Wikipedia talk:WikiProject Spam

	When reporting spam, please use the appropriate template(s):
	As a courtesy, please consider informing other editors if their actions are being discussed. {{Link summary}} - to report spam domains: {{Link summary|example.com}} -- do not use "subst:" with this template - Do not include the "http://www." portion of the URL inside this template {{IP summary}} - to report anonymous editors suspected of spamming: {{IP summary|127.0.0.1}} --- do not use "subst:" with this template {{User summary}} - to report registered users suspected of spamming: {{User summary|Username}} -- do not use "subst:" with this template Also, please include links ("diffs") to sample spam edits.
	Click here to start a new report

Indicators
Reports completed:
Done
Stale
Defer discussion:
Defer to XLinkBot
Defer to Local blacklist
Defer to Global blacklist
Defer to Abuse filter
Information:
Additional information needed
Note:

growupconference.com

• growupconference.com: Linksearch en (https) (insource) - meta - de - fr - simple - wikt:en - wikt:fr • MER-C X-wiki • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced • COIBot-Link, Local, & XWiki Reports - Wikipedia: en - fr - de • Google: search • meta • Yahoo: backlinks • Domain: domaintools • AboutUs.com • DomainsDB.net • Alexa • WhosOnMyServer.com
• Growupconference (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)

Suspicious new articles (25 January)

Back to business as usual. And yes, there seems to be more than usual. SIGH. MER-C 20:46, 25 January 2020 (UTC)

@MER-C: Astaghfirullah. Do you really think that members of the Sulaymanids dynasty (edit | talk | history | protect | delete | links | watch | logs | views) paid @Idriss265: to write a COI article about themselves? They have been dead for over 1100 years. You are practically saying that there is now UPE from the grave. I see a zombie movie in the making. Abubakar1919 (talk) 10:34, 28 January 2020 (UTC)

Detecting spam automatically is very imprecise and I use a relatively unsophisticated approach. False positives do happen. MER-C 19:09, 28 January 2020 (UTC)

Would someone mind trying to copyvio-search Outsourcing_in_Ukraine (one of the articles on the above list)? Earwig's detector is down and I can't do a good manual search right now, but the article is setting off my copyvio spidey-sense. ^creffpublic _{a creffett franchise} (talk to the boss) 19:58, 28 January 2020 (UTC)

Earwig returns nothing. I wouldn't be surprised the article was SEO spam - the references need close scrutiny. MER-C 14:06, 30 January 2020 (UTC)

Suspicious new articles (8 February)

Looks like a bad bunch this time around. MER-C 14:53, 9 February 2020 (UTC)

Suspicious new articles (22 February)

Spam is a viral disease and grows exponentially, just like COVID-19. MER-C 17:29, 22 February 2020 (UTC)

thegrablegroup.com and espeakers.com

• espeakers.com: Linksearch en (https) (insource) - meta - de - fr - simple - wikt:en - wikt:fr • MER-C X-wiki • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced • COIBot-Link, Local, & XWiki Reports - Wikipedia: en - fr - de • Google: search • meta • Yahoo: backlinks • Domain: domaintools • AboutUs.com • DomainsDB.net • Alexa • WhosOnMyServer.com

  uses - currently 22

• thegrablegroup.com: Linksearch en (https) (insource) - meta - de - fr - simple - wikt:en - wikt:fr • MER-C X-wiki • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced • COIBot-Link, Local, & XWiki Reports - Wikipedia: en - fr - de • Google: search • meta • Yahoo: backlinks • Domain: domaintools • AboutUs.com • DomainsDB.net • Alexa • WhosOnMyServer.com

  uses - currently 13

• Timgrable (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)
• 12.97.9.30 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
• 68.53.16.229 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
• 68.53.28.235 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
• 68.63.255.197 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
• 69.137.110.41 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
• 70.210.6.38 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
• 71.203.228.72 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)
• 76.22.234.132 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)

I've run across these a few times, but apparently never looked into possible spamming.

I suppose some of the links might fit WP:BLPSPS criteria, but only when used for non-contentious, basic facts.

Still, there's definitely spamming going on, like [1] this bit of REFSPAM that's totally unnecessary and highly prominent in the article.

I've only started looking for spammers, so the list is just a start. --Hipal/Ronz (talk) 20:19, 28 February 2020 (UTC)

• 108.21.81.143 (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)

  SPA --Hipal/Ronz (talk) 17:22, 1 March 2020 (UTC)

• 184.48.52.99  (talk • contribs • deleted contribs • blacklist hits • AbuseLog • what links to user page • COIBot • count • block log • &lang=en x-wiki • Edit filter search • WHOIS • RDNS • tracert • robtex.com • StopForumSpam • Google • AboutUs • Project HoneyPot)

  SPA --Hipal/Ronz (talk) 20:22, 4 March 2020 (UTC)

• Christina Malyon (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)

  probably not a spammer, but noting because of Wikipedia:Sockpuppet investigations/Changingguardsatbuckinghampalace. --Hipal/Ronz (talk) 00:35, 29 February 2020 (UTC)

• Johnmoor (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)

  spammer, paid editor, blocked for undeclared paid editing and promotional editing. Admits he's been using ip's to make subsequent edits. --Hipal/Ronz (talk) 00:50, 29 February 2020 (UTC)

• Bamanh27 (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)

  may not be a spammer, but another blocked sockmaster: Wikipedia:Sockpuppet investigations/Bamanh27 --Hipal/Ronz (talk) 01:13, 29 February 2020 (UTC)

• Cada mori  (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)

  blocked for promotional editing. --Hipal/Ronz (talk) 17:29, 1 March 2020 (UTC)

• Richardo42 (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)

  blocked sock. --Hipal/Ronz (talk) 19:10, 1 March 2020 (UTC)

• Nextupspeakers (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam) coiusername --Hipal/Ronz (talk) 22:52, 17 March 2020 (UTC)

I'm only listing the more interesting SPA's, but most of the entries are coming from SPAs. --Hipal/Ronz (talk) 19:48, 1 March 2020 (UTC)

• globalspeakers.net: Linksearch en (https) (insource) - meta - de - fr - simple - wikt:en - wikt:fr • MER-C X-wiki • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced • COIBot-Link, Local, & XWiki Reports - Wikipedia: en - fr - de • Google: search • meta • Yahoo: backlinks • Domain: domaintools • AboutUs.com • DomainsDB.net • Alexa • WhosOnMyServer.com [2] --Hipal/Ronz (talk) 18:47, 1 March 2020 (UTC)
• mentorlist.com.au: Linksearch en (https) (insource) - meta - de - fr - simple - wikt:en - wikt:fr • MER-C X-wiki • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced • COIBot-Link, Local, & XWiki Reports - Wikipedia: en - fr - de • Google: search • meta • Yahoo: backlinks • Domain: domaintools • AboutUs.com • DomainsDB.net • Alexa • WhosOnMyServer.com related subject matter. --Hipal/Ronz (talk) 18:47, 1 March 2020 (UTC)
• speakersconnect.com: Linksearch en (https) (insource) - meta - de - fr - simple - wikt:en - wikt:fr • MER-C X-wiki • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced • COIBot-Link, Local, & XWiki Reports - Wikipedia: en - fr - de • Google: search • meta • Yahoo: backlinks • Domain: domaintools • AboutUs.com • DomainsDB.net • Alexa • WhosOnMyServer.com related subject matter. --Hipal/Ronz (talk) 18:47, 1 March 2020 (UTC)
• premierespeakers.com: Linksearch en (https) (insource) - meta - de - fr - simple - wikt:en - wikt:fr • MER-C X-wiki • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced • COIBot-Link, Local, & XWiki Reports - Wikipedia: en - fr - de • Google: search • meta • Yahoo: backlinks • Domain: domaintools • AboutUs.com • DomainsDB.net • Alexa • WhosOnMyServer.com related subject matter. --Hipal/Ronz (talk) 19:43, 1 March 2020 (UTC)
• nsaspeaker.org: Linksearch en (https) (insource) - meta - de - fr - simple - wikt:en - wikt:fr • MER-C X-wiki • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced • COIBot-Link, Local, & XWiki Reports - Wikipedia: en - fr - de • Google: search • meta • Yahoo: backlinks • Domain: domaintools • AboutUs.com • DomainsDB.net • Alexa • WhosOnMyServer.com - given this --Hipal/Ronz (talk) 01:05, 29 February 2020 (UTC)
• nashvillespeakers.com: Linksearch en (https) (insource) - meta - de - fr - simple - wikt:en - wikt:fr • MER-C X-wiki • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced • COIBot-Link, Local, & XWiki Reports - Wikipedia: en - fr - de • Google: search • meta • Yahoo: backlinks • Domain: domaintools • AboutUs.com • DomainsDB.net • Alexa • WhosOnMyServer.com --Hipal/Ronz (talk) 20:05, 13 March 2020 (UTC)
• nextupspeakers.com: Linksearch en (https) (insource) - meta - de - fr - simple - wikt:en - wikt:fr • MER-C X-wiki • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced • COIBot-Link, Local, & XWiki Reports - Wikipedia: en - fr - de • Google: search • meta • Yahoo: backlinks • Domain: domaintools • AboutUs.com • DomainsDB.net • Alexa • WhosOnMyServer.com --Hipal/Ronz (talk) 22:57, 17 March 2020 (UTC)
• apbspeakers.com: Linksearch en (https) (insource) - meta - de - fr - simple - wikt:en - wikt:fr • MER-C X-wiki • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced • COIBot-Link, Local, & XWiki Reports - Wikipedia: en - fr - de • Google: search • meta • Yahoo: backlinks • Domain: domaintools • AboutUs.com • DomainsDB.net • Alexa • WhosOnMyServer.com --Hipal/Ronz (talk) 22:57, 17 March 2020 (UTC)

At this point it looks more like COI/UPE problems driven by the promotional nature of the public speaking business. --Hipal/Ronz (talk) 19:49, 1 March 2020 (UTC)

@Hipal: I have changed the templates in above, we try to avoid LinkSummaryLive here as blacklisting would then disable archiving) and with {{IPSummary}} and {{UserSummary}} the users get picked up by COIBot to create reports (which can then again lead to more domains). --Dirk Beetstra ^{T C} 11:27, 2 March 2020 (UTC)

Suspicious new articles (7 March)

Sigh... I may have to produce these lists once a week to ensure faster scrutiny and therefore less payments. MER-C 18:09, 7 March 2020 (UTC)

MER-C, I'm wondering if it would be worthwhile to change the format of the table slightly - add a "reviewed by/comments" field, so that as people go through and vet these, we don't get too much duplication of effort - I'm imagining that people would comment things like "looks okay," "sent to AfD," etc. Of course, maybe you and others think it would be better to get multiple eyes on each article, in which case, never mind. creffett (talk) 01:01, 10 March 2020 (UTC)

COIBot suspicious domain reports

(to be crossposted at WT:SBL)

m:User:LiWa3 is doing basic statistics on domains that it has seen being added, and when those statistics are suspicious it throws those in the general direction of COIBot. COIBot is then reporting those in a local category or a xwiki category, depending on the type of statistics.

COIBot has been saving reports for years, and most of those are still lingering (COIBot closes some automatically when they have been cleaned up independently, but with so many it does not check all). I evaluated a good handful of the old ones and closed them, and I have been trying to keep up with some of the new ones for a week. I do find that a significant portion of them do need a follow up (most need cleanup, quite some outright blacklisting).

May I ask you to turn on category changes in your watchlist, watchlist Category:Open Local COIBot Reports, and evaluate all that COIBot is opening in there. Please try to close them with an evaluation remark for further reference. Thanks. --Dirk Beetstra ^{T C} 06:07, 8 March 2020 (UTC)

Beetstra, do you have a guide somewhere for how to evaluate these reports? I'm definitely up to help, just want to make sure I'm helping correctly. creffett (talk) 01:05, 10 March 2020 (UTC)

Ditto.Slywriter (talk) 02:50, 10 March 2020 (UTC)

@Creffett and Slywriter:

The reports in the /local tree are reports of domains that LiWa3 found 'suspicious'. That generally means that they are 'new' domains (domains that have never been added to any of the Wikis of WikiMedia before and the editor did not add a lot of domains before), and only added by one account, or only added by IPS etc. COIBot reports these domains in a report together with the editors that caused the trigger (sometimes there are other edits that are not part of the trigger, like one named editor, and 10 IPs in a close range will still trigger a report, but the /local-report will only show the 10 IPs).

The top sections of the report are the data that is collected. At the bottom there is a 'Discussion' section. The top sections get refreshed by COIBot when it saves a new one, the Discussion section is appended upon, and you can change the text there. That is where you can comment on your analysis.

In the discussion section is a template '{{LinkStatusLocal}}', which has as first parameter the wiki (here always 'en.wikipedia.org'), and as second parameter 'open', 'closed', 'stale', 'ignored', and 'added'.

• 'Open' - obvious
• 'Close' - a) someone has closed the report, the edits have been analyzed, reverted/left, whatever; b) COIBot has detected that someone blacklisted the site and closed the report (see COIBot comment in section; Wikipedia:WikiProject Spam/Local/thegadgetsandgears.com)
• 'Stale' - When saving the report, COIBot goes through the additions and sees if any of the links are still there, if all are gone, it marks it 'stale' (see COIBot comment in section; Wikipedia:WikiProject Spam/Local/journals.ju.edu.et). Note that some of these reports are on domains which are of a type that we would normally blacklist but as all are gone it is less urgent.
• 'Added' - an admin added the domain to the spam blacklist (marked that way by an admin script; effectively the report is closed).
• 'Ignore' - some domains are just 'good', but they keep triggering on LiWa3 - these reports are basically closed but will not be re-opened by the bot if new additions occur.

I try to go through the ones that COIBot opened and handle the additions, marking closed/added as appropriate, reverting edits where needed, issuing warnings. I remark when I close what actions I take and why. Reports that are marked 'closed' (or 'stale') will be reopened by COIBot when additional edits occur (no local example: see m:User:COIBot/XWiki/sierradeespadan.com on meta). So if you revert a domain now and warn the editor, and the editor proceeds, COIBot will re-open the report if the edits still trigger LiWa3. Do keep in mind that for every domain there is an editor who adds it first, it is certainly not always spam - it may mean that the new editor needs some guidance in the way of adding links (or that the report can be safely ignored). I hope this helps. --Dirk Beetstra ^{T C} 06:22, 10 March 2020 (UTC)

Beetstra, yup, that's helpful. So here's my understanding of how to close (for non-admins):

• Review the domain and its usage on-wiki, add appropriate comments in the discussion section.
• If the domain doesn't look like a problem, or it is no longer linked on-wiki/I've reviewed all current uses and either reverted them (if inappropriate) or left them alone (if okay), close it as "Close".
• If the domain appears spammy, report here for addition to the blacklist, and it will be closed as "Added" when an admin blacklists it.
• If it looks like a legitimate domain with a lot of false positives, close as "Ignore".

That sound about right? ^creffpublic _{a creffett franchise} (talk to the boss) 15:42, 10 March 2020 (UTC)

Creffett, yep, that is about it. Dirk Beetstra ^{T C} 07:05, 11 March 2020 (UTC)

Shoehorn

Advertising on a picture for the vendor: “The Moon Exports”. — Preceding unsigned comment added by Ennui93 (talk • contribs) 06:08, 10 March 2020 (UTC)

Ennui93, I have removed the image. Dirk Beetstra ^{T C} 06:24, 10 March 2020 (UTC)

copeclinics.com

copeclinics.com: Linksearch en (https) (insource) - meta - de - fr - simple - wikt:en - wikt:fr • MER-C X-wiki • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced • COIBot-Link, Local, & XWiki Reports - Wikipedia: en - fr - de • Google: search • meta • Yahoo: backlinks • Domain: domaintools • AboutUs.com • DomainsDB.net • Alexa • WhosOnMyServer.com

Sreelathareddy (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)

Spammy ref-replacement by the tagged user, reporting here for COIBot monitoring - if this continues it should go to the blacklist. creffett (talk) 13:47, 12 March 2020 (UTC)

Gezipgordum.com

gezipgordum.com: Linksearch en (https) (insource) - meta - de - fr - simple - wikt:en - wikt:fr • MER-C X-wiki • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced • COIBot-Link, Local, & XWiki Reports - Wikipedia: en - fr - de • Google: search • meta • Yahoo: backlinks • Domain: domaintools • AboutUs.com • DomainsDB.net • Alexa • WhosOnMyServer.com

Bu site wikipedia'dan link alabilmek için içerik oluşturmaktadir.

gezipgordum.com — Preceding unsigned comment added by 88.246.54.175 (talk) 16:54, 12 March 2020 (UTC)

Google translate says "This site creates content to get links from Wikipedia." creffett (talk) 19:49, 12 March 2020 (UTC)

Agreed with OP that it looks spammy, and none of the refs are relevant to the pages. I've cleared them all out. creffett (talk) 20:32, 12 March 2020 (UTC)

aglasem.com

• aglasem.com: Linksearch en (https) (insource) - meta - de - fr - simple - wikt:en - wikt:fr • MER-C X-wiki • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced • COIBot-Link, Local, & XWiki Reports - Wikipedia: en - fr - de • Google: search • meta • Yahoo: backlinks • Domain: domaintools • AboutUs.com • DomainsDB.net • Alexa • WhosOnMyServer.com

Came up while reviewing COIBot - it (and its subdomains) show up in a few articles and are right on the edge of promo. The website appears to be study aids (and maybe tutoring?) for exams in India. It pops up as a "source" next to several exams but doesn't actually support the claim - as an example, see Government Polytechnic, Barauni#Admission, it's used as a ref twice but the pages it links to don't even mention the article subject. Doesn't seem to have any encyclopedic value - the information it provides appears to be blog-quality and not likely to be reliable. Thoughts on whether to send this to the blacklist? creffett (talk) 23:55, 12 March 2020 (UTC)

delhiriot.blogspot.com

• delhiriot.blogspot.com: Linksearch en (https) (insource) - meta - de - fr - simple - wikt:en - wikt:fr • MER-C X-wiki • Reports: Links on en - COIBot - COIBot-Local • Discussions: tracked - advanced • COIBot-Link, Local, & XWiki Reports - Wikipedia: en - fr - de • Google: search • meta • Yahoo: backlinks • Domain: domaintools • AboutUs.com • DomainsDB.net • Alexa • WhosOnMyServer.com
• Boy shekhar (talk · contribs · deleted contribs · blacklist hits · AbuseLog · what links to user page · count · COIBot · user page logs · x-wiki · status · Edit filter search · Google · StopForumSpam)

Personal blog spammed on List of riots in India. — Newslinger talk 07:23, 15 March 2020 (UTC)