Wikipedia talk:WikiProject Spam/2012 Archive Jan 1

scalibux.com
Caution: NSFW


 * Spam pages
 * deleted 2 times
 * deleted 2 times


 * fr:Scalibux
 * fr:Scalibux


 * Sites spammed


 * Spammers
 * Cross-wiki spammer, see
 * Spammer replaced existing links
 * Spammer replaced existing links


 * Cross-wiki spammer, see
 * Spammer replaced existing links
 * Cross-wiki spammer, see
 * Spammer replaced existing links


 * Spammer replaced existing links
 * Spammer replaced existing links


 * Spammer replaced existing links
 * Spammer replaced existing links
 * Spammer replaced existing links


 * Spammer replaced existing links
 * Spammer replaced existing links


 * Spammer replaced existing links
 * Spammer replaced existing links


 * Cross-wiki spammer, see fr:Special:Contributions/41.142.222.100
 * Spammer replaced existing links
 * Spammer replaced existing links


 * Spammer replaced existing links
 * Spammer replaced existing links



MER-C 13:13, 19 December 2011 (UTC)


 * Plain text spamming after blacklisting:
 * MER-C 03:45, 2 January 2012 (UTC)
 * MER-C 03:45, 2 January 2012 (UTC)
 * MER-C 03:45, 2 January 2012 (UTC)

ceoneedtoknow.com

 * links


 * accounts

Repeated addition of self-published site, including issuing a threat to vandalize if the link is removed. --- Barek (talk • contribs) - 05:24, 3 January 2012 (UTC)

User:Davem1981
All of Davem1981's contributions are irrelevant external links. IsaacAA (talk) 16:45, 22 December 2011 (UTC)


 * Adsense pub-1609789099200669
 * Google Analytics UA-869385


 * Additional domains:
 * blacklisted globally
 * blacklisted globally
 * blacklisted globally
 * blacklisted globally
 * blacklisted globally
 * blacklisted globally


 * Additional spammers:


 * Reverted and warned. MER-C 08:31, 23 December 2011 (UTC)
 * Updated. MER-C 01:20, 4 January 2012 (UTC)

entireeducation.com



 * Spammers

MER-C 12:39, 24 December 2011 (UTC)
 * Updated. MER-C 02:58, 4 January 2012 (UTC)

indiantvserials.orgfree.com

 * Previous incidents
 * Wikipedia talk:WikiProject Spam/2009 Archive Dec 1
 * Wikipedia talk:WikiProject Spam/2010 Archive Sep 1


 * Sites spammed


 * Spammers
 * Spammer moved links up
 * Spammer moved links up


 * Spammer replaced existing links
 * Spammer replaced existing links
 * Spammer replaced existing links

MER-C 10:43, 25 November 2011 (UTC)
 * Updated. MER-C 11:12, 1 December 2011 (UTC)
 * Recycled. MER-C 01:25, 4 January 2012 (UTC)

soulinterviews.com

 * Previous incidents
 * Wikipedia talk:WikiProject Spam/2010 Archive Dec 1


 * Spam pages


 * Sites spammed


 * Spammers
 * Spammer replaced existing links
 * Spammer replaced existing links
 * Spammer replaced existing links




 * See also
 * Wikipedia:Miscellany for deletion/User:Cystalgate/Soul Interviews

MER-C 01:48, 4 January 2012 (UTC)

Whatisall.com
Ad-laden Wikipedia mirror. Added to two articles by User:219.91.185.197 and perhaps to other articles by other IPs. Beyond My Ken (talk) 03:56, 31 December 2011 (UTC)


 * Adsense pub-2938541844964998, Google Analytics UA-25826123


 * Also:


 * Accounts


 * MER-C 05:03, 31 December 2011 (UTC)
 * Updated. MER-C 02:56, 4 January 2012 (UTC)
 * additional IP accounts
 * Added additional IPs whose sole activity is adding techiecop.com to multiple articles, in some cases removing other existing links in the process. --- Barek (talk • contribs) - 05:20, 5 January 2012 (UTC)
 * Added additional IPs whose sole activity is adding techiecop.com to multiple articles, in some cases removing other existing links in the process. --- Barek (talk • contribs) - 05:20, 5 January 2012 (UTC)
 * Added additional IPs whose sole activity is adding techiecop.com to multiple articles, in some cases removing other existing links in the process. --- Barek (talk • contribs) - 05:20, 5 January 2012 (UTC)

Mehul Brahmbhatt 05:20, 5 January 2012 (UTC) The content which was being linked was relevant to topic and up to the point than what was point for deletion? Mehul Brahmbhatt 05:20, 5 January 2012 (UTC) — Preceding unsigned comment added by Web mehul (talk • contribs)

sitka.com

 * link


 * accounts

A geodomain site for community networking that is being repeatedly added by drive-by IPs. The link is neither the official city site, nor the site of the visitor/convention bureau, so has been removed per WP:USCITY, WP:ELNO, and WP:NOT. --- Barek (talk • contribs) - 17:24, 4 January 2012 (UTC)

CreateOnline Ltd. Spam Campaign

 * "Prints Place is operated by Printree, which is the online trading name for CreateOnline, which is owned and operated by CreateOnline Limited." printsplace.co.uk/About


 * SpamLinks


 * More
 * More
 * More
 * More
 * More
 * More
 * More
 * More
 * More




 * Accounts

--Hu12 (talk) 13:50, 6 January 2012 (UTC)

Google Plus, Facebook, Twitter


The above user created the template and spammed it into multiple articles today. He also appears to be adding Facebook, Twitter and other social networking site links to multiple articles as well, against the spirit of WP:EL, especially External links/Perennial websites Yworo (talk) 09:24, 9 January 2012 (UTC)


 * Please note that I've proposed promoting External links/Perennial websites to a guideline. The discussion can be found here. Yworo (talk) 19:14, 9 January 2012 (UTC)


 * This discussion is redundant, see ELN. We do not consider the contributions of good faith Wikipedians to be spam. MER-C 05:44, 10 January 2012 (UTC)
 * Templates_for_discussion/Log/2012_January_9. worth looking at.--Hu12 (talk) 12:09, 10 January 2012 (UTC)

http://en.wikipedia.org/wiki/TMCR_95.3
http://en.wikipedia.org/wiki/TMCR_95.3

It appears that someone has made revisions to the page to claim that I, Gordon Sharpe, had resigned or was sacked. These edits are malicious and need to be removed please. I do not know how to revert the page and feel that an editor should look at this abuse.

The history shows: (cur | prev) 00:07, 27 December 2011‎ 86.161.0.169 (talk)‎ (7,241 bytes) (→Presenters (at July 2010)) (undo) (cur | prev) 18:07, 22 December 2011‎ 86.162.12.102 (talk)‎ (7,243 bytes) (→Presenters (at July 2010)) (undo) (cur | prev) 18:07, 22 December 2011‎ 86.162.12.102 (talk)‎ (7,241 bytes) (→Presenters (at July 2010)) (undo) (cur | prev) 12:25, 7 December 2011‎ 161.12.7.4 (talk)‎ (7,243 bytes) (→Presenters (at July 2010)) (undo)

The revisions alternate between Resigned and Sacked against my name. TrustAM (talk) 22:53, 9 January 2012 (UTC)
 * Gordon, best course of action for you is to make the correct change to the article per COI. be sure to document the change on the articles talk page. see also COI. if it continues excessively, may want to make a report over at Requests for page protection. thanks for reporting. --Hu12 (talk) 01:34, 10 January 2012 (UTC)


 * Question. Would it be acceptable to remove the entry all together? I created it and am shown as the author but since the abuse took place I have made a difficult decision to leave the group, which I will simply put down to constructive dismissal here. Rather than have any future arguments over the content of the Wikipedia entry I feel it better to withdraw my contribution or have all reference to myself removed. Is this viable? I would remove it myself, but have had enough accusations thrown at me to last a lifetime. TrustAM (talk) 21:51, 10 January 2012 (UTC)

Long term Spamming catranslation.org

 * Accounts


 * es:Special:Contributions/SophiaKD


 * cs:Special:Contributions/108.83.18.223
 * es:Contributions/108.83.18.223
 * fr:Special:Contributions/108.83.18.223
 * hu:Special:Contributions/108.83.18.223

--Hu12 (talk) 00:38, 11 January 2012 (UTC)

unifrance.org



 * Brice Guezet Project Manager - International Film Unifrance
 * fr:Special:Contributions/Unifrancefilms

--Hu12 (talk) 19:48, 11 January 2012 (UTC)

Convicted Artist Magazine

 * Adsense google_ad_client = pub-6302538575241952


 * Accounts



"We are a true social art network...we invite you to visit and enjoy our site."

--Hu12 (talk) 20:37, 11 January 2012 (UTC)

highSCORE | New Music Center and Past Related

 * Promotes contemporary music and events, Associazione Culturale Biquadro


 * redirects to highscorefestival.com
 * Other Paolo Fosso owned sites
 * Other Paolo Fosso owned sites


 * Articles_for_creation/2006-06-23 declined
 * Articles for deletion/DGform Multimedia deleted
 * Articles for deletion/DGform Multimedia deleted


 * Accounts


 * it:Special:Contributions/151.66.132.165
 * it:Special:Contributions/151.66.132.165
 * it:Special:Contributions/151.66.132.165
 * it:Special:Contributions/151.66.132.165


 * it:Special:Contributions/151.66.131.115
 * it:Special:Contributions/151.66.131.115


 * it:Special:Contributions/151.66.129.240
 * it:Special:Contributions/151.66.129.240


 * it:Special:Contributions/151.15.155.4
 * it:Special:Contributions/151.15.155.4


 * it:Special:Contributions/151.66.131.122
 * it:Special:Contributions/151.66.131.122

--Hu12 (talk) 15:28, 12 January 2012 (UTC)

SwiftMQ
--Hu12 (talk) 14:22, 13 January 2012 (UTC)
 * Accounts

MCi Educational Group

 * User:MCI bihar

--Hu12 (talk) 15:06, 13 January 2012 (UTC)

sites.google.com spam

 * Pages







--Hu12 (talk) 15:53, 13 January 2012 (UTC)

RuleWorks.co.uk Spam


--Hu12 (talk) 16:37, 13 January 2012 (UTC)

CESI S.p.A. multiple entries
User page is spam page for CESI S.p.A.. User has created spam page CESI S.p.A. several times (I made it to be three) and has removed speedy tag at least once. TreacherousWays (talk) 17:13, 13 January 2012 (UTC)
 * Article spam
 * User:Cribuz
 * it:Centro elettrotecnico sperimentale italiano
 * Accounts
 * IP whois checks out to be CESI CENTRO ELETTROTECNICO SPERIMENTALE ITALIANO, using multiple sock accounts clearly exist for the sole or primary purpose of promoting CESI. Pages deleted, accounts blocked.--Hu12 (talk) 17:57, 13 January 2012 (UTC)
 * it:Centro elettrotecnico sperimentale italiano
 * Accounts
 * IP whois checks out to be CESI CENTRO ELETTROTECNICO SPERIMENTALE ITALIANO, using multiple sock accounts clearly exist for the sole or primary purpose of promoting CESI. Pages deleted, accounts blocked.--Hu12 (talk) 17:57, 13 January 2012 (UTC)
 * IP whois checks out to be CESI CENTRO ELETTROTECNICO SPERIMENTALE ITALIANO, using multiple sock accounts clearly exist for the sole or primary purpose of promoting CESI. Pages deleted, accounts blocked.--Hu12 (talk) 17:57, 13 January 2012 (UTC)
 * IP whois checks out to be CESI CENTRO ELETTROTECNICO SPERIMENTALE ITALIANO, using multiple sock accounts clearly exist for the sole or primary purpose of promoting CESI. Pages deleted, accounts blocked.--Hu12 (talk) 17:57, 13 January 2012 (UTC)
 * IP whois checks out to be CESI CENTRO ELETTROTECNICO SPERIMENTALE ITALIANO, using multiple sock accounts clearly exist for the sole or primary purpose of promoting CESI. Pages deleted, accounts blocked.--Hu12 (talk) 17:57, 13 January 2012 (UTC)

myscrapbookinc.com

 * link


 * accounts

repeated addition of advert content into multiple articles by multiple SPA accounts. --- Barek (talk • contribs) - 06:41, 15 January 2012 (UTC)

newsintechnologys.com

 * links


 * accounts

Users adding highly spammish links or creating advert-only pages. --- Barek (talk • contribs) - 02:12, 17 January 2012 (UTC)

James Phyll related spamsites
Adsense google_ad_client = pub-934637620383421


 * Other related
 * Other related
 * Other related
 * Other related
 * Other related


 * Accounts

Persistent spamming multiple ad revenue related sites, BL'd--Hu12 (talk) 13:48, 20 January 2012 (UTC)

goarticles.com

 * link

I stumbled on this site, and found pretty extensive use both as ELs and as refs. The problem is that it doesn't qualify as either. The site accepts any submissions with no editorial review or oversite; even the author bios are not reviewed, simply accepted as submitted - so there's no possible way to confirm the person who actually wrote it has any expertise or legitimate credentials.

I've been reviewing the use, and can't spot any organized abuse (as yet); but it has been used heavily to link to press-release type content as well as to material that would otherwise fail as being original research.

I would appreciate assistance in reviewing the remaining links for where it's used within articles. --- Barek (talk • contribs) - 18:51, 20 January 2012 (UTC)
 * This domain is already on the XLinkBot revert list, I'll set it to revert reference additions as well. We should consider blacklisting. MER-C 08:02, 21 January 2012 (UTC)

linkspam template
ConnecticutHikingOrgsAndWebSites


 * Templates_for_discussion

--Hu12 (talk) 02:31, 21 January 2012 (UTC)

chruscikies.com

 * Spammer


 * Sample spam edits
 * http://en.wikipedia.org/wiki/Angel_wings?diff=471328698
 * http://en.wikipedia.org/wiki/Angel_wings?diff=471610315
 * http://en.wikipedia.org/wiki/Angel_wings?diff=472414447

Che829 (talk) 05:08, 25 January 2012 (UTC)


 * Patrick McCloskey (Registrant) Spam




 * http://planetpm.webring.com/chrusciki/chrusciki.html
 * http://homepage.mac.com/planetpm/chrusciki/chrusciki.html
 * http://planetpm.webring.com/fireballisland/fireballislandgame.html
 * http://planetpm.webring.com/queenholden/paperdolls.html
 * http://homepage.mac.com/planetpm/whichwitch/information.html
 * http://planetpm.webring.com/greenghost/greenghostgame.html
 * http://homepage.mac.com/planetpm/hauntedhouse/hauntedhousegame.html
 * http://planetpm.webring.com/gamehaunt/index.html
 * http://homepage.mac.com/planetpm/voiceofthemummy/index.html
 * http://planetpm.webring.com/darktower/darktowergame.html
 * http://homepage.mac.com/planetpm/buildthisbike/index.html
 * ECT....
 * Accounts



Lonterm additions of related Iframe spamlinks by "planetpm" (http://www.webring.com/profile?y=planetpm;def=y), E-mail ID Patrickm@alloymail.com selling his stuff--Hu12 (talk) 20:12, 25 January 2012 (UTC)

guitaradda.com
Persistent addition of spamlink in article text, references and external links of articles Electric guitar, Acoustic guitar, Bass guitar and Gibson Guitar Corporation.
 * Link


 * Accounts and IP's


 * Diffs
 * Started with ,
 * All edits by this (new) user and their satellite IP's.

User and IPs notified on talk pages. Can guitaradda.com be blacklisted? Otherwise this might not stop. TIA - DVdm (talk) 14:56, 25 January 2012 (UTC)

printingfairy.com


--Hu12 (talk) 20:51, 24 January 2012 (UTC)
 * continued


 * Bl'd--Hu12 (talk) 17:41, 28 January 2012 (UTC)
 * Bl'd--Hu12 (talk) 17:41, 28 January 2012 (UTC)

playbillvault.com

 * link:


 * related AfD:
 * Articles for deletion/Playbill Vault


 * accounts:


 * related discussion thread at WP:EL/N:
 * External links/Noticeboard

Seeming WP:SPA adding link in possible promotion of newly created website. The parent site is clearly notable, but this one has not established notability of its own as yet. --- Barek (talk • contribs) - 18:56, 26 January 2012 (UTC)

Food-related websites





 * Mostly to Weight loss, which is now partial-protected. Given that they're changing the url and accounts/ips, I'm not sure what to do besides protecting the articles. --Ronz (talk) 21:35, 22 January 2012 (UTC)

Site ips are 64.31.55.250 and 216.245.202.26, see:


 * 64.31.55.250
 * 216.245.202.26
 * 216.245.202.26
 * 216.245.202.26

I have revertlisted the two server IPs on XLinkBot, which should revert everything that resides on these two IPs. If after a few warnings it does not stop, blacklist this all, and new stuff as soon as it appears. --Dirk Beetstra T C 17:35, 23 January 2012 (UTC)
 * Another related URL, also hosted by server at IP 216.245.202.26:
 * This time added to . Looks to be migrating to new articles as prior ones are semi-protected. --- Barek (talk • contribs) - 23:57, 23 January 2012 (UTC)
 * This pattern of spam domains isn't limited to food/dieting.. they've also hit Ageing and Wrinkle -- Versa geek  00:38, 24 January 2012 (UTC)
 * just added this related link to Bodybuilding. Apparition11  Complaints / Mistakes  17:24, 24 January 2012 (UTC)
 * has added the link above to a few weight loss related articles. --bonadea contributions talk 09:20, 25 January 2012 (UTC)
 * just added this related link to Bodybuilding. Apparition11  Complaints / Mistakes  17:24, 24 January 2012 (UTC)
 * has added the link above to a few weight loss related articles. --bonadea contributions talk 09:20, 25 January 2012 (UTC)
 * has added the link above to a few weight loss related articles. --bonadea contributions talk 09:20, 25 January 2012 (UTC)

<- Now they're using URL shrinkers (I visited the site via this link & it's the same low quality cookie-cutter junk we've seen on the other domains): This particular user was blocked for his user name (by User:January) & I've requested a meta-blacklist for the URL shrinker. -- Versa geek  19:57, 25 January 2012 (UTC)

WAAAY more - What I think is the full set until now:

Case 7
Case report by COIBot.


 * Links


 * Users


 * Site IPs

(Sorry, I don't feel like weeding out the duplicates here in this). Maybe we should consider to be a bit liberal with both blocks and blacklistings here, this is getting annoying (but I am afraid that this is going to be one of those examples where that is also not going to help). --Dirk Beetstra T C 13:24, 25 January 2012 (UTC)

Updated. --Dirk Beetstra T C 17:51, 25 January 2012 (UTC)

Sorted a bit of order in this chaos. Only two of the IP addresses seem to be close (within a /24), the others seem completely random. This will be impossible to stop. Turning hard override on on these links in XLinkBot, blacklisting is probably futile, as is blocking the accounts (I will proceed with indeffing the named accounts anyway). --Dirk Beetstra T C 18:01, 25 January 2012 (UTC)


 * All URLS, not including site IP's, have been to the Blacklist--Hu12 (talk) 18:03, 25 January 2012 (UTC)
 * Range User IP's


 * Some of the IP ranges, have no way to see if these range contribs are vandalism only in order to block. Would be nice to also block the server the sites are hosted on.. --Hu12 (talk) 18:34, 25 January 2012 (UTC)
 * Some of the IP ranges, have no way to see if these range contribs are vandalism only in order to block. Would be nice to also block the server the sites are hosted on.. --Hu12 (talk) 18:34, 25 January 2012 (UTC)
 * Some of the IP ranges, have no way to see if these range contribs are vandalism only in order to block. Would be nice to also block the server the sites are hosted on.. --Hu12 (talk) 18:34, 25 January 2012 (UTC)
 * Some of the IP ranges, have no way to see if these range contribs are vandalism only in order to block. Would be nice to also block the server the sites are hosted on.. --Hu12 (talk) 18:34, 25 January 2012 (UTC)
 * Some of the IP ranges, have no way to see if these range contribs are vandalism only in order to block. Would be nice to also block the server the sites are hosted on.. --Hu12 (talk) 18:34, 25 January 2012 (UTC)
 * Some of the IP ranges, have no way to see if these range contribs are vandalism only in order to block. Would be nice to also block the server the sites are hosted on.. --Hu12 (talk) 18:34, 25 January 2012 (UTC)
 * Some of the IP ranges, have no way to see if these range contribs are vandalism only in order to block. Would be nice to also block the server the sites are hosted on.. --Hu12 (talk) 18:34, 25 January 2012 (UTC)


 * I've done this for now. This is something that I have not used a lot in XLinkBot, the only thing it will now obey is 3RR and it will not revert established users .. we have one step more (where only whitelisted users will not be reverted, and the bot will also not obey 3RR anymore), but lets see where this brings us.  Please keep an eye on XLinkBot reversions of these rules, I hope it will not go wrong.
 * I am working on a new off-wiki spam-collecting tool. It is, and needs to be, very manually operated, but I will save the result regularly in m:User:COIBot/case/case7 and (after enabling it further) also in WikiProject Spam/case/case7.  It is experimental, but it proves to be effective here.  Diffs between versions will show which new links have been added, all reported here are in the last version).
 * Can someone see what is there on all these servers, and preemptively blacklist all that is hosted on this? --Dirk Beetstra T  C 18:49, 25 January 2012 (UTC)
 * Well, I cant get in to see each one, but it looks massive;
 * 453 domains hosted on IP address 50.22.112.223
 * 5,201 domains hosted on IP address 64.31.55.250
 * 5,446 domains hosted on IP address 216.245.202.26
 * --Hu12 (talk) 20:52, 25 January 2012 (UTC)


 * The blacklist regex \b\d+\w*facts\.com\b would catch most of those above without any collateral damage. ~Amatulić (talk) 01:02, 26 January 2012 (UTC)

2itb.com hosting
I've been noticing sites being added hosted by 2itb.com with identical or near-identical style sheets as some of those being used above. has connected some of the dots for us, first linking a site hosted at 2itb.com with the commonly used stylesheet, then linking another url with a different style sheet. --Ronz (talk) 03:04, 26 January 2012 (UTC)


 * Listed above as well.
 * Listed above as well.
 * Listed above as well.
 * Listed above as well.
 * Listed above as well.
 * Listed above as well.

Makes me wonder if they're using other hosting sites that we've not found yet. --Ronz (talk) 03:38, 26 January 2012 (UTC)

Well ...


 * links




 * Servers:


 * users


 * Site IPs:
 * This is vur.me, the first redirector, already blacklisted - only link added hosted on this server is vur.me
 * 2itb.com and 4t.com
 * 2itb.com and 4t.com
 * 2itb.com and 4t.com

I've noted the user Gestaltdiscovery in this, which I also saw somewhere around on some of the webpages. --Dirk Beetstra T C 05:39, 26 January 2012 (UTC)
 * I've added 2itb.com to the spam blacklist. There are no articles currently using the link as a legitimate ref or EL, while the abuse is quite well documented above. --- Barek (talk • contribs) - 23:42, 28 January 2012 (UTC)

Commission Breakthrough Spamming
The thing which is tying all of the above spam domains & spammers together is a "online money making program" sold through commissionbreakthrough.com. According to online reviews of the program, the general concept is 1) set up any number of low content sites using this application, 2) spam Wikipedia, 3) Profit. Apparently there are a number of suckers who have bought into this plan. Let's see if we can abort the program at step 2!. -- Versa geek  06:19, 26 January 2012 (UTC)

See also: boldmoney.com/commission-breakthrough-exposed-is-it-a-scam.html --Dirk Beetstra T C 06:18, 26 January 2012 (UTC)
 * Yep. Seems to me that we're going to be most effective if we can focus on the website hosts.
 * Would it be helpful or feasible to try to figure out what method this software is using to get Wikipedia statistics? --Ronz (talk) 16:54, 26 January 2012 (UTC)
 * There are a few YouTube videos that show the interface and the stats they are gathering.. If someone had a lot of time, we might be able to go after the repeat offenders by reporting them to clickbank.net for violating their terms of service (spamming isn't permitted).. but that would mean clicking through to the individual domains to get the clickbank IDs & compiling a report.

Here are a few more domains, not all have been spammed here yet: -- Versa geek  04:49, 27 January 2012 (UTC)
 * Removed easyweightloss.2itb.com, mafiawarsecrets.2itb.com, typhoon42.com as duplicates of links above. Johnuniq (talk) 06:49, 27 January 2012 (UTC)

Is there any point in reporting the spam here? Here's one I just reverted: I noticed that the spammed URL had the extension http___commissionbreakthrough.com_members_wp-content_uploads_2011_11_original_templatev1.html - maybe that's something that can help identify and quickrevert the links via XLinkBot. --bonadea contributions talk 10:09, 27 January 2012 (UTC)
 * spammed by


 * It always helps to report it here, get a record of everything.
 * I already added \b2itb\.com\/http___commissionbreakthrough\.com\b on all the lists, I hope that does help (I'll check the detection now, you may have reverted before XLinkBot could). Unfortunately do not all links follow that pattern.  --Dirk Beetstra T  C 10:31, 27 January 2012 (UTC)


 * Two new ones very close together, but seemingly unrelated. I saw them on XLinkBot (and I had to tweak my regexes further) - I expected '\b2itb\.com(?:commissionbreakthrough)' and '\b2itb\.com(?!commissionbreakthrough)' to do the job as complementary rules.  I have again adapted the rules.  I am tempted to take the whole 2itb.com domain the hard way, accepting that some innocent additions of 2itb.com do run into a harsh warning, by far most is of the type of spam that we are discussing here.  --Dirk Beetstra T  C 11:30, 27 January 2012 (UTC)
 * Two new ones very close together, but seemingly unrelated. I saw them on XLinkBot (and I had to tweak my regexes further) - I expected '\b2itb\.com(?:commissionbreakthrough)' and '\b2itb\.com(?!commissionbreakthrough)' to do the job as complementary rules.  I have again adapted the rules.  I am tempted to take the whole 2itb.com domain the hard way, accepting that some innocent additions of 2itb.com do run into a harsh warning, by far most is of the type of spam that we are discussing here.  --Dirk Beetstra T  C 11:30, 27 January 2012 (UTC)
 * Two new ones very close together, but seemingly unrelated. I saw them on XLinkBot (and I had to tweak my regexes further) - I expected '\b2itb\.com(?:commissionbreakthrough)' and '\b2itb\.com(?!commissionbreakthrough)' to do the job as complementary rules.  I have again adapted the rules.  I am tempted to take the whole 2itb.com domain the hard way, accepting that some innocent additions of 2itb.com do run into a harsh warning, by far most is of the type of spam that we are discussing here.  --Dirk Beetstra T  C 11:30, 27 January 2012 (UTC)

I've been collecting some data, please see WikiProject Spam/CommissionBreakthrough_Spam. I only did two of the servers, there obviously is more, way more. --Dirk Beetstra T C 15:19, 28 January 2012 (UTC)






 * MER-C 07:04, 29 January 2012 (UTC)


 * --bonadea contributions talk 10:19, 29 January 2012 (UTC)
 * --bonadea contributions talk 10:19, 29 January 2012 (UTC)
 * --bonadea contributions talk 10:19, 29 January 2012 (UTC)
 * --bonadea contributions talk 10:19, 29 January 2012 (UTC)


 * (reported to AIAV)
 * --bonadea contributions talk 10:52, 29 January 2012 (UTC)
 * --bonadea contributions talk 10:52, 29 January 2012 (UTC)
 * --bonadea contributions talk 10:52, 29 January 2012 (UTC)

XLinkBot & '1 strike and you are out'
Regarding this case I have been upgrading LiWa3 and XLinkBot. The majority has been in tweaking the 'resolve IP' rules on LiWa3/XLinkBot, a feature that has not been used in a long long time. It now operates good (see e.g. the source of User_talk:68.190.12.40, it mentions the link and the rule, something that did not work optimally yet). I also started recently to parse parsed revids of pages in stead of wikitext. That means that youtube and any other template now gets detected as the addition of an external link. It is heavy on the machine, but it works.

One new feature I have now added to XLinkBot is a kind of a '1 strike and you are out' option. Regexes on a special page read by XLinkBot will have their warning-level set to a preset level (if no higher level exists). In other words, the first warning given to an editor for the addition of a certain link will be that level, not a 'spam0'-level, even if there are no earlier warnings to that editor. The links are in User:XLinkBot/LevelOverrule. Note, setting the initial level to 6 or higher will skip any warnings to that editor and immediate reporting to AIV. Note: not tested yet, waiting for the first spammer to help me with this.

Some of the techniques I am using here (mainly aimed at the non-regular spam-fighting admins who encounter this rubbish), please apply them liberally to this as soon as it comes up. Blacklisting is here not enough, as new sites ánd hosting servers come up regularly.


 * I am determining the server where the domain is hosted on, and adding the rule 'resolve ' to User:XLinkBot/RevertList. That will from then on revert any domain that is hosted on that site (m:User:LiWa3 does have a slight lag for loading the rules, it does not update its revertlist before every edit, it may take about 5 minutes).  Use that in stead of reverting the domain itself, the domain will change, the hosting server generally not (it saves you from figuring out what the next domain that is spammed is, and what the next IP of the user is).  Do take care that some servers do contain a lot of good stuff as well, then it may give false positives.  If unsure, poke someone on IRC in e.g. #wikipedia-spam-t to check with COIBot, or User:COIBot/Poke the IP of the server and wait for COIBot to save a linkreport for the IP - that will show you which sites have been added that reside on the server.  If it is not possible to use 'resolve ', you'll have to revertlist all the sites that you can find.  Do not add both the sites ánd the 'resolve ' rule, as that may conflict in determination of what XLinkBot has to do with reverting.  Note that it is often worth to first add the rules to XLinkBot, and then start cleaning - by the time you warn the first IP, they are already somewhere else and may not see the warning (as if they care anyway).
 * This is plain spam. These editors do not listen to reverts, warnings or even blocks.  They will re-add and re-add.  It earns them money to have the links on Wikipedia.  Therefore, besides adding the rule to User:XLinkBot/RevertList, also add it to User:XLinkBot/OverrideList.  That overrides basic settings in XLinkBot - it will revert everything as long as it is obeying 3RR and as long as the editor is not an established editor.  It will re-revert, it will revert references, it will revert undo-actions, etc.).  It will keep mainspace cleaner for you.  Please don't do this with sites which also contain occasional good links, enabling this feature does not WP:AGF anymore.
 * The new feature - '1 strike and you are out'. Consider adding the rule to User:XLinkBot/LevelOverrule - up 'numoverrules', and add 2 lines: 'overrule#rule' (containing the revert-rule from the revertlist) and 'overrule#level' (level 1-6, XLinkBot's levels are wiki-levels+1 - e.g. level 1 is the friendly message, uw-spam4 is level 5, ).  That will make XLinkBot start warning at the level specified in that setting when it warns an editor for adding that rule.  Level 5 will hence give a new user a welcome template, and a uw-spam4 warning.  If that editor reverts XLinkBot, or adds a link somewhere else, XLinkBot's next step is AIV.  In principle, the levels could be set to '6' (or higher), XLinkBot would then go immediately to AIV without even bothering to warn the editor.  Also here, this is not WP:AGF anymore.
 * Do blacklist stuff anyway, I know they will change server, but at least this one is gone.

Happy reverting. --Dirk Beetstra T C 08:35, 26 January 2012 (UTC)
 * Relentless. Found these two IP's inserting their links despite them being blacklisted...."rolls eyes".--Hu12 (talk) 15:43, 18 February 2012 (UTC)


 * That certainly is not going to earn them a lot of money - I hope you blocked them for a bit. Nothing much that we can do about that, though there is an inactive filter that is capable of blocking non-linking urls based on regexes, maybe that is an option.
 * It is relentless, it does not seem to stop anywhere soon, I noted that the advertising of this great piece of software are still actively going on, and editors get reverted on a very regular basis because of this rubbish. --Dirk Beetstra T  C 18:26, 18 February 2012 (UTC)