From Wikipedia, the free encyclopedia

Travel site spam

(and a few more following the same naming pattern)

See COIBot reports for more details. All of these sites have the same layout and likely are maintained by the same spammer - started apparently in January/February. Almost all sites are named "location.com-archipelago.com". There are possibly a lot of similarly-named sister sites for other travel locations in the area. I am not sure if it would be useful to blacklist a pattern such as "*.com-archipelago name.com"(?), but it's worth looking out for further incidents regardless. GermanJoe ( talk) 10:28, 1 August 2018 (UTC)

Bold 185.156.72.9 ( talk) 06:51, 23 January 2023 (UTC)
Bold 185.156.72.9 ( talk) 08:04, 23 January 2023 (UTC)

naughtyfind.com

naughtyfind.com: Linksearch en (insource) - meta - de - fr - simple - wikt:en - wikt:fr • MER-C X-wiki • gs • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced - RSN • COIBot- Link, Local, & XWiki Reports - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.com

Carolynlwre1 ( talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)

Chletayor1 ( talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)

Ncolakig1 ( talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)

Juliahll1 ( talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)

SPAs posting "how-to's" related to online dating in their sandboxes ( here, here, here and here) and hiding the above link among a bunch of wikilinks. I tagged all the sandboxes for deletion as not webhost, but now that I think about it, blatant promo may have been a better fit. – FlyingAce ✈hello 05:00, 2 August 2018 (UTC)

Blacklisted. MER-C 06:56, 2 August 2018 (UTC)

Nomination for merging of Template:Uw-coi

Template:Uw-coi has been nominated for merging with Template:Coi-stern. You are invited to comment on the discussion at the template's entry on the Templates for discussion page. Thank you. —  Newslinger  talk 16:50, 2 August 2018 (UTC)

geoengineeringwatch.org

There are a number of addresses/users in the COIbot report which I'll not include here, but what initially brought the domain to my attention was this edit. A quick look at the site shows that it's a chemtrail conspiracy theory one so it will never be a reliable source for anything on Wikipedia. Thanks, — Paleo Neonate – 20:38, 3 August 2018 (UTC)

Adding: it was also used on other language Wikipedias. — Paleo Neonate – 20:43, 3 August 2018 (UTC)

casinobonusesfinder.com

Inserted by known sockfarm here and there are several others I haven't looked for ownership. ☆ Bri ( talk) 23:22, 3 August 2018 (UTC)

Blacklisted. MER-C 10:48, 4 August 2018 (UTC)

gminsights.com

Hello. This month, at least 2 users have added spamlinks to this website. Thanks and regards, Biwom ( talk) 10:24, 31 July 2018 (UTC)

@ Biwom: Seems to be also spammed by these, and there seem to be many IPs involved as well. Mind having a look as well to the COIBot reports linked in these templates? -- Dirk Beetstra T C 12:57, 31 July 2018 (UTC)

Hello. fractovia.org does not seem to be a problem. Regarding gminsights.com, most of the IP edits are obvious spam: it should not be a coincidence that 3 Indian IPs added similar external links in 3 articles on 9th, 12th and 13th May 2016, and this edit in November 2016 looks a lot like this edit in July 2018. Additionally, the edits of User:Sophiamiller1978 in late 2016 / early 2017 are very spammy. In the end though, we have the addition of less than 20 spamlinks over more than 2 years, which is not particularly aggressive. Thanks and regards, Biwom ( talk) 11:29, 1 August 2018 (UTC)
@ Biwom: plus Added to MediaWiki:Spam-blacklist. -- Dirk Beetstra T C 11:21, 4 August 2018 (UTC)

Marnitam

Hello. Should these contributions be mass-reverted? Thanks and regards, Biwom ( talk) 08:54, 4 August 2018 (UTC)

@ Biwom: doing that now. Dumping external links is not the purpose of our pages. WP:ELBURDEN applies on a case-by-case basis. -- Dirk Beetstra T C 11:08, 4 August 2018 (UTC)

See also

Account active just a few days before Marnitam started. Several "coincidental" similarities in editing patterns about TIFF - which is not a proper encyclopedia by the way, but a website with a strong focus on marketing for Canadian cinema and several commercial offers. Their main domain seems to be www.tiff.net. GermanJoe ( talk) 11:37, 4 August 2018 (UTC)

Lets get a report. -- Dirk Beetstra T C 11:42, 4 August 2018 (UTC)

User:Kellerkr likely has a conflict of interest, and I am not convinced that User:Marnitam doesn't. -- Dirk Beetstra T C 11:50, 4 August 2018 (UTC)
Just to clarify: the organization seems to be a noteworthy provider of cinema-related information in Canada (might need a real Canadian to verify :) ). But reliability of their data would need to be clarified, and their possible status doesn't excuse any systematic spamming of course. GermanJoe ( talk) 11:54, 4 August 2018 (UTC)

skncosmetics.com etc

Links
Users

I've long removed skncosmetics.com from hospital list articles as it showed up and it keeps showing up. Additions now commonly replace other external links in an additional attempt to avoid crutiny. It has been added by many socks as COIBot attests. I also noticed laserskincare.ae which needs to be cleaned up from articles (I'll do that later if it's not been done already). Thanks, — Paleo Neonate – 21:46, 6 August 2018 (UTC)

@ PaleoNeonate:  Defer to Global blacklist, cross-wiki problem. -- Dirk Beetstra T C 04:12, 7 August 2018 (UTC)
Thank you, — Paleo Neonate – 04:23, 7 August 2018 (UTC)
Oh, I did see the first domain there, but how about laserskincare.ae? Thanks again, — Paleo Neonate – 04:25, 7 August 2018 (UTC)
Note: I found the second as part of 58.65.129.35's edits (who also added the first domain). — Paleo Neonate – 04:26, 7 August 2018 (UTC)

nationsroot.com

nationsroot.com: Linksearch en (insource) - meta - de - fr - simple - wikt:en - wikt:fr • MER-C X-wiki • gs • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced - RSN • COIBot- Link, Local, & XWiki Reports - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.com

ShabinaP ( talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)

ASHVIN1689 ( talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)

Jwalant82 ( talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)

Hello. I can see there's already a COIBot report. One may be tempted to speculate that ShabinaP is a sock of Shabina Peerzada. Thanks and regards, Biwom ( talk) 11:07, 9 August 2018 (UTC)

@ Biwom: I am more tempted to speculate that this is a sockfarm for WP:REFSPAM. plus Added to MediaWiki:Spam-blacklist. -- Dirk Beetstra T C 17:45, 9 August 2018 (UTC)

Reminder augusto fagioli, Get Wikipedia Page at 85% Off

This is spam, to me. Reporting.

Message:


BEGIN>>>> 

Hello augusto fagioli

Do you think Gangnam Style, Justin Bieber and Adele went viral based on just the quality of their work? You’d be wrong if you thought so!

Generating the right type and amount of exposure for yourself or your business is not just a matter of fate or chance but rather a focused and calculated work of digital sciences.

In the digital age, businesses, actors, writers, singers and everyone else who wants to be popular have teams working for them to strategize and manage their content and reputation over the internet. We believe it’s time you took a step in the same direction to get the fire started.

What do we propose? We will take you and your business truly global with a place on the world’s largest online encyclopedia, taking you instantly to the top of your league! It might look like a simple page on Wikipedia but here is what you really need to know to understand the real power of Wiki.

1. Wikipedia is the largest and most popular general reference work on the Internet.
2. It is ranked the fifth-most popular website.
3. It comprises more than 40 million articles in 299 different languages.
4. The encyclopedia has 18 billion page views and nearly 500 million unique visitors each month.
5. Wikipedia's level of accuracy has approached that of Encyclopedia Britannica.

We are not saying that this is all you’ll ever need to go from common to ‘famously known’ but this will surely be the smartest first step towards it.

Interested to know more about it? Don’t wait any longer! We are offering a Special 85% discount on our Digital Services this New Year Click Here to Activate your 85% Off Deal Now.

Your Sincerely,
Debra Lin
Senior Consultant
Wiki Professionals Inc
4330 Clarence Court
Fayetteville, NC 28306

<<<<END


Details:


BEGIN >>> 

Messaggio originale
ID messaggio	<df92eb6b2e313111d2fb567407fb46e3@maildedi2.com>
Creato alle:	12 luglio 2018 16:00 (consegnato dopo 11244 secondi)
Da:	WikiPedia <debra.lin@wikifiersinc.com> Tramite Mailigen Mailer - **CIDe3fc2040169e9dd1**
A:	augusto fagioli <augustofagioli@gmail.com>
Oggetto:	Reminder augusto fagioli, Get Wikipedia Page at 85% Off
SPF:	PASS con l'IP 62.63.191.32 Ulteriori informazioni
DKIM:	'PASS' con il dominio maildedi2.com Ulteriori informazioni
DMARC:	'FAIL' Ulteriori informazioni


Scarica messaggio originale

<<<<END

— Preceding unsigned comment added by Augustofagioli ( talk • contribs) 12 July 2018 (UTC)


I have been recieving this as well in large numbers on several email addresses. - Peter ( talk) 11:29, 1 August 2018 (UTC)

Yes we have been seeing a lot of these emails being reported. They must be sending out 100s of thousands of them :-( Doc James ( talk · contribs · email) 21:07, 9 August 2018 (UTC)

Fundraiser websites

gofundme.com

I was surprised to see this fundraising site is not blacklisted yet. Spotchecking a few usages "references" to this site are either thinly-veiled misuses to promote ongoing fundraisers for various causes, or should be replaced by independent sources for significant donation drives. I'll clean them up, but wanted to check first: have there been any previous discussions about this relatively popular site? (did a Wiki search, but found nothing detailed) GermanJoe ( talk) 22:02, 23 July 2018 (UTC)

@ GermanJoe: plus Added to MediaWiki:Spam-blacklist. -- Dirk Beetstra T C 17:11, 24 July 2018 (UTC)

indiegogo.com

is a similar site with even more dodgy usages in Wikipedia. GermanJoe ( talk) 22:18, 23 July 2018 (UTC)

globalgiving.org

Another crowdfunding platform, this one is focussing on charity projects (see above "Fundraiser websites" for related info and discussion). Links are misused, primarily by undisclosed COI-editors, either for thinly-veiled donation drive promotions or to "verify" irrelevant self-published PR information or to cite the site's obscure internal vetting ratings as some kind of "award" (neither noteworthy nor credible). These usages have zero encyclopedic value and violate several content guidelines. Only a small minority of links, including a few usages in GlobalGiving, are OK-ish but could be handled by whitelisting. GermanJoe ( talk) 12:52, 31 July 2018 (UTC)

@ GermanJoe: per diff I have added the .com. Need to see some data. -- Dirk Beetstra T C 13:00, 31 July 2018 (UTC)
According to COIBot the link has been used approx. 90 times, approx. 10 of these links may be acceptable (although the extensive usage in GlobalGiving needs some trimming anyway). If you need more info or specific examples, please let me know (I am currently working through some of these links, and have yet to come across a really good usage). GermanJoe ( talk) 13:26, 31 July 2018 (UTC)
@ GermanJoe: plus Added to MediaWiki:Spam-blacklist. -- Dirk Beetstra T C 15:06, 31 July 2018 (UTC)
Thank you. Cleanup done (except of some usages in the main article and 2 related topics). GermanJoe ( talk) 16:07, 10 August 2018 (UTC)

discussion crowdfunding sites

I am sympathetic to this, like with petitionsites. Blacklist? -- Dirk Beetstra T C 04:00, 24 July 2018 (UTC)
GoFundMe has little use for ELs on WP, but there are legitimate notable commercial products that use Indiegogo for funding and thus serve as a valid EL for those products (it's basically not quite Kickstarter, but still recognizable). -- Masem ( t) 04:31, 24 July 2018 (UTC)
@ Masem: if they are legitimate notable commercial products then they have an official website I presume. Or do you mean that some of those have it as their official website (and in that case, what would be propotions, is it something that we can do through whitelisting?). To me, the only reason to have the fundraising as an EL is if the fundraising itself is the subject of the article.
I would presume these are pure primary sources (in case used as references). Should in principle be replaced with secondary sources to show that the fact itself is worth mentioning, though unlike with petitions, that may be more difficult to get. -- Dirk Beetstra T C 05:46, 24 July 2018 (UTC)
Currently gofundme has 172 active mainspace links, indiegogo is more common with 768 links (in MER'C extended linksearch). I suspect only a small minority are some sort of legitimate usage and would not be replaceable. If that's really the case at the end, both sites should be blacklisted - but with these numbers it'll take some time to verify the situation more thoroughly. It would be great if other editors could spotcheck a few more of these usages to get a better picture of the situation. I haven't found a valid and irreplaceable usage yet, but have checked only 30-40 cases in detail so far. The most common invalid usages seem to be 1) blatant advertising/spam 2) usage of a redundant link, where an independent source already exists 3) passing mention of a likely unremarkable fundraiser. GermanJoe ( talk) 09:22, 24 July 2018 (UTC)
I would hope legit products have a website or something else besides the fundraiser page. For example Atari VCS (2019 console) (sufficiently notable) is using indiegogo for funding, but we have its official page so don't link the indiegogo page. But if they were using the indiegogo page as their current product page with specifications and everything, we'd likely link that, even if it offered "buy" or "support us" type payment links. -- Masem ( t) 13:18, 24 July 2018 (UTC)
@ Masem: true. Judging from Joe's post, it suggests that most of the current use is not like that. And we have a whitelist for a reason, to me these look like typical sites that get mis/abused (just like with petitions. It is all fun and games, but you get a lot of 'come and save the peanutbutterbadger by signing the petition [here]' on en.wikipedia. Until now, I have only seen one whitelist request for an open petition that succeeded, and maybe a handful of links to closed ones - they basically do not have utility on Wikipedia. That is what I am trying to gauge here as well: how much is mis/abuse, how much is needed. -- Dirk Beetstra T C 13:40, 24 July 2018 (UTC)
That's why I fully agree that gofundme should be blacklisted as spam - I have never seen gofundme used by any legit commercial use that would filter into WP. Indiegogo is still very unlikely to be used in a similar method, but it does have enough "reputation" that can enter into the discussion about a WP standalone topic, but then at that point, most reputable products using indiegogo likely have a better website. So Indiegogo should be an edit filter rather than a blacklist, so that it should warn uses from editing but not block them in the rare case it might be reasonable. -- Masem ( t) 16:02, 24 July 2018 (UTC)
Your remark is rather perpendicular to Joe's "a similar site with even more dodgy usages" .. the first that I tried, Sean Michel, RJ Mitte, Isabel Rosado, Sabina Vajrača and 9000 needles are all dead links. That seems the fate of many links, all dead, see Betzefer for a good example of that.
Taking Sabina Vajrača as an example, the text is 'Summer Abroad (planned)', carrying a link to the fundraising (which, actually, is at www.indiegogo.com/projects/summer-abroad#/). That is exactly the type of primary stuff that we don't want to use - it is not independent, likely a crystal ball, ánd soapboxing. That is also the case with many of the above (if you go to find where the article now actually is), bad primary referencing, that in the case the situation is now is plain soapboxing. As for my mentioned case of petition sites, if something is worth mentioning, it should have independent secondary sources - this is not the use of self-published sources. I have the feeling that Joe's analysis is similar.
The Oatmeal is the first which I think is fine, there the references make sense.
I split up and renamed this section, I will pull the trigger on gofundme.com, although I also think that the second (and all other similar fundraising sites) should go, having the whitelist take care of the rest. IMHO, disruption for the very few links that are genuine will be minimal. -- Dirk Beetstra T C 17:10, 24 July 2018 (UTC)
I'll clean up the gofundme cases over time, but frankly don't feel like looking into all 800 Indiegogo links. Anyway, like Beetstra I believe a blacklist with occasional whitelist requests is needed for both sites (and similar cases) to push back this kind of misuse. When I have some time, I'll also think about a clarification of WP:RS for such sites: links to active petitions and fundraisers should never be acceptable as refs or ELs, unless the fundraiser itself is a notable topic. Both cases should be explicitly mentioned in the guideline. GermanJoe ( talk) 20:58, 24 July 2018 (UTC)
I support blanket blacklisting all crowdfunding websites. The situation is qualitatively similar to cryptocurrencies, with a couple of orders of magnitude less money. I'm quite surprised crowdfunding fraud is not a bigger deal, and we don't see as much spamming. Professional, legit, notable crowdfunds should have an official website, and the amount of funding and progress would likely be covered by secondary sources. There should be no need to link to a crowdfunding page. MER-C 10:28, 25 July 2018 (UTC)
@ MER-C: the 'spamming' with these sites is likely the same type as for petition sites - a couple of people adding one particular petition to one particular page on Wikipedia, and that happens then with many individual causes (with for each cause a different group of people and a different link). Not the typical one person adding multiple links to multiple pages. Patterns is similar to pornhub - many schoolkids who add it to the wikipedia page of their school. No 'spamming', just abuse on many individual fronts (for the notable porn sites I have never seen spamming campaigns by SEOs or people from the sites on Wikipedia ...).
For the notable crowdfunding websites we would follow the same as for other websites, we whitelist an index.htm, or an about page. I am a bit weary to pull the trigger on the other one with 800 pages linking to it, that may cause a stirr. -- Dirk Beetstra T C 13:42, 25 July 2018 (UTC)
I have started a discussion at WT:RS to clarify the guideline itself regarding this aspect. GermanJoe ( talk) 16:56, 29 July 2018 (UTC)

DarkComet

DarkComet appears to be undergoing an edit-war between two competing domains each claiming to be the official domain hosting DarkComet, a RAT program. A source appearing to be some sort of cracking or hacking enthusiast site is used as the source. This source purports to be the biography of the RAT's author. This does not appear to be a reliable, mainstream media outlet source. Indeed, such a source likely doesn't exist, as mainstream media would not point you toward the specific website for a RAT software. Currently, two editors are involved:

PhrozenSAS ( talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam) This user states that the website is darkcomet-rat.com: Linksearch en (insource) - meta - de - fr - simple - wikt:en - wikt:fr • MER-C X-wiki • gs • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced - RSN • COIBot- Link, Local, & XWiki Reports - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.com , which is on the cited source.

DarkCometRat ( talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam) This user states that the website is darkcometrat.com: Linksearch en (insource) - meta - de - fr - simple - wikt:en - wikt:fr • MER-C X-wiki • gs • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced - RSN • COIBot- Link, Local, & XWiki Reports - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.com , which is not on the cited source.

Because at least one of the sites must be fake (why would a RAT programmer create two sites that each say the other is fake?) and the source given is unreliable, I have removed the external link for the time being and demanded page protection on the relevant noticeboard.

It is also to be noted that there is a technical irregularity: when the "website" section of the infobox is removed, the website defaults to phrozensoft.com: Linksearch en (insource) - meta - de - fr - simple - wikt:en - wikt:fr • MER-C X-wiki • gs • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced - RSN • COIBot- Link, Local, & XWiki Reports - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.com . This occurs even though the website does not appear in the wikicode source. Given the fact that the article relates to a hacking tool, and someone who has the knowledge to create a RAT tool or modify a hacking tool to add a backdoor or scam people might have the technical prowess to hack a website, such technological irregularities are suspicious and demand attention. EDIT: I confirmed that this is not due to hacking but rather because it's on WikiData.-- Leugen9001 ( talk) 04:10, 9 August 2018 (UTC)

Note: Wired links to darkcomet-rat.com (with a dash) as the correct official website. -- Leugen9001 ( talk) 04:30, 9 August 2018 (UTC)
@ Leugen9001: I am undeleting your post again, we need to see which are the not-official one, and decide on blacklisting them. -- Dirk Beetstra T C 17:01, 9 August 2018 (UTC)
@ Leugen9001:The mysterious website is probably coming from Wikidata - that will need to be changed to the correct page, whatever it is. Ravensfire ( talk) 22:34, 9 August 2018 (UTC)
Note that DarkCometRat modified Leugen9001's post above, modifying its meaning. I have reverted the changes. DarkCometRat, if you would like to comment, you may do so below; please do not modify other editors' comments. – FlyingAce ✈hello 23:30, 9 August 2018 (UTC)
I believe that the one with the single dash (www.darkcomet-rat.com) is the real one. (To ensure that the url is not edited, check history. MD5 hash of url without http or slashes: 910ea0677d9759b87790cffa4706753d. First 4 letters "September 10th Electronic Arts".) The website with the dash says that DarkComet is no longer offered, consistent with reliable reports from Symantec and Wired. Livehacking and Wired also link to it as the real official website, with Wired claiming to have spoken to the creator of the hacking tool. If I was trying to trick others into downloading a fake version of DarkComet boobytrapped with some backdoor, I would at least provide an install link. It likely that User:PhrozenSAS is indeed telling the truth. -- Leugen9001 ( talk) 17:38, 10 August 2018 (UTC)
Should we even have an official website link for a trojan? Daß  Wölf 01:27, 10 August 2018 (UTC)
@ Daß Wölf: we generally link to the official website of a subject. -- Dirk Beetstra T C 18:49, 10 August 2018 (UTC)
Sorry, I was under the impression that the site was currently offering malware. It seems from Leugen9001's comment above that it isn't the case. Daß  Wölf 19:54, 11 August 2018 (UTC)

If anything is better blacklisted, please report this at meta (as clearly we already have WD involved). -- Dirk Beetstra T C 18:49, 10 August 2018 (UTC)

Here are two additional links that prove darkcomet-rat.com is the genuine one. See : https://www.theregister.co.uk/2012/07/10/darkcomet_rat_killed_off/ and https://www.bbc.com/news/technology-18783064 PhrozenSAS ( talk) 19:03, 10 August 2018 (UTC)

espressogurus.com

Refspamming espressogurus.com into multiple articles. ☆ Bri ( talk) 03:11, 12 August 2018 (UTC)

User warned, lets see if this progresses. -- Dirk Beetstra T C 04:35, 12 August 2018 (UTC)

Cafe Flore

Not quite your typical report, but I think this project might be able to help (or direct me to the right place). Cafe Flore is a probably notable place, but the current version of the article is mostly promotional in tone and sourced to a lot of questionably reliable sources. I've removed the most spammy section - a listing of non-notable awards added by an SPA - several times and been reverted by an IP each time. (The IPs know about the revert function, which sets off some other bells, but that's a separate issue). I'd appreciate some eyes on the article, and perhaps some help paring it down to a non-promotional article. Pi.1415926535 ( talk) 06:58, 17 August 2018 (UTC)

IP


61.94.225.87 ( talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot) Keeps posting link to "2018 MTV Video Music Awards FuLLSHOW." Cornerstonepicker ( talk) 02:20, 20 August 2018 (UTC)

elections-2019.com

elections-2019.com: Linksearch en (insource) - meta - de - fr - simple - wikt:en - wikt:fr • MER-C X-wiki • gs • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced - RSN • COIBot- Link, Local, & XWiki Reports - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.com -- various ips inserting this spam website in popular political pages of India to get traffic from Wikipedia [1] , [2] -- Adamstraw99 ( talk) 10:59, 24 August 2018 (UTC)

Refspammer

176.134.25.4 ( talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
31.39.54.184 ( talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
92.128.18.116 ( talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
92.128.94.94 ( talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)

Not sure if this or COIN is a better place to report long-term refspam. Stumbled across the first IP above when they added an item to the reflist on the utopia article. A closer look showed that they had added works by the same author to a whole bunch of articles, even creating new bibliography sections just to add one of their works, with no real additions to the articles themselves. All reverted.

I did a quick search for the author, Yann Rocher, and found refspam going as far back as 2010. The IPs above are just those which had added content that was still in the article. Others may exist that had since been reverted (i.e. I used a normal search for the author). All removed at this point, but reporting here given it looks like a long-term thing. — Rhododendrites talk \\ 18:17, 24 August 2018 (UTC)

Quick ping for Anita5192, who saw and reverted a couple of them, too. — Rhododendrites talk \\ 18:18, 24 August 2018 (UTC)
I first saw this editing behavior at Sphere with this edit. Similarly to what is written above, I saw in 176.134.25.4 a long sequence of similar insertions, mostly unreferenced, and barely relevant to the articles. I reverted a few of them.— Anita5192 ( talk) 19:33, 24 August 2018 (UTC)

Someone please create an AbuseFilter set to warn. If that isnotheeded, we set it to block. -- Dirk Beetstra T C 20:20, 24 August 2018 (UTC)

Long-term spamming and self-promotion by Japanese IPs

Domains/URLs

No post yet, but owned by the same person so may be worth preemptively blocking:

Note Blogspot used to redirect to country-specific sites from 2013 to 2018, so some of the links were under .jp rather than .com.

Spammer's IPs

Registered account

IPs from Japan have been posting links to these websites and blogs run by the same person ( [3] [ archive], [http://gengobunka.web.fc2.com/] [[http://web.archive.org/web/20180710010247/http://gengobunka.web.fc2.com/ archive]]) starting as early as in 2014, despite having been warned and blocked at least twice in 2016/2017. Googling the blogger's name in Japanese or in the romanized form returns only a few dozen results, so the blogs definitely don't qualify as reliable self-published sources (however, there's a twist to it—see below).

Considering these IPs have contributed nothing but links to these websites, except for this addition of "By Imawo Aikawa" to such a link (and a few other things—see below), the IPs are clearly driven purely by vanity and self-promotion, rather than intent to help build an encyclopedia. Also, the fact that the spammer changed their IP eight times within a matter of 25 hours (despite using the same ISP) is possibly a sign of intention to evade scrutiny.

I have a deep suspicion that this "Imawo Aikawa" person is an alter ego of the Japanese linguist Isamu Hayakawa. The only thing these IPs have done apart from adding spam links and "By Imawo Aikawa" is add "citations", to no particular claim in an article, to Hayakawa's work, and add "By Isamu Hayakawa" to a link to [http://gengobunka.web.fc2.com/ a website credited solely to "Imawo Aikawa"]. In addition, the Japanese Wikipedia's article on Hayakawa, which includes a link to the said site and is completely unsourced by the way, has been created and substantially edited almost exclusively by IPs, including some of the spamming IPs listed above ( 180.49.196.198 [ ja], 153.193.78.105 [ ja], 180.33.121.229 [ ja], 180.33.81.66 [ ja]). Aside from editing Hayakawa's article, all they have done on the Japanese Wikipedia is posted spam links and citations in the exact same manner as on the English WP.

However, the claims in the Japanese article do check out, such as him having been a professor at Aichi University, and receiving a shout-out from the OED for his research. Amazon has his books about English lexicography, such as Johnson's and Webster's dictionaries. So he is apparently already a reputable scholar, making it seem quite strange he needs so much promotion, because other people are going to write about such a respected scholar anyway. I suspect participating in this kind of blatant and persistent spamming and self-promotion only tarnishes his reputation.

A coincidence or not, the most recent IPv6 addresses above are all tied to Chubu Telecommunications, which operates in Aichi Prefecture, where his university is situated.

I think we should blacklist these domains/URLs. Nardog ( talk) 15:03, 19 August 2018 (UTC)

I support blacklisting these domains. Academic spam is still spam. Pi.1415926535 ( talk) 23:42, 20 August 2018 (UTC)
@ Nardog: plus Added to MediaWiki:Spam-blacklist. -- Dirk Beetstra T C 20:27, 24 August 2018 (UTC)

numerentur.org

numerentur.org: Linksearch en (insource) - meta - de - fr - simple - wikt:en - wikt:fr • MER-C X-wiki • gs • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced - RSN • COIBot- Link, Local, & XWiki Reports - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.com — various accounts inserting this Spanish website into English-language articles.— Anita5192 ( talk) 18:36, 25 August 2018 (UTC)

For example, [4] by 37.13.191.7 ( talk), [5] by Nikola90madrid ( talk | contribs), [6] by 2.137.210.194 ( talk), [7] by Gail carpenter1 ( talk | contribs).— Anita5192 ( talk) 18:54, 25 August 2018 (UTC)

[The site I have included does not sell or buy anything and has no advertising. If there is an error? Apologies. Gail] — Preceding unsigned comment added by Gail carpenter1 ( talk • contribs) 19:21, 25 August 2018 (UTC)

hobbymodelguide.com

SPA appears to be following the formula of finding dead links and replacing them with their website, often (or always?) containing an archived copy of the very same dead link. ☆ Bri ( talk) 17:20, 25 August 2018 (UTC)

I see three instances, so far. It is possible the editor has simply found a site that has archived pages relating to modeling, and is using it to repair dead links. The pages linked do not carry advertising, and don't seem to be promotional, and apparently do contain the same information that was at the now-dead links. In at least one case, it appears that the editor fixed a dead link that could not be recovered from the WayBack Machine. I recommend that we wait and see if more of a pattern emerges. - Donald Albury 18:43, 25 August 2018 (UTC)
It's a known abuse pattern. Blanking this thread certainly doesn't help this user's cause. MER-C 18:49, 25 August 2018 (UTC)
I am confused. The user has no User Talk page and has never had a warning or anything and yet, somehow, they find their way here. How did they even know to look here? They only have 4 edits to their name and all from today. A genuine new user would probably not know about this page. This makes me suspicious. (Also, they probably should be given notification and a warning.) -- DanielRigal ( talk) 18:57, 25 August 2018 (UTC)
Could be a ping. I've left a level 3 warning, and intend to block if the spamming continues. MER-C 19:04, 25 August 2018 (UTC)
The website is a paid referer to Amazon and all the articles there are written by a Peter Melville. Lyndaship ( talk) 18:53, 25 August 2018 (UTC)

Sorry for my changes. I actually didn't know that I broke some rules. I'll never do this again. Could you please remove my site from spam section? Petermelville ( talk) 19:18, 25 August 2018 (UTC)

On page /info/en/?search=Solid-propellant_rocket Dead link to http://www.pw.utc.com/StaticFiles/Pratt%20.../Products/.../pwr_rl10b-2.pdf was complemented with archived copy http://web.archive.org/web/20120326211303/http://www.pw.utc.com/products/pwr/assets/pwr_rl10b-2.pdf Petermelville ( talk) 20:14, 25 August 2018 (UTC)

On page /info/en/?search=Safir_(models) dead link http://supersafir.wifeo.com/documents/2012-10-31-Les-miniatures-JADALI-chapitre-1.pdf updated to its newer version http://supersafir.wifeo.com/documents/2013-10-20-Chapitre-1---Histoire-des-miniatures-Jadali.pdf Petermelville ( talk) 20:25, 25 August 2018 (UTC) Petermelville ( talk) 20:28, 25 August 2018 (UTC)

On page /info/en/?search=Safir_(models) dead link http://supersafir.wifeo.com/documents/2013-04-27-Chapitre-5.pdf updated to its newer version http://supersafir.wifeo.com/documents/2013-10-20-Chapitre-5---Les-Jadali-SIFMA.pdf Petermelville ( talk) 20:25, 25 August 2018 (UTC) Petermelville ( talk) 20:28, 25 August 2018 (UTC)

User:Aadil1 persistently inserting spam links

Aadil1 ( talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam) has been repeatedly warned against inserting spam links but persists. He or she has most commonly added links to eztalks.com: Linksearch en (insource) - meta - de - fr - simple - wikt:en - wikt:fr • MER-C X-wiki • gs • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced - RSN • COIBot- Link, Local, & XWiki Reports - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.com . ElKevbo ( talk) 04:16, 26 August 2018 (UTC)

Blocked indefinitely as spam-only account. - Donald Albury 22:04, 26 August 2018 (UTC)

ecopainting.ca

ecopainting.ca: Linksearch en (insource) - meta - de - fr - simple - wikt:en - wikt:fr • MER-C X-wiki • gs • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced - RSN • COIBot- Link, Local, & XWiki Reports - Wikipedia: en - fr - de • Google: search • meta • Domain: domaintools • AboutUs.com

Repeatedly spammed into House painter and decorator by a variety of IPs. - Julietdeltalima (talk) 00:32, 29 August 2018 (UTC)

@ Julietdeltalima: plus Added to MediaWiki:Spam-blacklist. -- Dirk Beetstra T C 02:35, 29 August 2018 (UTC)

Hard money loan

Repeated addition of a spam link here. Not sure if anything can be done, besides keeping an eye on it, but mentioning it here. Pinkbeast ( talk) 01:14, 29 August 2018 (UTC)

@ Pinkbeast: I have protected the page. Blacklisting will be the next step if discussion is not forthcoming. -- Dirk Beetstra T C 02:39, 29 August 2018 (UTC)

Photospherix

-- MarioGom ( talk) 15:53, 29 August 2018 (UTC)

Retrieved from " https://en.wikipedia.org/?title=Wikipedia_talk:WikiProject_Spam/2018_Archive_Aug_1&oldid=1135206803"