This page you are viewing is part of the SEVA Wiki Archive, Please visit the new Official Website!
NOTICE: Visit the Maillist page for help joining the new google groups email list, the old maillist is no more.
SEVA meetings are held every second Tuesday.


User:Rjf/Spam

From SeattleEVA
Jump to navigation Jump to search

We're getting some spam and vandalism which I'm reporting here and here.


Wikipedia Vandalism

For Jan 23 2006 within my watchlist: [1] [2] [3] [4] [5]


Spam

Odd Random Changes

Such Vandalism seems to have began on April 10th, 2007. I have mentioned it at meta.

www.eaa-phev.org:
www.seattleeva.org:

Solution

All of this vandalism appears to be coming from a new User-Agent which didn't exist until these began and only appears to identify this particular bot, so I've blocked it from accessing the site altogether by including in the apache configuration file:

SetEnvIf User-Agent "Mozilla/4.0 \(compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 2.0.50727\)" vandal_agents

Next add this Deny line to applicable virtual hosts directory sections:

<Directory />
 Deny from env=vandal_agents
</Directory>

This should work until the bot wises up and changes it's agent identification...

Registered Spam

Dude registered a user and blanked a talk page, banned forever. [13] User:DedMoroz6

acbutton\.com
acvideo\.net
chaddbc\.org
collincoinclub\.com
denicemonaco\.com
gcowd\.org

Another one, I suspect there may be more... [14] User:Ciklon22

x-cialis\.be
rx4\.org

Generic Spam

See this spam we were so fortunate to recieve:

Some script kiddie from oncuturk.org flying a W:Turkey flag thinks he's a "Hacker"...

  • [19] Identified by div id="zuenwa2895"
zip\.dk
lol\.to
home\.ph
blog\.hr
hk852\.to
myblog\.de
weblog\.ro
u-blog\.net
ripway\.com
rantweb\.com
freehost\.ag
20six.co\.uk
jislaaik\.com
4allfree\.com
boards2go\.com
chaosmagic\.com
gaestebuch4u\.de
wiccawebsites\.com
classicbroncos\.com
satanicwebsites\.com
electrical-contractor\.net
  • [20] This one was kind enough to identify itself as spam: div id="wikiSpam"
rx-seote\.com
  • [21] This one was kind enough to use the signature, doesn't look very botish.

<!pre> drugs\.com lrginc\.com Aciphex\.com Actonel\.com Actos\.com Acyclovir\.com Alendronate\.com Allegra\.com Altace\.com Amoxycillin\.com Atorvastatin\.com Augmentin\.com Avandia\.com Azithromycin\.com Bupropion\.com Bupropion\.com Carisoprodol\.com Cefixime\.com Celebrex\.com Celecoxib\.com Cephalexin\.com Cetirizine-HCL\.com Cialis\.com Cipro\.com Ciprofloxacin\.com Clarinex\.com Claritin\.com Clomid\.com Clomiphene\.com Cozaar\.com Desloratadine\.com Diflucan\.com Esomeprazole\.com Fexofenadine\.com Finasteride\.com Flomax\.com Fluconazole\.com Fluoxetine\.com Fosamax\.com Glucophage\.com Imitrex\.com Keflex\.com Lamisil\.com Levitra\.com Lipitor\.com Loratadine\.com Losartan\.com Meridia\.com Metformin\.com Montalukast\.com Nexium\.com Omeprazole\.com Orlistat\.com Pantoprazole\.com Paroxetine\.com Paxil\.com Pioglitazone\.com Pravachol\.com Pravastatin\.com Prilosec\.com Propecia\.com Proscar\.com Protonix\.com Prozac\.com Rabeprazole\.com Ramipril\.com Risedronate\.com Rosiglitazone\.com Sertraline\.com Sibutramine\.com Sildenafil\.com Singulair\.com Softtabs\.com Softtabs\.com Soma\.com Sumatriptan\.com Suprax\.com Tadalafil\.com Tamsulosin\.com Terbinafine\.com Tretinoin-Gel\.com Valacyclovir\.com Valtrex\.com Vardenafil\.com Viagra\.com Wellbutrin\.com Xenical\.com Zithromax\.com Zoloft\.com Zovirax\.com Zyban\.com Zyrtec\.com <!/pre>

Thanks for reporting this. I added a few from the top, rx-seote.com and mx.gs. The others from the top appear to be legitimate hosting sites that had spam domains on them. The long list of pharmaceuticals is confusing; some of them are probably spammer-owned but there are others that appear to be legitimate (like viagra.com). Perhaps some spam links were listed alongside legitimate links in order to improve search engine rankings? Not adding for now. silsor 23:10, 31 October 2005 (UTC)
7restaurant\.us
pharmacy\.net
celebrities\.evac4\.com
cann2\.net
sexual-area\.info
free-naked-girls\.info
webcindario\.com
idilis\.ro
blowsearch\.ws
741\.com
smuttygirls\.info
galaxy99\.net  
prohosting\.com
net4free\.org 
2hot2cool\.com
tiscali\.cz 
ifrance\.com
funpic\.de
mujweb\.cz
multiweb\.cz
girlsarea\.info
thesitefights\.com
snooser\.de
aimoo\.com
network54\.com
blogsource\.com
koolpages\.com
oneofthegirls\.info
gtiq\.info
badland\.com
proboards75\.com
kataweb\.it
ufanet\.ru
girlswantsmore\.info
qiiq\.info
20six\.nl
toolia2\.de
xorg\.pl
proboards46\.com
proboards53\.com
proboards55\.com
proboards56\.com
proboards57\.com
proboards61\.com
zorpia\.com
guestbookz\.com
cgispy\.com
007box\.de
mod-site\.net
power-guestbook\.de
maxpages\.com
cgiforme\.com
free-web-polls\.com
jeeran\.com
atomicboards\.com
easyjournal\.com
erimax\.com
girls-with-cunts\.info
adult-sex-girls\.info
3x\.ro
f79asd3454dfsdf\.com
nlm.nih\.gov
meds-help\.com
generic-cialis-levi\.net
levitra-xyz\.net
buy-cialis-x\.com
cialis-pcs\.info
marketingbuscadores\.com
acceso24h\.com
biada\.com
einnova\.com
posicionarweb\.com
ticketsfc\.com
iese\.edu
generic-help\.com
stikipad\.com
awardspace\.com

Bot 1 [_pw##_]

  • [53] This looks like the bot mentioned here [54].

<!pre> mx\.gs sie\.pl omet\.pl czytelnia\.net fragism\.com spiritualitea\.net <!/pre>

flappie\.nl
zwap\.to
ubtt\.org
xanga\.com
diaryland\.com
ojr\.org
japanmediareview\.com
islovely\.com
cutezone\.com
athome\.to
loveslife\.com
cutecity\.com
isfriendly\.com
duvx\.com
ismad\.com
isyummy\.com
ven\.bz

Bot 2 section replacer

Looks like a new Bot, it appear to be replacing the first section on user pages.

hranostaj\.com
cheefmsn\.com
newcarma\.cn
newpleasure\.cn
dronero?
antioch-college\.edu
beeplog\.com
lycos\.nl
zax\.co\.in
\.in
digitalpoimt\.com
kakalu\.com
#blogspot\.com # can't exactly block all of blogspot now can I?
#buykamagra.blogspot.com
#buyfosamax1.blogspot.com
#buylopressor.blogspot.com
#buyeffexorxr.blogspot.com
#buylioresal1.blogspot.com
#buycialissofttabs.blogspot.com
buy..\.blogspot.com
buy...\.blogspot.com
buy....\.blogspot.com
buy.....\.blogspot.com
buy......\.blogspot.com    
buy.......\.blogspot.com    
buy........\.blogspot.com    
buy.........\.blogspot.com    
buy..........\.blogspot.com    
buy...........\.blogspot.com    
buy............\.blogspot.com 
buy.............\.blogspot.com 
buy..............\.blogspot.com 
buy...............\.blogspot.com

User:Rjf

bgjq\.biz
sudu\.info
kqtr\.info
goak\.info
diamondcashclub\.com 
zjir\.com
viprape\.com
golft\.nl
lau\.biz
fiberia\.com
airmode\.de
#green-tea\.co\.nr
#green-tea-300\.co\.nr
hosting\.q4w\.net
co\.nr
#buy-tramadol\.fw\.nu
fw\.nu
narod\.ru
asso\.ws
scooter-web\.org
bikesplanet\.org

Main_Page

track4you\.cn
wpfreeblogs\.com
prexon\.nl
cinebb\.com
guestbook\.at
bb-fr\.com
gb-x\.de
megabb\.com
adipex-p-r.blogspot\.com
idisk\.mac\.com
extra\.hu
rasklad\.net\.in
z\.la\/
ownsthis\.com
userland\.com
vdforum\.ru
czytajto\.pl
quotaless\.com
defacer\.org
gov\.tr
free-bb\.com
levitra\.blogspot\.com
desiurl\.com
imageshack\.us
mb\.net
firm\.in
symy\.jp
fm7\.biz
freehostinn\.com
2site\.com
relurl\.com
6-6-6\.pl
strongsex\.info
9999mb\.com
\.co\.il
z\.tw
romandie\.com

mycv\.nu
20fr\.com
ibelgique\.com
#45\.kg
#70\.kg
\.kg
#alice\.it
\.it
sitesfree\.com
xarchive\.org
501megs\.com
freewebsitehosting\.net
  • Junk from 66.36.243.77 with no url
  • [123]
awardspace\.co\.uk
megspace\.com
lld\.dk
quickblog\.org
blogstudio\.com
monforum\.com
heavenforum\.com
free20\.com
ibdanswers\.com
pornzonehost\.com
aol\.ca
aol\.de
hometown\.aol\.com
forumer\.com
blogsharing\.com
dnevnik\.org\.ua
lacoctelera\.com
ialweb\.it
toplog\.nl
forumup\.it
freeforumhosting\.net
juicypornhost\.com
21publish\.de
9cy\.com
blox\.pl
eku\.edu
teamyates\.com
av-senteret\.no
indiana\.edu
kakiko\.com
c-o\.in
coz\.in
bee\.pl
blogse\.nl

New Page and Period "." Bot

opredo\.info
cheefmsn\.com
whytramadol\.biz
# tinyurl\.com/2qul3c 
croixrouge-binche\.be
cheaptramadolsite\.info
cardiomyopathie\.be
artengine\.be
akimbo\.be
espanacams\.com
knowledgemoney\.net
buytramadolpills\.info
elkind\.net
bxhost\.com
babylon-x\.com
erfurt-internate\.de
urettich\.de
steroidssupplier\.com
sdfl\.biz
band-consulting\.de
siegel-net\.de
intercoursezy\.info
interracialzy\.info
kinkyzy\.info
latexzy\.info
lesbozy\.info
libidozy\.info
lickzy\.info  
lingeriezy\.info
lubricantzy\.info
masturbatezy\.info
bisexualzy\.info
blondzy\.info
anuszy\.info
assholezy\.info
barebackzy\.info
bdsmzy\.info   
bestialityzy\.info
blowjobzy\.info
bondagezy\.info
bonerzy\.info
brothelzy\.info
bukkakezy\.info 
bustyzy\.info
butchzy\.info
castrationzy\.info
celebzy\.info
chubbyzy\.info
circumcisionzy\.info
clapzy\.info
climaxzy\.info
free-resumes\.info 
buyviagrapills\.com
uka-web\.de
caronlinedirect\.org
online-webportal\.biz
healthagencyclub\.org
shopusarx\.com
medsjoy\.biz  
buyusarx\.com 
enjoymeds\.biz
yourwebpublic\.org
adsense-org\.org  
  • more per their website.
ad4sense\.org
ad-sense-agency\.org
adver-ad-words\.org 
adwords-agency\.org 
your-adwords-agency\.org
adwords-org\.org
adsense-org\.org
world-adwords\.org
adsense4u\.org
adwords4u\.org
afxbmx\.info
chrykne\.info
infoarena\.info
bambulka\.info
homunkulus\.info 
bestoverture\.info
hoffmangolf\.com
yi\.org
khai\.edu
s-url\.net
jeeee\.net
alldatafree\.info
s-url\.net
editthispage\.com
freestuffer\.net
myamericanidol\.info
my-homedepot\.info
mybest-airlines\.info
dnip\.net
ipoo\.org
testoster0ne\.com
dtdns\.net
esbresources\.co\.uk
alldigest\.info
berry\.edu
wisc\.edu
dewaterratte\.nl
how-to-have-sex\.info 
wethar\.info
selllvbag\.com
yourflowerfarm\.info 
avtoban-dsk\.com
-zas\.blogspot\.com
oil\.jimdo\.com
hostultra\.com
xenadrine-hgf543\.blogspot\.com
yourcelebrit\.info
celebrityclan\.info
isthier\.de
iphorum\.com
yourpetlinks\.com
byethost.\.com
easyfreeforum\.com
mobymemory\.com
ind\.in
kherson\.ua
butkel1\.org
myrxnews\.info
mazdarxinfo\.info
greatrxinfo\.info
erxinfo\.info
webraindor\.info
rxworlddata\.info
rxtvinfo\.info
rxplusinfo\.info
svinka\.info
porosenok\.info
lebedi\.info
svinya\.info
cyplenok\.info
loshad\.info
kotyonok\.info
zherebyonok\.info
kozlyonok\.info
indyushonok\.info
supermortgagerate\.info
dearhomeloan\.info
krystalstealfan\.org
white-seo\.com
myeasyseek\.info
themysearch\.info
myownlook\.info 
workfinda\.info
pharmainfo\.net
h15\.ru
mistapotta\.com
phpbbx\.de
forumromanum\.com
rubyurl\.com
urlbounce\.com
kisaweb\.com
url\.vg
tnij\.org
url4\.net
info-graf\.fr
byronss\.com\.au
cresthomeloan\.info
sxlheoea\.com
ciwtcssy\.com
fzohpnvw\.com
1001nights\.net
greatcouponclub\ .info
italiagame\.org
couponclubusa\.info
yeshuanet\.com
  • [235]
  • [236] revision from second ip to avoid rollback?
jeun\.fr
siamforum\.com 
edaconnect\.com
hayotwater\.com
italytraffic\.info
traffit\.info
hecarabi\.info
thecanadianmeds\.com
ledes\.net
jondesign\.net
spin-sthlm\.org
windloadanalysis\.com
embnet\.org
#cobweb\.ecn\.purdue\.edu
purdue\.edu
#fb08-biochem58\.chemie\.bio\.uni-giessen\.de
uni-giessen\.de
#ites\.upr\.edu
upr\.edu
probapera1\.info

fucker\.info
italymega\.info
italika\.info
swinger-sex-chat\.info
sexy-chat-rooms\.org
live-adult-chat\.info
adult-chat-world\.org
dildo-chat\.org
flirt-online\.org
chatdoors\.info
atpages\.jp
mpprn\.info
gekz\.info
zeiter\.info
jcxej\.info
schadez\.info
hem\.nu
xhostar\.com
prophp\.org
afzw\.info
virginia\.edu
nabi\.org
forumprofi3\.de
bsu\.edu
queroumforum\.com
winthrop\.edu
bambid\.info
skocz\.pl
italinrus\.info
shkvarka\.info
kanak\.fr
uwyo\.edu
tulane\.edu
uned\.es
pe-solutions\.org
smokeme\.org
mambaitaliano\.com
luciano-pavarotti\.org
gbtop\.org
gratis-sito\.org
kebamnet\.biz
net\.ru
forumprofi2\.de
mtsu32\.mtsu\.edu
bestmine\.com
vsepoh\.info
ebemse\.info
ezseeu\.org
just2buy\.com
refinance-mortgage-4you\.com
thelookhere\.com
ringtones-dir\.net
fora\.pl
fin-fin\.biz
sweetteensonline\.com
gen\.in
zdka\.com
100freemb\.com
in\.ua
e4ls6p2\.com
just2006\.info
zmfa\.com
zvca\.com
finance-here\.biz
finance-on-line\.biz
houka5\.com
150m\.com
1stporno\.net
pornoroxx\.net
bxha\.com
factorywhores\.com
hqgall\.com
artstudiopottery\.com
dn\.ua
or\.at
#princeton\.edu  
#udayton\.edu  
#oas\.org
fort-myers-florida-real-estate\.com
discoverlife\.org
cyberimagegh\.com
ac\.jp
bestsearch20\.com
liverpoolfc\.tv
chenado\.info
cyox\.de
deduska\.info
2y5\.de
propaid\.org
webhosting4free\.org
hifrienddd\.info
webpage24\.de
com\.ua
freeforen\.com
hrentut\.org
republika\.pl
php5\.cz
lliippoo\.org
ttuuoopp\.org
  • trying to match all of these...
1.....\.org
1......\.org
1ebalo\.org
1foleks\.org
1hrens\.org
1domiks\.org
1golod\.org
1jolla\.org
1ibanusiks\.org
oxrash\.com
buy-cheap-software.net

display:none Bot

example syntax: [290]

<br><br><u style="display:none;">
 [http://www.google.not.ca/pda/search?q=spam+ness:spamness.there.net Spam]<br>
 [more links]<br></i>

or

<div style="overflow:auto;height:1px;">
uifu3\.info
opensymphony\.com
google\.ca
csanyi\.net
blogs\.ebay\.com

Massive new page bot, 183 unique urls

2geckos\.com 3coastal\.com 3guystechsupport\.com 5u\.com aaronprice\.com abiz4me\.com ac5512\.org acmeanesthesia\.com addr\.com allsomali\.com angelfire\.com anthroposofie\.nl anziobeachheadveteransofwwii\.com apapets\.org azzouni\.com bayani\.info bayareacoalition\.com belmead\.com books4homeschool\.com braincomputerinterface\.it brentjackson\.com bridgecounselingassociates\.org brokersally\.com bizland\.com ca\.us californiacolumn\.org can-be-scanned\.com carteretcountyschools\.org centralfloridavwclub\.org cftda\.org cinitron\.com classicchevyclubofnoar\.com clkwebdesign\.com co\.uk cohs\.net colecompany\.net com\.br comcast\.net commercialmortgagemall\.com cookiesbecause\.com cmich\.edu covenantonline\.com crescentsofbrisbane\.org croswellpolice\.com crwindustries\.com cwdavis\.com daems\.net dharmamemphis\.com dirtydelta\.com dmtsystemdesign\.com docmi\.org dsu\.edu e-literacyonline\.com endureth\.com engineers-india\.com eyewitnessvideo\.com farmercoop\.com fbckingsbury\.org fcote\.com fin402\.org fleet514\.com fmbinfosource\.com forestbrookhoa\.com fpinva\.org frankfortsportsmanclub\.com gardenclubsc\.org geraldlunn\.com ggsct\.org glasshillgolf\.com gloversville\.com gpab\.net griswolds\.net hackwith\.com halla13\.se heartofamericatractorclub\.com hitx\.com horsepenbaptist\.org houstonmccc\.org howibeatcancer\.org iaap-satellite\.org indianachildcare\.com intellischeduler\.com iqfnet\.org istitutocomprensivomeduno\.net jhelpdesk\.com jimdishertrucking\.com jordanmechanical\.com josca\.org jpcunlimited\.com jwebdesigning\.com kado4me\.com kappa-estl\.com keepingcentered\.com khems\.org kingsmancamp\.com kittykiernans\.com ks\.us lafdchs\.org liquidairenergy\.com lonepinequilting\.com louienet\.com mackbank\.com marinebig5\.com maywood-il\.org mb\.ca members\.tripod\.com midlandmcc\.ie mn\.us montesilvanosostenibile\.com myfathershousepa\.org nancylamott\.com naps100\.org net-newsletters\.com netcreations\.net newenglandplumber\.com newglarus\.org ngheartcenter\.com nnicc\.org nwaempire\.com nzs\.dk ocsparta\.com oftalmo\.cz onlineinsurance\.com openspaceproject\.com org\.uk ourhopechurch\.org palmconstruction\.com panagiasoumela\.org payettelake\.org pelhamweb\.org pelicanpointe\.net wcsu\.edu pghkaraoke\.com places4us\.com plans4wood\.com planterswalk\.com pleasantvalleyranch\.com pmconsultancy\.com polishnetwork\.com polishunion\.com professionalchef\.com weber\.edu projectodejersey\.com puzzlesbyjoe\.com pwcsmath\.com quest-youth\.org quiet-innovations\.com rainbowexplorer\.com realphd\.com redneckworld\.com reednorthamerica\.com rememberingheroes\.org remembertomstone\.net rezoe\.com rlstaton\.com roadwayretirees\.com rockymountainland\.com rodee\.org romania-internationalmedicalcenter\.org ruthiesarc\.org rviins\.com ryangoodson\.com s5consultants\.com saetnbeta\.org safetek\.com sagegoals\.com scottkuehn\.com scottsavoldawgpound\.com scpd-computerclub\.org scrapbooking-online\.com sd\.us servizioinformatico\.it skysyndicate\.com sportflight\.com yorktech\.com tasteof\.org tcgalaska\.com thinkables\.org tripod\.com uab\.edu usouthal\.edu weber\.edu mohid\.com