Here is something interesting I found on spamhuntress.com: Netomedia are blog spammers. They seem to have a rather good php bot that (supposedly) can even deal with captchas. I never liked those anyway. – Manni - 2005-07-25 07:47
The OCR to defeat captchas (if true) is just insane. I am sure it works once it knows the variations each type of software it is attacking uses, but it seems like such a waste. Wouldn't it be easier to just move on to the next victim? Maybe they do it because they assume captcha users will be lazy about cleaning spam up, especially since they won't expect any spam to make it through. Then until everyone is using an OCR enabled spambot, they are the only ones on protected sites which is much better than competing with every other spambot and overloading pages with links so their PR goes down. It just seems like a lot of work and requires more bandwidth and processor useage. I bet the solution to this will be just make captchas even less human readable with random distortions. Some probably already do, I have seen some that are certainly not easily human readable. – Joe - 2005-07-26 06:22 UTC
Someone from yath01.zar.cronon.net just added tzz\.de to ReferrerFilter. I don't recognize the hostname that made the edit. We tend to trust people more if you create a username. From a quick look at tzz.de in Google it seems that is a good filter to have. In the chongqed wiki's case, unless we are getting hit especially bad by a referrer spammer we don't usually worry about filtering them. Our referrers page is not indexed by search engines so they can spam us all they want and it won't do them any good. And actually hurts them in the end. – Joe - 2005-07-19 15:18 UTC
Well, yath01.zar.cronon.net is my machine at work. I took a peek at the referrers page and had to do something about that bastard. Obviously, I trusted on the cookie being set here, which wasn't the case. But I guess that the ReferrerFilter page can only be edited by admins/editors anyway. – Manni - 2005-07-20 07:48
It wasn't locked. I did lock it, but then changed my mind since it doesn't really matter and thought we had someone else trying to contribute. If it was locked you wouldn't have been able to edit if you didn't have the login cookie, that is the only way it would know you were admin (I think). Should we lock it? – Joe - 2005-07-20 16:18 UTC
Good point; you're quite right. I guess we don't have to lock it. There's very little a potential abuser could do to that page that could trouble us in any way. In fact, I can't think of anything. – Manni - 2005-07-21 07:30
MattisManzel: There was an interesting spam case on community-wiki: some wiki page and I thought it would be a good idea to tell my old chonqed buddies about it. Spamers are trying on intelligence now it seems. They try to make their spam look like contributions (while at the same time making serious errors - like in this case starting with a blanc, On s23-wiki we had a spamer making a page named protected page. Ridiulous at the first view. But on weak wikis it might work. And they take over weak wikis. Spamlandia as a part - not a beautiful one, maybe, but a part - of wikilandia already exists. Anyhow.
I see you have a bot, cool. The wiki-forums works superb, new ideas go. Nice community. What I think: It would be good if community-wiki (where I'm busy) took a look at chonqed-wiki again. I just have a new idea cooking on community-wiki: eye of HAL. To start I'd like to put the chonqed wiki's rss-feed for the recent changes on community-wiki: eye of HAL. Do you have such a rss-feed?
Hi Mattis. There's an RSS feed of the chongqed.org news, but did you want one for the wiki RecentChanges? This osbercad dot com spam was not all that unusual really. Lots of spammers include some text along with their links. I think it probably makes google like the links better too (as well as being less obviously spam). Anyway… chongq em! Another example of this type of spam would be ebusiness-cards.org. – Halz - 2005-07-16 16:39 UTC
We don't have a feed for the wiki. Oddmuse does have one, but it doesn't work on Manni's server for some reason. We do have a list of all chongqed related feeds. – Joe - 2005-07-16 19:04 UTC
Hi Mattis, glad you dropped in again. I like the community-wiki: eye of HAL idea. Unfortunately, I cannot provide a feed for our recent changes. At least currently. Looks like one way or another chongqed.org will move to a new server in the next months. I hope the Perl modules that are necessary to easily provide a feed will be installed on the new machine. – Manni - 2005-07-18 07:24
MattisManzel: rome-wiki wasn't built in a day either :)
There seems to be a particularly nasty spammer attacking at lot of wikis at the moment. Each edit has a summary which tells a little porn story. I can see WikiMinion battling against it here on KayakWiki for example. URLs point to a complex link farm across wide range of free hosts. The pages always redirect to searchadv dot com, but that's not what they want google to see. So I tried to investigate this by clicking 'stop' to prevent the redirect, then viewing the source. But as I've seen before, the link farm seems to be designed to make it difficult to figure out the end point of all these links. There's hardly any external links at all.
I did find a link to http://www.silent-fear.org/tob/ but that site's kinda cool. Made with a sense of humour. It seems unlikely that they are interested in spamming. Maybe I'll ask them. – Halz - 2005-07-16 19:21 UTC
Halz, yes, over the last week or so WikiMinion has reverted literally thousands of spam edits by that porn spammer. UBCWiki has been particularly hard hit, for example, see this page. It is particularly annoying on UBCWiki because it provides wiki space to students, including school children. As you mentioned, this spammer rotates through many open proxies and URLs at free hosts, so . – RichardP - 2005-07-16 20:43 UTC
As most of you have probably noticed, chongqed.org is going through a slow spot. Luckily it appears many spammers are too. Hopefully we will be more lively once Summer is over.
Don't worry if you use the blacklist, even though this are slow, we are still adding new URLs relatively frequently. If you find anything we don't have, submit it.
Since it's so slow, I finally got sick of all the spammers and the vandal on netcathost.com hitting the main page. So I made it read only, lets see if they will hit something else now. We won't keep the main page locked for long, but it's boring if spammers can't expand their attacks and pick another page to show their stupidity on.
I still wonder what the netcathost.com vandal is doing, first he created a lower case truncated copy of wikihome, now he is removing all the line returns and truncating the text at just over 1800 characters. A few times he has left links to http://www.test1.com/test-1.htm, but I have major doubts that he is actually spamming for that site. I think he is just testing and attempting to learn (though its obvious he is slow). On another wiki he hit with the same truncated page and a test1.com link, he also tried a test2.com link. The whois info appears to indicate no connection between the two domains.
In related news, Ann and the rest of the bunch have been slowing down a bit too. There just isn't as much as usual to deal with out there right now. Or at least they are wising up and avoiding us. I also seem to be getting less email spam lately. Hopefully it stays that way, but I have my doubts. Spammers must be on Summer vacation.
Ann does have one big thing going right now though, it looks like she upset a spammer (how supprising). Someone seems to be referrer spamming her URL on other sites. Hopefully that will blow over soon as spammer revenge usually does. If you see any referrer or other spam for her sight let her know and provide whatever details you can so she can track this guy down.
Richard, is WikiMinion seeing a slowdown in spam too?
– Joe - 2005-07-07 04:29 UTC
During the month of June the number of reverts performed by WikiMinion was down by more than 50% compared to WikiMinion's 120 day running average. Perhaps spammers take vacations? However, for the last 24 hours or so, a spammer for botspot.net has been hitting several wiki's patrolled by WikiMinion pretty hard (see, for example, KayakWiki or UBCWiki). The modus operandi of the botspot.net spammer is pretty much identical to the infty.net spammer, so I suspect that either they're the same spammer or using the same spam-ware package.
– RichardP - 2005-07-07 05:50 UTC
I've seen a bit more spam the last week or so. A bit more traffic too. But then controversy always makes for more traffic. I've for the most part turned down the frequency of posting, and that affects traffic dramatically in the beginning, considering I had maybe four posts a day quite often.
– Ann
I've been on a spam fighting holiday because I had a lot of work to do (for once), also I had an internet outage at home, and also because I was actually on Holiday. …back now though :-) , although quite busy still. Halz - 2005-07-13 12:48 UTC