours) and put them in User:Videmus Omnia/Sandbox for now. Videmus Omnia Talk 05:17, 19 December 2007 (UTC)
  1. Try the DomainsDB.net links in the {{spamlink}} template. Sometimes they're unhelpful but it looks like this time they may be on to something. Take the whitneywonders.com link for example:
    1. This is the DomainsDB.net link:
      http://www.domainsdb.net/whitneywonders.com
      And here's the part I use:
      "Reverse IP: there are -1 domains on this IP, click here to get them all"
      "Name Server: ns1.fantastichomemovies.com"
      "ns2.fantastichomemovies.com"
      "(click to any NS server to get all domains, hosted on this NS)"
    2. Click on the first pair of links. I don't know why it always says "-1 domains" but it does
      • That gives a list of what else is hosted at that IP -- most of the time. Sometimes not -- I don't know why.
      • Note the list of porn-looking sites hosted at that IP (208.109.18.208)
    3. Click on the second pair and that gives a list of domains served by those nameservers
    4. Sometimes an IP or nameserver hosts a zillion unrelated sites, in which case DomainsDB.net gives you the first 500 hits; these kinds of results pages are useless.
    5. Important: sometimes lots of unrelated domains are hosted by a server or affiliated with a nameserver. And all those porn sites are not necessarily related; just as Yahoo hosts zillions of unrelated web sites, there are porn-hosting companies that host many different owners' sites. So always confirm via either whois, Adsense numbers, web page design or something else before blacklisting.
      Gotta run. Will proof this post later. --A. B. (talk) 13:14, 19 December 2007 (UTC)
    6. DomainsDB.net also has a link for whois data, but it's usually not as accurate, extensive or current as that you get with domaintools (also in the spamlink template).
  2. I suggest you also list the users adding these links using the {{IPSummary}} and {{UserSummary}} templates rather than the other traditional user and IP templates. Those two templates are optimized for spam investigations. For instance, you can rapidly run a x-wiki edit history that's faster than a x-wiki external link search. You can also Google search the IP or user name and sometimes find interesting instances of that user name or IP elsewhere on the net (lists of open proxies, username postings in SEO forums, etc).
  3. The AboutUs.org wiki links in our spamlink templates give 3 useful pieces of information:
    1. "Related domains". This is calculated by their bot based on inbound and outbound links, similar whois data, etc. The accuracy varies and you'll often see Wikipedia, Google, and other big names listed. Still it gives clues as to additional domains to check out with actual site visits or domaintools.
    2. "What links here" (in the "useful links" drop down menu on the right). This shows what other AboutUs.org pages link to this one. This can be a somewhat different list from the "Related domains" list.
    3. "History" tab at the top gives the edit history. A site-owner has the option to edit page data about his site and it can be interesting to see what other pages are in their user contribution history. Once in a blue moon, you'll see that the edits to a page were actually a competitor tampering with the page.
      Note:The whois data on AboutUs.org pages is not as up to date as domaintools'.
I hope this helps. --A. B. (talk) 15:40, 19 December 2007 (UTC)

I recommend blacklisting all these domains at meta if these sites appear to be infringing others' copyrights. Even if sites are not cross-wiki spammed, innocent editors often copy an en.wikipedia article to another language's Wikipedia and translate it, thus propagating our spamlinks elsewhere. Legally, I don't think we want to take a chance of copyvio links showing up on any Wikimedia project even if the site-owner's only spamming en.wikipedia. Also, I think those 1000s of other unrelated MediaWiki-using wikis that have adopted our blacklist would also appreciate this.

I'm sorry I'm tied up and can't help much more with this one. --A. B. (talk) 16:03, 19 December 2007 (UTC)

Utarget Media

Spam pages
Sites spammed

http://spam.urbanplanet.co.uk

http://spam.financedaily.co.uk

Related sites

http://spam.keepthedoctoraway.co.uk

http://spam.travelconnect.co.uk

http://spam.justoverseas.co.uk

http://spam.justcompetitions.co.uk

Spammers

MER-C 10:00, 19 December 2007 (UTC) Adsense pub-2340979139322250

Logo‎ spammer

  • davidairey.com parked domain
  • logopond.com Adsense pub-2340979139322250
  • logomarket.com Adsense pub-pub-1642068985324361
  • etiziano.com
  • ci-portal.de
Accounts

Apollo560 (talk · contribs · deleted contribs · logs · block user · block log)
84.191.247.77 (talkcontribsdeleted contribsWHOISRDNStraceRBLshttpblock userblock log)
Bestmom2007 (talk · contribs · deleted contribs · logs · block user · block log)
Princemidas (talk · contribs · deleted contribs · logs · block user · block log)
--Hu12 (talk) 10:40, 19 December 2007 (UTC)

Spamming of related

yahoo ads partner 1486688007

Accounts

Storagedirectory (talk · contribs · deleted contribs · logs · block user · block log)
76.111.231.218 (talkcontribsdeleted contribsWHOISRDNStraceRBLshttpblock userblock log)
--Hu12 (talk) 23:30, 19 December 2007 (UTC)

spam.sommelier.dn.ua

sommelier.dn.ua: Linksearch en - meta - de - fr - simple - wikt:en - wikt:fr • Reports: Links on en - COIBot - Meta: SRB-XWiki - COIBot-XWiki - Eagle's spam report search • Interwiki link search, big: 20 - 57 • Linkwatcher: search • Wikipedia: en - fr - de • Google: searchVeinor pagesmeta • Yahoo: backlinks • Domain: domaintoolsAboutUs.orgDomainsDB.netAlexaOnSameHost.comWhosOnMyServer.com

Spammers

MER-C 12:31, 19 December 2007 (UTC)

On Meta BL --Herby talk thyme 13:25, 20 December 2007 (UTC)

http://spam.freefoto.ca

Adsense pub-2971406444944970

Accounts

Filtv (talk · contribs · deleted contribs · logs · block user · block log)
--Hu12 (talk) 03:16, 20 December 2007 (UTC)

Note — all images on this site are free and released under Creative Commons-sa-by-nc-3.0. — ERcheck (talk) 04:14, 20 December 2007 (UTC)
"nc" being the issue. — ERcheck (talk) 05:25, 20 December 2007 (UTC)
67.55.9.74 (talkcontribsdeleted contribswhat links to user page • COIBot • countblock logx-wikisearch an, ani, cn, an3LinkWatcher search || WHOISRDNStracerouteCompleteWhoisippages.comrobtex.comtorGoogleAboutUs)
--Hu12 (talk) 03:59, 29 May 2008 (UTC)

Hacking blogger lifedork.com

At least two IPs adding links to a hacker-related blog. Warnings back to November on one talk page.

Jackollie (talk) 06:14, 20 December 2007 (UTC)

Sorry I do not get it. How is this Website is a Spammer? I have looked at the blog and he talks about valid security points. So how is he Spamming WikiPedia. If you can explain it would be greatly appreciated, because maybe I do not know how the Spamming case incident insued. Igor Berger (talk) 07:13, 20 December 2007 (UTC)
User:Versageek I just refered back to what you sad to me earlier, that it is not the content but the behavior of the users that make them Spammers and put their domain on WikiPedia Spam list. I agree!!! But could it be that the contributers do not understand the WikiPedia system of notability? When I first sign up I tried to create an article on PHSDL and all hell broke lose, even Durova had to come down and explain to me how things are done. No A.B. told me that PHSDL should be made into an article and that I should come down and contribute to WikiPedia Spam project. Can it really be that some of the contributers who are Spanning do not know how to do White Hat SEO? Thank you, Igor Berger (talk) 07:55, 20 December 2007 (UTC)

http://spam.addictivebooks.com

Accounts

Claudia Heilig (talkcontribsdeleted contribswhat links to user pagecount COIBot • search an, ani, cn, an3user page logsx-wikistatusHeilig LinkWatcher searchGoogle)
24.44.169.29 (talkcontribsdeleted contribswhat links to user page • COIBot • countblock logx-wikisearch an, ani, cn, an3LinkWatcher search || WHOISRDNStracerouteCompleteWhoisippages.comrobtex.comtorGoogleAboutUs)
--Hu12 (talk) 18:11, 20 December 2007 (UTC)

commercial spammer

Accounts

82.109.239.2 (talkcontribsdeleted contribswhat links to user page • COIBot • countblock logx-wikisearch an, ani, cn, an3LinkWatcher search || WHOISRDNStracerouteCompleteWhoisippages.comrobtex.comtorGoogleAboutUs)
Liverpoolsciencepark (talk · contribs · deleted contribs · logs · block user · block log)
Dancarney (talk · contribs · deleted contribs · logs · block user · block log)
--Hu12 (talk) 18:25, 20 December 2007 (UTC)

Referral site spamdal

Referral site:

Spamsock:

If we end up blacklisting , I suggest \btradedoubler\.com\/click\? - which will allow a link to the main page on the article TradeDoubler - but prevent it's use for referral link spam. --Versageek 21:51, 20 December 2007 (UTC)

I support that. Had a past issue with an unrelated, however it is a wikimedia wide problem. seeWikipedia_talk:WikiProject_Spam/2007_Archive_Aug#Affiliate_spamming_of_http:.2F.2Fspam.moneybookers.com, should have meta BL resticted it a long time ago.--Hu12 (talk) 22:31, 20 December 2007 (UTC)

Storming Media LLC Spamming

  • //spam.legistorm.com Adsense pub-5159231827098763
Accounts

Lyoshka (talk · contribs · deleted contribs · logs · block user · block log)
74.93.192.118 (talkcontribsdeleted contribsWHOISRDNStraceRBLshttpblock userblock log) →Storming Media LLC STORMING-MEDIA-LLC
Dceditor (talk · contribs · deleted contribs · logs · block user · block log)
M.K.Cummings (talk · contribs · deleted contribs · logs · block user · block log)
Wattpower (talk · contribs · deleted contribs · logs · block user · block log)
Ghfycgfxhrz (talk · contribs · deleted contribs · logs · block user · block log)
505 links from Lyoshka, 151 from IP 74.93.192.118, with no other edits other than legistorm.com. The others are spam only accounts, whith a pattern of starting article based on the link (with no other edits). (91 remain) --Hu12 (talk) 00:28, 19 December 2007 (UTC)

Someone has just opened a relevant, and sure to be heated, discussion at WP:ANI#Abusive identification of Legistorm.com as "spam". It would be much appreciated to get some calm, unbiased evaluations over there from experienced Project members. Specifically, is legistorm.com a site that should have been blacklisted? Thanks in advance for your analysis and opinions. — Satori Son 21:17, 19 December 2007 (UTC)
Thanks for making us aware. I'm sorry to see Guy getting lynched over this; I put in my 2 cents at WP:ANI. --A. B. (talk) 23:00, 19 December 2007 (UTC)
See now MediaWiki talk:Spam-blacklist#legistorm.com. --Hu12 (talk) 18:48, 20 December 2007 (UTC)
The pitch is boiling and chickens are being plucked. --A. B. (talk) 19:00, 20 December 2007 (UTC)
Avoid angry mastodons--Hu12 (talk) 23:29, 20 December 2007 (UTC)


FYI, a Request for Comments has been opened about the removal of legistorm.us from the local spam blacklist:

Your inputs are invited.
--A. B. (talk) 22:26, 21 December 2007 (UTC)

Patni Computer Systems Ltd.

Articles

Patni Computer Systems
Narendra Patni

Accounts

Marketing@Patni (talkcontribsdeleted contribswhat links to user pagecount COIBot • search an, ani, cn, an3user page logsx-wikistatusLinkWatcher searchGoogle)
203.189.177.135 (talkcontribsdeleted contribswhat links to user page • COIBot • countblock logx-wikisearch an, ani, cn, an3LinkWatcher search || WHOISRDNStracerouteCompleteWhoisippages.comrobtex.comtorGoogleAboutUs) →Patni Computer Systems Inc
Nirajwagle (talk • contribsdeleted contribswhat links to user pagecount COIBot • search an, ani, cn, an3user page logsx-wikistatusLinkWatcher searchGoogle)
203.199.135.133 (talk • contribsdeleted contribswhat links to user page • COIBot • countblock logx-wikisearch an, ani, cn, an3LinkWatcher search || WHOISRDNStracerouteCompleteWhoisippages.comrobtex.comtorGoogleAboutUs)
Vishal.bhatt (talkcontribsdeleted contribswhat links to user pagecount COIBot • search an, ani, cn, an3user page logsx-wikistatusLinkWatcher searchGoogle)
203.196.203.20 (talkcontribsdeleted contribswhat links to user page • COIBot • countblock logx-wikisearch an, ani, cn, an3LinkWatcher search || WHOISRDNStracerouteCompleteWhoisippages.comrobtex.comtorGoogleAboutUs)
203.196.203.20 (talkcontribsdeleted contribswhat links to user page • COIBot • countblock logx-wikisearch an, ani, cn, an3LinkWatcher search || WHOISRDNStracerouteCompleteWhoisippages.comrobtex.comtorGoogleAboutUs)
203.187.213.119 (talk • contribsdeleted contribswhat links to user page • COIBot • countblock logx-wikisearch an, ani, cn, an3LinkWatcher search || WHOISRDNStracerouteCompleteWhoisippages.comrobtex.comtorGoogleAboutUs)
--Hu12 (talk) 22:58, 21 December 2007 (UTC)

Wedding dress spam

Account

Sites spammed

This account added about 30 spam links altogether, and nearly all have been reverted. Adding these links seems to be his only activity. The editor was still active today. EdJohnston (talk) 18:59, 22 December 2007 (UTC)

Both sites are definatly connected to a single owner, Adsense pub-2068997676225300 --Hu12 (talk) 19:50, 22 December 2007 (UTC)

Yeigo Communications (Pty) Ltd

Yeigo

Accounts

YeigoMobile (talk · contribs · deleted contribs · logs · block user · block log)
41.245.163.0 (talkcontribsdeleted contribsWHOISRDNStraceRBLshttpblock userblock log)
--Hu12 (talk) 06:45, 23 December 2007 (UTC)

spam related

Adsense pub-3482288747951847

Accounts

Ripsss (talk · contribs · deleted contribs · logs · block user · block log)
--Hu12 (talk) 06:55, 23 December 2007 (UTC)

http://spam.csgsindia.com

Adsense pub-4625031504195728

Accounts

Csgsindiaorg (talk · contribs · deleted contribs · logs · block user · block log)
Csgsindia (talk · contribs · deleted contribs · logs · block user · block log)
--Hu12 (talk) 08:45, 23 December 2007 (UTC)

Arontac Systems Ltd

Articles created

Projecthand
ProjectHand

Accounts

Dinohung (talk · contribs · deleted contribs · logs · block user · block log)
--Hu12 (talk) 10:13, 24 December 2007 (UTC)

http://spam.mcnmagazine.com

Myiplayground

Accounts

Miex06 (talk · contribs · deleted contribs · logs · block user · block log)
70.52.58.113 (talkcontribsdeleted contribsWHOISRDNStraceRBLshttpblock userblock log)
--Hu12 (talk) 10:28, 24 December 2007 (UTC)

http://spam.mappery.com

Adsense pub-2868140543533702

Accounts

64.131.165.77 (talkcontribsdeleted contribswhat links to user page • COIBot • countblock logx-wikisearch an, ani, cn, an3LinkWatcher search || WHOISRDNStracerouteCompleteWhoisippages.comrobtex.comtorGoogleAboutUs)
--Hu12 (talk) 11:38, 24 December 2007 (UTC)

http://spam.clubbingabroad.co.uk http://spam.clubbingabroad.com

Spammers

MER-C 12:00, 24 December 2007 (UTC)

heraldry-online.org.uk

Accounts

Heraldic (talk · contribs · deleted contribs · logs · block user · block log)
212.240.95.228 (talkcontribsdeleted contribsWHOISRDNStraceRBLshttpblock userblock log)
Personal website, --Hu12 (talk) 12:45, 24 December 2007 (UTC)

The heraldry Online site show the results of collated information regarding the heraldry associated with places or particular surnames. There is no financial gain from the site nor is there any attack or criticism of others listed. --Heraldic 12:08, 6 January 2008 (UTC) —Preceding unsigned comment added by Heraldic (talkcontribs)
See [2]--Hu12 (talk) 14:24, 7 January 2008 (UTC)