Wikipedia talk:WikiProject Spam/2012 Archive Aug 1

User:Sobur09
is spamming his user page/user talk page (and mine). is doing the same stuff (possible sock puppet). --Vincent Liu (something to say?) 04:26, 1 August 2012 (UTC)

affiliatefuture.com



 * Spammers

No redeeming value. MER-C 10:23, 1 August 2012 (UTC)

diplomacy.edu Spamming



 * Accounts
 * Accounts

--Hu12 (talk) 17:41, 1 August 2012 (UTC)

Return of Product Development Institute and Stage-Gate International Spamming



 * Spammed


 * Article Spam


 * User:EmirOzdemir10/Stage-Gate International
 * Accounts
 * User:EmirOzdemir10/Stage-Gate International
 * Accounts
 * User:EmirOzdemir10/Stage-Gate International
 * Accounts
 * Accounts

(Emir Ozdemir, Product Manager)  (Marketing Communications at Stage-Gate Inc)      (Daniel Krempa. Director of Digital Platforms at Stage-Gate Inc)  (Marketing Communications at Stage-Gate Inc)  (Izabella Lis. Product Manager at Stage-Gate International)   --Hu12 (talk) 22:53, 1 August 2012 (UTC)

Virtual Medical Centre Adsense link-farming Spam



 * Articles
 * Articles
 * Articles
 * Articles
 * Articles


 * Accounts
 * Accounts

Long term multi-article, multiple Adsense related domains. replacing existing links with ones own link is never a sign of good faith. --Hu12 (talk) 03:23, 2 August 2012 (UTC)

DocuWare Spamming



 * Article spam
 * DocuWare
 * DocuWare
 * DocuWare
 * DocuWare
 * DocuWare
 * DocuWare

de:Benutzer:ECMdoku/DocuWare
 * Accounts
 * Accounts


 * es:Special:Contributions/ECMdoku
 * it:Special:Contributions/ECMdoku
 * fr:Special:Contributions/ECMdoku
 * de:Special:Contributions/ECMdoku


 * es:Special:Contributions/Docuware s.l.


 * es:Special:Contributions/85.48.252.237


 * es:Special:Contributions/88.30.0.28

--Hu12 (talk) 10:56, 2 August 2012 (UTC)

imcredel.com

 * links


 * accounts

Multiple SPA accounts adding misleading links and hijacking existing "official links" from multiple articles to point to this site. --- Barek (talk • contribs) - 04:14, 3 August 2012 (UTC)

seeraa.com



 * Spammers

MER-C 12:24, 3 August 2012 (UTC)

silsila-e-iftekhari.com Spamming

 * Accounts
 * Accounts


 * http://en.wikisource.org/wiki/Special:Contributions/203.192.219.202
 * http://en.wikisource.org/wiki/Special:Contributions/203.192.219.202
 * http://en.wikisource.org/wiki/Special:Contributions/203.192.219.202
 * http://en.wikisource.org/wiki/Special:Contributions/203.192.219.202
 * http://en.wikisource.org/wiki/Special:Contributions/203.192.219.202

Spam attack the last 2 days--Hu12 (talk) 19:52, 3 August 2012 (UTC)

packershalloffame.com Spamming



 * Accounts
 * Accounts

--Hu12 (talk) 20:13, 3 August 2012 (UTC)

Joseph Di Virgilio Long term promotion
(old) Conflict_of_interest/Noticeboard/Archive_15
 * Wikipedia talk:Articles for creation/Joseph Di Virgilio
 * Wikipedia talk:Articles for creation/Joseph Di Virgilio
 * Wikipedia talk:Articles for creation/Joseph Di Virgilio
 * Wikipedia talk:Articles for creation/Joseph Di Virgilio


 * Accounts



--Hu12 (talk) 02:16, 4 August 2012 (UTC)

radioguide.fm



 * Adsense related
 * Accounts
 * Accounts
 * Accounts
 * Accounts

--Hu12 (talk) 17:14, 5 August 2012 (UTC)

www.mariocorp.com

 * Also 86.126.5.148
 * Also www.mariocorp.ro

History of Italian fashion Milan Fashion Week Italian fashion

Classic: adding new copy of link immediately following a previous insertion October 2011. Paid by the keystroke? Shenme (talk) 04:59, 6 August 2012 (UTC)

hoparoundindia.com
Anyone have time to look into this link? I saw that had been adding it and similar links across many articles, which I believe have all been removed, but the number of remaining links suggests others have been doing the same. --Ronz (talk) 15:48, 23 July 2012 (UTC)


 * has been adding it in a similar manner. Needs cleanup. --Ronz (talk) 03:19, 24 July 2012 (UTC)

--Ronz (talk) 16:51, 24 July 2012 (UTC)
 * Most of the remaining links that I've seen were added as references. Refspam perhaps? Its hard to tell if the site is reliable, Indian geography isn't really my field. If the site is reliable I'd say it isn't doing any harm as a reference.  Them  From  Space  17:07, 25 July 2012 (UTC)
 * Adsense related
 * --Hu12 (talk) 19:39, 25 July 2012 (UTC)
 * --Hu12 (talk) 19:39, 25 July 2012 (UTC)
 * --Hu12 (talk) 19:39, 25 July 2012 (UTC)
 * --Hu12 (talk) 19:39, 25 July 2012 (UTC)
 * --Hu12 (talk) 19:39, 25 July 2012 (UTC)
 * --Hu12 (talk) 19:39, 25 July 2012 (UTC)

The site is clearly intended to promote tourism. I don't see any indication that they meet WP:RSN criteria in any way. --Ronz (talk) 15:30, 26 July 2012 (UTC)


 * These could all be the same person. --Ronz (talk) 15:55, 27 July 2012 (UTC)
 * Also found on fa fwiw. Many on en are from, who started posting them on 19 March.LeadSongDog come howl!  22:05, 27 July 2012 (UTC)
 * Sorry, but "fa" = Farsi? --Ronz (talk) 13:50, 28 July 2012 (UTC)
 * Googling finds  and  in addition to all the English pages. LeadSongDog  come howl!  23:45, 29 July 2012 (UTC)
 * Looks is an author of articles at hoparoundindia.com  --Ronz (talk) 23:45, 30 July 2012 (UTC)
 * One editor added it a source when they had difficulty finding anything better. While he agrees it's promotional in nature, I'm not against keeping it for clear statements of fact about locations or regions, but not for history, religion, etc, and certainly not for listing "local attractions." --Ronz (talk) 15:53, 1 August 2012 (UTC)
 * I've found a few more editors using it as a reference. --Ronz (talk) 16:19, 4 August 2012 (UTC)
 * These could all be the same person. --Ronz (talk) 15:55, 27 July 2012 (UTC)
 * Also found on fa fwiw. Many on en are from, who started posting them on 19 March.LeadSongDog come howl!  22:05, 27 July 2012 (UTC)
 * Sorry, but "fa" = Farsi? --Ronz (talk) 13:50, 28 July 2012 (UTC)
 * Googling finds  and  in addition to all the English pages. LeadSongDog  come howl!  23:45, 29 July 2012 (UTC)
 * Looks is an author of articles at hoparoundindia.com  --Ronz (talk) 23:45, 30 July 2012 (UTC)
 * One editor added it a source when they had difficulty finding anything better. While he agrees it's promotional in nature, I'm not against keeping it for clear statements of fact about locations or regions, but not for history, religion, etc, and certainly not for listing "local attractions." --Ronz (talk) 15:53, 1 August 2012 (UTC)
 * I've found a few more editors using it as a reference. --Ronz (talk) 16:19, 4 August 2012 (UTC)

I'm done with this. There are currently 32 links still, but most are from other editors made in good faith. I'm sure I missed a few by Rkiran t, but I'm not going back to find them. --Ronz (talk) 17:21, 6 August 2012 (UTC)

2012-london-olympics-news.com and dhruvplanet.com - can someone look into this?

 * Related links
 * Editors
 * Related links
 * Editors
 * Editors
 * Editors
 * Editors
 * Editors
 * Editors






 * Probably should be considered for immediate blacklisting given the problems with the related links --Ronz (talk) 14:16, 28 July 2012 (UTC)
 * Cleanup of 2012-london-olympics-news.com done.
 * (As an aside, it looks like there are other bloggers doing the same thing: creating websites to carry news related to the Olympics, then spamming them to Wikipedia.) --Ronz (talk) 03:50, 29 July 2012 (UTC)
 * The site appears to be plagiarizing articles. --Ronz (talk) 21:30, 29 July 2012 (UTC)
 * I've requested that 202.134.156.161 be blocked as the only one continuing to spam the olympic site. Still looking at the other sites... --Ronz (talk) 19:54, 30 July 2012 (UTC)
 * A number of editors have noted that dhruvplanet.com articles sometimes mirror Wikipedia articles, and have removed them as unreliable and plagiarizing. --Ronz (talk) 22:12, 6 August 2012 (UTC)
 * Previous incidents:
 * Wikipedia talk:WikiProject Spam/2010 Archive May 1
 * Wikipedia talk:WikiProject Spam/2010 Archive Aug 1
 * MER-C 11:33, 31 July 2012 (UTC)
 * Cleanup of dhruvplanet.com done. Found rupeeinvest.com spamming as well, which shares same host and adsense pub-9445189103749654. --Ronz (talk) 22:44, 6 August 2012 (UTC)
 * Cleanup of rupeeinvest.com done. --Ronz (talk) 03:28, 7 August 2012 (UTC)
 * Cleanup of rupeeinvest.com done. --Ronz (talk) 03:28, 7 August 2012 (UTC)

Technofix book/cite Spamming

 * Accounts
 * Accounts


 * "Huesemann, M.H., and J.A. Huesemann (2011). http://www.technofix.org Technofix: Why Technology Won’t Save Us or the Environment, New Society Publishers, Gabriola Island, British Columbia, Canada,"

--Hu12 (talk) 01:47, 7 August 2012 (UTC)

*codedatabase.com Spamming

 * Accounts
 * Accounts
 * Accounts
 * Accounts
 * Accounts

--Hu12 (talk) 02:33, 7 August 2012 (UTC)

martinlawfirm.com



 * Spammers

MER-C 09:53, 31 July 2012 (UTC)
 * Updated. MER-C 10:24, 5 August 2012 (UTC)
 * MER-C 10:38, 7 August 2012 (UTC)

latestmoviez.com

 * Spam pages


 * Sites spammed
 * redirects to latestmoviez.com
 * redirects to latestmoviez.com
 * redirects to latestmoviez.com


 * redirects to latestmoviez.com
 * redirects to latestmoviez.com


 * redirects to latestmoviez.com
 * redirects to latestmoviez.com




 * Spammers

MER-C 12:36, 13 July 2012 (UTC)
 * Updated. MER-C 09:51, 15 July 2012 (UTC)
 * to the local blacklist. ~Amatulić (talk) 15:22, 15 July 2012 (UTC)

Post-blacklist spamming:


 * Spammers

MER-C 10:02, 20 July 2012 (UTC)


 * Continued:


 * MER-C 01:56, 21 July 2012 (UTC)
 * Also, plain text spamming. MER-C 06:21, 22 July 2012 (UTC)
 * MER-C 01:56, 21 July 2012 (UTC)
 * Also, plain text spamming. MER-C 06:21, 22 July 2012 (UTC)
 * MER-C 01:56, 21 July 2012 (UTC)
 * Also, plain text spamming. MER-C 06:21, 22 July 2012 (UTC)
 * MER-C 01:56, 21 July 2012 (UTC)
 * Also, plain text spamming. MER-C 06:21, 22 July 2012 (UTC)

Another day, another domain:



MER-C 01:50, 23 July 2012 (UTC)


 * I note that the latter 2 are redirect domains (which should be on meta without even thinking about it) - I've instructed XLinkBot to do whack-a-mole. --Dirk Beetstra T  C 06:49, 23 July 2012 (UTC)





MER-C 11:08, 3 August 2012 (UTC)
 * Rangeblocked
 * (up to 512 users would be blocked)
 * --Hu12 (talk) 19:26, 3 August 2012 (UTC)
 * (up to 512 users would be blocked)
 * --Hu12 (talk) 19:26, 3 August 2012 (UTC)



I'm not going to bother listing the spammers any more. MER-C 09:35, 7 August 2012 (UTC)

Forgotten opera singers



 * Users

Sock started after first sockmaster got blocked. Same articles, same inserted text. --Dirk Beetstra T C 10:30, 7 August 2012 (UTC)

geekscholars.com
The editor who created GeekScholars Movie News, which was speedied, has been adding film ratings from this blog to many articles. Attempts to remove them were immediately reverted by the editor who added them. I can't find any evidence from other sites that this blog is notable, and the many additions appear to be promotional. Trying to discuss it with the editor in this discussion at my talk page and at User talk:Mrfoxinabox, but any advice and help from admins would be useful. Lone boatman (talk) 14:30, 7 August 2012 (UTC)
 * links


 * accounts

eyetwitchingcure.org

 * links:


 * unambiguous advert page created:


 * accounts:

Spamming of URL into multiple articles by SPA accounts. --- Barek (talk • contribs) - 16:03, 8 August 2012 (UTC)

Leafly



 * Article
 * Article


 * Accounts
 * Accounts

--Hu12 (talk) 03:01, 9 August 2012 (UTC)

xt3.com
Continuous pushing, see ANI thread Administrators%27_noticeboard/Incidents.



Final warning given. Creating this report 'for the record'. --Dirk Beetstra T C 07:08, 9 August 2012 (UTC)

Long term mdct.com.au Spamming

 * Accounts
 * Accounts

Long term(2007) persistant spamming including Link vandalism;. --Hu12 (talk) 13:43, 9 August 2012 (UTC)

R To Z Media Spamming



 * Accounts
 * Accounts

Randi Zuckerberg's company. --Hu12 (talk) 13:43, 10 August 2012 (UTC)

92.251.229.192
-

IP adding spam link to talk pages. --Nathan2055talk - contribs 01:14, 12 August 2012 (UTC)

Triplett, J. M WP:BOOKSPAM

 * Accounts

--Hu12 (talk) 00:38, 13 August 2012 (UTC)

Bertrand Moingeon ‎WP:BOOKSPAM

 * Articles


 * Accounts
 * Accounts
 * Accounts

--Hu12 (talk) 13:12, 13 August 2012 (UTC)

HospitalGlobal

 * Accounts
 * Accounts
 * Accounts

Clear promotion additions (domain created:7/24/2012)-Hu12 (talk) 14:10, 13 August 2012 (UTC)

Oxford Bibliographies WP:SOCK Spamming

 * Accounts
 * Accounts

OXFORD UNIVERSITY PRESS OXFORD-U61-77-128 --Hu12 (talk) 17:15, 13 August 2012 (UTC)
 * --Hu12 (talk) 17:24, 13 August 2012 (UTC)

Long term spamming by logos.com
User has been spamming links for logos.com bible software products for at least three years, continuing in spite of eight warnings over the years, and a final warning four days ago. To add to the cynicism of this 'user,' they are spamming from the logos.com owned email server, which also geolocates to their corporate headquarters in Bellingham, Washington. A longer than typical block is warranted in my opinion. First Light (talk) 00:13, 15 August 2012 (UTC)
 * Tracking. MER-C 01:43, 15 August 2012 (UTC)
 * The static IP range occupied by Logos Research Systems, Special:Contributions/216.57.209.224/27, is now blocked for 5 years, including blocking the ability for logged-in users to edit from that range. The .250 address in this range as well as .252 was responsible for similar linkspam. ~Amatulić (talk) 21:02, 15 August 2012 (UTC)
 * Many thanks. I see they continued to spam even after I posted here (and before your block, of course). First Light (talk) 21:46, 15 August 2012 (UTC)
 * Many thanks. I see they continued to spam even after I posted here (and before your block, of course). First Light (talk) 21:46, 15 August 2012 (UTC)

Tarai Dooars Tour & Travels Spam



 * Accounts
 * Accounts

--Hu12 (talk) 13:14, 15 August 2012 (UTC)

Return of Long term doabaheadlines.co.in Citespam

 * Wikipedia_talk:WikiProject_Spam/2010_Archive_Nov_1

Articles
 * Accounts
 * Accounts
 * Accounts
 * Accounts

Asside from the MASS recent WP:CITESPAMming, activity also involes replaceing established reliable sources (such as the official Olympic site (london2012.com)) with this unreliable spam. Others have also noticed this behavior. I find it very telling that, Money would be on the mind of this editor --Hu12 (talk) 13:50, 15 August 2012 (UTC)

Fleming Europe Promotion



 * Articles
 * Articles


 * Wikipedia talk:Articles for creation/CEE Retail Banking Conference
 * Wikipedia talk:Articles for creation/Collateral Management Conference
 * Accounts
 * Accounts

Marketing Executive chez Fleming Europe
 * cs:Special:Contributions/178.40.21.207

--Hu12 (talk) 13:39, 16 August 2012 (UTC)

ForexPeaceArmy.com



 * Accounts
 * Accounts

Spamming, with an agenda.--Hu12 (talk) 23:01, 16 August 2012 (UTC)

Tattoo spamming
Anonymous IPs mass spamming to. Please blacklist. -Crushspam (talk) 06:38, 17 August 2012 (UTC)

DVBViewer promotion

 * Articles
 * Articles
 * Articles


 * Accounts
 * Accounts

--Hu12 (talk) 21:35, 10 August 2012 (UTC)


 * More showed up in the Articles for deletion/DVBViewer debate

--Hu12 (talk) 14:40, 14 August 2012 (UTC)
 * It appears that is the re-creator of the articles (as evidenced by this post) and is the author of DVBViewer.--Hu12 (talk) 19:57, 15 August 2012 (UTC)
 * Tag removal--Hu12 (talk) 01:13, 18 August 2012 (UTC)
 * Tag removal--Hu12 (talk) 01:13, 18 August 2012 (UTC)

spoturtrain.com

 * Accounts
 * Accounts

--Hu12 (talk) 01:24, 18 August 2012 (UTC)

spiralpointtaps.com

 * link


 * related link


 * previous report
 * Wikipedia talk:WikiProject Spam/2012 Archive Jul 1


 * new involved accounts

Repeated addition of blog front-end that links heavily and exclusively to taylortool.com. --- Barek (talk • contribs) - 16:11, 16 August 2012 (UTC)


 * 69.166.19.6 tried to delete this Wikiproject Spam section a few hours ago.


 * Now the IP has spammed cross-wiki:
 * wikt:en:Special:Contributions/69.166.19.6
 * -- A. B. (talk • contribs) 21:43, 20 August 2012 (UTC)

irishcountry.ie Spamming



 * Accounts
 * Accounts

--Hu12 (talk) 17:17, 19 August 2012 (UTC)

Snodger Media Spamming



 * Analytics related
 * Articles
 * Articles
 * Articles


 * Accounts
 * Accounts
 * Accounts
 * Accounts

Site is essentially a fork of wikipedia, fails WP:EL WP:RS--Hu12 (talk) 15:05, 20 August 2012 (UTC)

Oleg Prikhodko Spamming

 * Accounts
 * Accounts


 * ru:Special:Contributions/213.191.26.28
 * ru:Special:Contributions/213.191.26.28


 * ru:Special:Contributions/217.114.226.247
 * ru:Special:Contributions/217.114.226.247


 * ru:Special:Contributions/128.75.9.252
 * ru:Special:Contributions/128.75.9.252


 * ru:Special:Contributions/128.75.47.1
 * ru:Special:Contributions/128.75.47.1


 * ru:Special:Contributions/128.75.27.53
 * ru:Special:Contributions/128.75.27.53


 * ru:Special:Contributions/213.191.8.62
 * ru:Special:Contributions/213.191.8.62


 * ru:Special:Contributions/128.75.22.169
 * ru:Special:Contributions/128.75.22.169

--Hu12 (talk) 00:30, 21 August 2012 (UTC)

hazardousareas.net



 * Accounts
 * Accounts

--Hu12 (talk) 00:39, 21 August 2012 (UTC)

arbitrarytweets.com



 * Spammers

MER-C 12:32, 21 August 2012 (UTC)

related spam sites

 * Accounts
 * Accounts
 * Accounts
 * Accounts
 * Accounts
 * Accounts
 * Accounts
 * Accounts
 * Accounts
 * Accounts
 * Accounts
 * Accounts

Sock spamming related sites and moving ones own link "UP" is never a sign of good faith.--Hu12 (talk) 18:25, 21 August 2012 (UTC)
 * There are a few more userIDs matching these user name patterns in my recent blocks - all were found via CU. -- Versa geek  18:39, 21 August 2012 (UTC)
 * Got em, thanks--Hu12 (talk) 22:23, 21 August 2012 (UTC)
 * Got em, thanks--Hu12 (talk) 22:23, 21 August 2012 (UTC)

Grime Digital Spamming



 * Related
 * Accounts
 * Accounts
 * Accounts
 * Accounts
 * Accounts
 * Accounts
 * Accounts
 * Accounts
 * Accounts


 * "Grime Digital is a collective of like minded people working together to improve the online presence of Grime" - grimedigital.com footer

Spamming categories multiple times is never a sign of good faith.--Hu12 (talk) 14:55, 22 August 2012 (UTC)

Outsource Infotech Services

 * links


 * related sites


 * accounts

Blatant advert linkspam by SPA/COI user. --- Barek (talk • contribs) - 17:42, 24 August 2012 (UTC)

hairsaloninclearwater.com



 * Spammers

MER-C 12:10, 15 August 2012 (UTC)
 * Shared IP. MER-C 10:47, 21 August 2012 (UTC)
 * Shared IP. MER-C 10:47, 21 August 2012 (UTC)


 * The first three IPs are in Florida, as is the hair salon. At least one has been identified as a source of forum spam. The last IP is in Nepal. Maybe it's an open proxy or maybe it's just a mountain-climbing hairstylist. -- A. B. (talk • contribs) 01:34, 25 August 2012 (UTC)



MER-C 10:50, 27 August 2012 (UTC)

Automated wikipedia trolling
Kulkapedia

https://www.google.co.uk/search?q=kulkapedia

thanks! — Preceding unsigned comment added by 92.40.255.91 (talk) 10:44, 28 August 2012 (UTC)

Questions about "Chinese Knockoff Spam"
Continuing earlier research about link spam has led me to intensive archive browsing. It is impossible not to notice the many-many iterations of "Generic Chinese Knockoff Spam" that appear throughout 2010 and 2011 (now inactive?). Given that this time is far past, it inhibits my investigation a bit. Moreover, it seemed the team here usually blacklisted it without much discussion or fanfare. For these reasons, I'd like to ask a few questions of those who were active at that time:


 * Was there a particular modus operandi for their actions?
 * How were "related domains" found? I notice that usually only a few domains were actually spammed, but many more were pro-actively blacklisted on some basis? Something to do with WHOIS registrations?
 * What was actually at the destinations? Were there just a couple of core sites that they endlessly purchased new domains for?
 * How do you think they got all those IPs? Do you think this was a single person or a team? Were they utilizing proxy servers, or something more powerful?
 * Do you have any evidence that these spam links were being used elsewhere? blog/forum spam?
 * Do you think these links were added by a human acting quickly, or were there automation scripts?
 * Has any attacker near this scale/complexity been seen before?

Thanks for all you help, West.andrew.g (talk) 21:16, 28 July 2012 (UTC)


 * From top to bottom:
 * Profit.
 * Web search for various unique Chinglish phrases.
 * They usually aren't redirects. Chinese knockoff domains are copypasta/reskins.
 * I don't know, but there is definitely more than one person doing it.
 * Google is your friend. Something like "louis vuitton cheap comment" will do. This is an internet wide problem.
 * Most likely human sweatshop spam.
 * No. This is organized, as in organized crime.
 * MER-C 03:03, 29 July 2012 (UTC)
 * In case people are not aware, Andrew is probably not just curious—he is able to monitor link additions and perform complex processing. If there were patterns that might be detected (article categories, timing of link additions, ranges of IPs, and more), his processing may be of assistance (potentially, it could do more background checking than XLinkBot). The copypaste/reskins observation is of interest—it would be difficult, but it might be possible to guess that the target of an added link is a reskin. Another clue might be the whois registrant for the domain, although whois lookups can become expensive. Johnuniq (talk) 03:22, 29 July 2012 (UTC)
 * Johnuniq is correct. I have several corpora of Wikipedia link spam, run a link processing engine, and have worked heavily in anti-vandalism development (see WP:STiki. No offense, but I found MER-C's answers were a bit sarcastic/brief, whereas I was hoping to have a more technical discussion on the topic of Generic Chinese Knockoff Spam (CGKS). If anyone seems to be persistent and technically sophisticated in profiting off of wiki via link spam, it would seem to be those folks. Understanding their attack vectors would seem key to understanding Wikipedia's spam weaknesses. So to go top to bottom again, with a little more detail:
 * Yes, profit is obviously the over-arching MO. However, the actions are just puzzling. Sometimes they blank articles with links. Sometimes they insert 5-10 at a time in the middle of an article. Sometimes they post to talk pages. They obviously aren't trying to blend in and evade the first wave of anti-vandal checks. With this behavior so obvious to patrollers, its difficult to imagine how the links survive long enough to extract any utility. It's also a bit odd that they had to know the accounts/IPs would be blocked, but didn't seem to use accounts to their full capacity (i.e., spamming at speed until blocked). Real spam outfits know how things work and have technical sophistication, these folks just seemed dumb and random at times (which made me wonder about automation).
 * I don't imagine you actually searched Chinglish phrases. I imagine the related domains were sitting on the same server?
 * The destination sites were actually selling products, I assume? With this complexity I imagined they were probably part of a larger affiliate program into the actual goods, but probably using copypaste/reskins themselves - i.e., some central backend was fulfilling any "orders"
 * Looking at the accounts used was a bit perplexing. For their poor understanding of the interface and norms (i.e., spamming talk pages, they still managed to register some accounts. As far as the IPs involved, they seem all over the place. This isn't local IP hopping. They are geographically distributed. This screams proxy servers to me. In the worst case, it could be a botnet (but these attacks simply don't seem large enough for that). Why do you believe it is more than one person? The spam never really happened so quickly that it couldn't be a single person.
 * I understand that GCRS is a widespread Internet problem, but there are certainly many outfits involved in it globally. I was curious about the domains Wikipedia was dealing with in particular. They've paid for 1000s of domain registrations, so if they weren't getting used on wiki, they had to be showing up elsewhere. Strange, then, why they didn't show up on wiki? 50 or so pockets of spam over 1.5 years isn't *that* much for an outfit that seems to have these capabilities.
 * -skip-
 * I understand the organized crime ramifications of spam outfits. What I was asking if anyone/anything had come close to this in your experience *on Wikipedia"? My interest here is confined to wiki/Wikipedia experience.
 * Additional questions:
 * Were all/most of these blacklisted? Over at meta? Including the "related but not yet seen on wiki" set? MER-C always seemed to lodge the reports, but it wasn't clear the blacklist treatment of these guys.
 * Thanks for your help. More than a casual passer-by, I am trying to develop tools/algorithms that aide the project. I'd be happy to take this up on IRC if that is easier for anyone involved. Thanks, West.andrew.g (talk) 04:04, 29 July 2012 (UTC)
 * P.S. Why when I do an archive search for "Generic Chinese" or any variant thereof I only get 24 results? I have more luck searching for "2.0", "3.0", "4.0", but this only gets me one at a time and doesn't help with the odd ones, i.e., "8.5". Thanks, West.andrew.g (talk) 04:36, 29 July 2012 (UTC)
 * Thanks Andrew, however this page is not a good place for discussion because it is subject to a lot of churning as new reports come in.
 * @MER-C: Do you think there is value in continuing this elsewhere? A subpage dedicated to the topic? I don't think IRC is desirable as complex statements there are difficult—a wiki page would help with development of any ideas, and may be useful for future discussions. I suggest moving this section to a subpage, with a link here. Johnuniq (talk) 04:42, 29 July 2012 (UTC)

I think that this is very well within the capabilities of LiWa3/XLinkBot. Problem is that XLinkBot only reverts, spammers will re-insert add nausiam, they don't care when accounts get blocked (just move to another IP), they don't even care when their links get blocked (they just copypaste or reskin to a new domain). It is how they make money. I think that it is therefore valuable to have these link blanket-blacklisted. Preemptively, it saves us, and XLinkBot, a lot of work. If the spammers found out Wikipedia is a target (and they obviously did, some of the links were spammed to Wikipedia), then the fact that only so few links were actually added (while the internet at large was targetted) may actually show MER-C's efficiency here: either they did not spam because their domains were already blacklisted, or the sweat-shop workers were told to not make a priority of Wikipedia, as it was too effective too fast.

Andrew, I'd like to hear more about your detection systems, maybe there are things that can be incorporated into LiWa3 so we can work in real time and ask COIBot to make reports. Indeed, maybe a dedicated subpage is better. --Dirk Beetstra T C 05:09, 29 July 2012 (UTC)

Regarding IRC, MER-C and I generally hang around in #wikipedia-spam-t (the main 'command center' for XLinkBot, though it, you may want to join us there. Regarding doing everything on-wiki - I'd like to put WP:BEANS into consideration there.  --Dirk Beetstra T  C 05:12, 29 July 2012 (UTC)


 * However, the actions are just puzzling. Sometimes they blank articles with links. Sometimes they insert 5-10 at a time in the middle of an article. Sometimes they post to talk pages. They obviously aren't trying to blend in and evade the first wave of anti-vandal checks.
 * These guys (1) probably don't speak English too well and (2) are targeting the entire interwebz. This isn't "pay $X to get your link into Wikipedia" spam -- these spammers don't specialize and are paid piecewise per comment => quantity over quality. They do not target Wikipedia specifically -- we're just another website to be spammed. Something like this, I guess. (I have read a more detailed article on this subject but the link escapes me). Usernames are often the same across websites. Messages are usually copypasta. Automation (if used) is usually achieved with XRumer. If there are bots, they pass the Turing test (only because the humans are so dumb).
 * I don't imagine you actually searched Chinglish phrases.
 * Yes, I actually did. Examine the spam reports here closely and you will find the search phrases I used.
 * The destination sites were actually selling products, I assume?
 * Mostly. There are also splogs for the knockoff domains.
 * Something to do with WHOIS registrations?
 * WHOIS data isn't really helpful for knockoffs. Come to think of it, this might be an example of smurfing. Re: copy and paste reskins -- they look the same, and many use the same server-side software. (So do many other sites).
 * blacklist treatment of these guys
 * Blacklisted on sight, uncontroversially.
 * Why do you believe it is more than one person? The spam never really happened so quickly that it couldn't be a single person.
 * Remember, it's the entire internet being targeted. What you see here is the tip of the iceberg.
 * Do you think there is value in continuing this elsewhere?
 * I'll "sticky" this by adding an appropriate timestamp. Things tend to die on subpages.
 * I apologise for my brevity, but the OP should have put a little more effort into asking the initial questions. MER-C 09:46, 29 July 2012 (UTC)
 * Sticky. MER-C 09:36, 29 August 2012 (UTC)
 * FWIW, I've compiled all the reports in archives into a single page @ User:West.andrew.g/GCKS
 * Continuing to update, I geolocated all the IP addresses found in the GCKS campaigns. 99% trace back to a single Chinese province. This doesn't seem to be at botnet scope and too much time has passed to determine the open proxy status of the IPs. This seems to further support the "distributed sweatshop" thinking someone put forth earlier. Out of curiosity, what do the experts around here think is the second most prevalent or determined campaign/faction/attempt they've seen? Does it even begin to approach the scale of GCKS? Thanks, West.andrew.g (talk) 17:55, 4 August 2012 (UTC)


 * The 'internet brands' stuff? Some specialists have managed to circumvent our detection for a long, long time.  --Dirk Beetstra T  C 04:01, 6 August 2012 (UTC)
 * The "latestmoviez.com" crap (see below) is getting there as well. MER-C 09:36, 7 August 2012 (UTC)

Promo on user talk page of Millycylan
Hi, I just removed promo on Cloud computing added by Millycylan, but apparently this user left also promo on his talk page. I'm not sure I can remove this too. Can somebody help to get this removed? Thanks, SchreyP (messages) 07:26, 29 August 2012 (UTC)
 * Done. (You can do this yourself). MER-C 10:38, 29 August 2012 (UTC)


 * When I notice that, I just replace the user's talk page with welcome or with a warning (if they spammed elsewhere). Johnuniq (talk) 10:52, 29 August 2012 (UTC)


 * Thanks MER-C and Johnuniq, I learned something today :) Next time I do this indeed myself. SchreyP (messages) 20:35, 29 August 2012 (UTC)