Wikipedia talk:Protected titles/XRumer spambot

From Wikipedia, the free encyclopedia

Corrected version below: (I didn't realise the namespace had to be specified separately from the page title.) Flyingtoaster1337 16:23, 1 February 2007 (UTC)

__NOTOC__ __NOEDITSECTION__
Lately spammers have been using automated software to post their spam links. These programs often create pages with nonsense titles. Below is a list of these titles, which no human will ever need to edit. The / at the end of some titles is not a typo, but what the spambots have actually created.

== Protected titles ==
The following titles have been deleted, and protected to prevent re-creation:
*{{protected title|Computer and video board games/wiki/Category:Board game designers/|ns=Category talk}}
*{{protected title|World Economic Forum/w/index.php|ns=Talk}}
*{{protected title|11:14/index.php|ns=Talk}}
*{{protected title|WikiProject Missing encyclopedic articles/Distributed indexing/Cyclopaedia/w/index.php|ns=Wikipedia talk}}
*{{protected title|Categories for deletion/Log/wiki/Wikipedia talk:WikiProject Military history/United States military history task force/|ns=Wikipedia talk}}
*{{protected title|Korath/wiki/User talk:Korath/Potentially useful stuff/|ns=User talk}}
*{{protected title|The Business and Economics Forum/|ns=Wikipedia talk}}
*{{protected title|Main Page/index.php|ns=Talk}}
*{{protected title|Coffee Talk/|ns=Talk}}
*{{protected title|Kjhkjhnm|ns=Talk}}
*{{protected title|Request for comments/wiki/Wikipedia talk:Requests for comment/Striver/|ns=Wikipedia talk}}
*{{protected title|Sri Lankan Conflict/|ns=Template talk}}
*{{protected title|Featured topic candidates/|ns=Wikipedia talk}}
*{{protected title|The Scream/|Especially egregrous spambot target, deleted about 10 times|ns=Talk}}
*{{protected title|Aadlhasljdaskjfgsakhfgsdhfg sadjfgsdfhgsadfjgsfjgsadjgfsfgsdjf gsfdjgs gfsad|Not strictly spam, but repeatedly reposted nonsense about [[pi]]; probably linked from a forum or blog somewhere.|ns=Talk}}
*{{protected title|Phorum/w/index.php|ns=Talk}}
*{{protected title|Hinduism small/|ns=Template talk}}
*{{protected title|Great Britain national rugby league team/|ns=Talk}}
*{{protected title|Eagle 101/WikiDiscussion Manager/Forum/|ns=User talk}}
*{{protected title|TrackBack/|ns=Talk}}
*{{protected title|Thailand-related topics notice board/Archive 1/|ns=Wikipedia talk}}
*{{protected title|International/|ns=Talk}}
*{{protected title|V sign/index.php|ns=Talk}}
*{{protected title|Drawing board/|ns=Wikipedia talk}}
*{{protected title|Miscellany for deletion/Wikipedia:Miscellany for deletion/Wikipedia:Articles for deletion/Laurent Banide|ns=Wikipedia talk}}
*{{protected title|Regional notice boards/index.php|ns=Wikipedia talk}}
*{{protected title|World Social Forum/wiki/Talk:World Social Forum/|ns=Talk}}
*{{protected title|World Social Forum/w/w/index.php|ns=Talk}}
*{{protected title|Miscellany for deletion/Wikipedia:Miscellany for deletion/Wikipedia:Miscellany for deletion/Wikipedia:Articles for deletion/Georg Michael Telemann|ns=Wikipedia talk}}
*{{protected title|Biographies of living persons/Noticeboard/archive toc/|ns=Wikipedia talk}}
*{{protected title|Biographies of living persons/Noticeboard/w/index.php|ns=Wikipedia talk}}
*{{protected title|Hungarian+Wikipedians'+notice+board/w/index.php|ns=Wikipedia talk}}
*{{protected title|Q-tips/index.php|ns=Talk}}
*{{protected title|Comparison of Internet forum software/w/w/w/wiki/Wikipedia:Articles for deletion/Comparison of Internet forum software/|ns=Talk}}
*{{protected title|Scientific journal/|ns=Talk}}
*{{protected title|Digital reference services/|ns=Talk}}
*{{protected title|Posting system/|ns=Talk}}
*{{protected title|ROOT/|ns=Talk}}
*{{protected title|Action potential/index.php|ns=Talk}}
*{{protected title|North/w/index.php|ns=Talk}}
*{{protected title|Zoroastrianism/|ns=Template talk}}
*{{protected title|Go Daddy/|ns=Talk}}
*{{protected title|Obesity/w/Talk:Obesity/w/Talk:Obesity/w/Talk:Obesity/index.php|ns=Talk}}
*{{protected title|Volvo 850/w/index.php|ns=Talk}}
*{{protected title|Ford Focus/w/index.php|ns=Talk}}
*{{protected title|Talk page/|ns=Wikipedia talk}}
*{{protected title|Project missing articles/|ns=Template talk}}
*{{protected title|World Social Forum/wiki/Special:Undelete/Talk:World Social Forum/|ns=Talk}}
*{{protected title|Miscellany for deletion/Help:Starting a new page/w/wiki/Help talk:Starting a new page/w/index.php|ns=Wikipedia talk}}
*{{protected title|Reference desk/wiki/Wikipedia talk:Reference desk/|ns=Wikipedia talk}}

Contents

[edit] Old list

With my latest dump analysis, I found these spam pages. I noticed many had been deleted but not added to this list, and before including the ones missing here, I prefer to ask if they should, or we would take a "wait and see" approach with these. I am right now importing the newest en: dump, and expect to have a new analysis (including very probable and probable spam pages) by Monday night or Tuesday morning. -- ReyBrujo 03:02, 16 February 2007 (UTC)

Anything that obviously looks like a spambot page should be added, if it isn't there. That's all of these:

  • Talk:.hack//w/index.php?title=Talk:.hack/SIGN
  • Talk:.hack/w/index.php
  • Talk:Best Buy/index.php
  • Talk:Components/minibb/index.php
  • Talk:Dvorak keyboard/w/index.php
  • Talk:Gainax/index.php
  • Talk:Grandfather paradox/w/index.php
  • Talk:Great Britain national rugby league team/index.php
  • Talk:Housing and Development Board/w/index.php
  • Talk:Internet forum/index.php
  • Talk:The Space Merchants/index.php
  • Talk:W/w/w/index.php
  • User talk:Eagle 101/Talk/Archive/4/w/index.php
  • User talk:LinkBot/suggestions/w/index.php
  • User talk:Project2501a/w/index.php
  • User talk:Zeno McDohl/w/index.php
  • Wikipedia talk:Articles for creation/w/index.php
  • Wikipedia talk:Featured topic candidates/w/index.php
  • Wikipedia talk:Miscellany for deletion/Wikipedia:Featured topic candidates/w/wiki/Wikipedia talk:Featured topic candidates/w/index.php
  • Wikipedia talk:Notice board for India-related topics/wiki/Wikipedia talk:Notice board for India-related topics/w/index.php
  • Wikipedia talk:Templates for deletion/Log/Not deleted/August 2005/w/index.php
  • Wikipedia talk:Votes for deletion/w/index.php

plus more. Also, Wikipedia talk:Drawing board/ and Talk:Comparison of Internet forum software/w/w/index.php are listed twice. MER-C 08:44, 16 February 2007 (UTC)

Not to mention
  • Talk:Webserver directory index/
  • Talk:Wiki/
  • Talk:Wiki/wiki/Talk:Wiki/
  • Talk:Comparison of Internet forum software/w/w/wiki/Talk:Comparison of Internet forum software/
  • Talk:Internet forum/
  • Talk:Jason Kottke/
  • Wikipedia talk:Requests for mediation/VBulletin/w/index.php
which are tagged with {{deletedpage}}. MER-C 08:52, 16 February 2007 (UTC)

A couple more, from google cache:

  • Wikipedia talk:Articles for deletion/GB Patrol World/w/index.php
  • Wikipedia talk:Articles for deletion/Lonelygirl15/

MER-C 08:56, 16 February 2007 (UTC)

Done all of these, and removed the duplicates. -- ReyBrujo 13:51, 16 February 2007 (UTC)

[edit] Split page or sections?

Why don't we create sections for now? Or split in subpages like A-H, I-M, N-Z, or similar? -- ReyBrujo 16:19, 18 February 2007 (UTC)

[edit] Do we need them all?

As in, I can download the deletion logs, parse them and get most of the nonsense pages that had been deleted (most times they match '%index.php%', '%/w/%' and '%/wiki/%' SQL patterns). It would be much faster than reviewing the deletion logs through MediaWiki interface for sure. -- ReyBrujo 03:59, 19 February 2007 (UTC)

[edit] what is the purpose of this protection?

After creating the nonsense-titled pages do the spammers come back to them? I'd expect they'd just create more such pages. Probably better to use a DNS blacklist or something, if you're not already. 75.62.7.22 05:38, 1 May 2007 (UTC)

Several are recreated by spambots automatically, like W/index.php. However, the fact is that no article would be created, ever, in that location. -- ReyBrujo 03:29, 2 May 2007 (UTC)

[edit] Latest blanking

I have reverted this blanking, and contacted East718 (talk • contribs • blocks • protects • deletions • moves • rights) for reasoning. I don't really like the idea of, suddenly, unprotecting dozens of pages. Even if it is indeed obsolete, it makes sense to keep the list for historical reasons. -- ReyBrujo (talk) 02:29, 17 December 2007 (UTC)

I have a bot that runs 24/7 and detects and deletes pages created by XRumer, then portscans and if necessary blocks the IP that created it. It's been running for a while now with a 0% error rate, so I figured that unsalting the pages would make them honeypots for zombie proxies. The issue of admins having to clean up after the spambots is no longer an issue because of this. east.718 at 02:31, December 17, 2007
I guess it is running at your own account? While it is easy to catch these attacks, I don't really like the idea of unsalting these pages, if only for historical purposes. Personally, I would like having the deleted pages reported somewhere (like this page), and to see what other admins think about this. -- ReyBrujo (talk) 02:37, 17 December 2007 (UTC)
We can keep the list around for whatever historical purpose it may serve, but I disagree with cascading protection. Like I said, this is an excellent way of catching zombie computers and open proxies. I also log deleted pages, here's what I've gotten in the past couple hours: east.718 at 02:45, December 17, 2007
[12/16/2007 15:24:01] 68.28.123.118 blocked
[12/16/2007 15:24:01] Talk:Sex/ deleted
[12/16/2007 15:59:36] 68.28.123.116 blocked
[12/16/2007 15:59:36] Talk:Sex/ deleted
[12/16/2007 17:58:40] 200.162.29.247 blocked
[12/16/2007 17:58:40] Talk:Highest and best use/w/w/index.php deleted
[12/16/2007 18:01:22] 98.193.55.82 blocked
[12/16/2007 18:01:22] Template talk:Electromagnetism/ deleted
[12/16/2007 19:13:27] 68.28.123.117 blocked
[12/16/2007 19:13:27] Talk:Sex/ deleted
[12/16/2007 19:41:21] 84.19.176.2 blocked
[12/16/2007 19:41:21] Talk:Main Page/w/index.php deleted
Well, not warning users is an excellent way of catching vandals too, but we do anyways. I am not against having a bot(?) catching the pages. But now I must ask, 3 years block? Have you talked with anyone about that? I think we should include more administrators here (AN or ANI should be told). -- ReyBrujo (talk) 03:04, 17 December 2007 (UTC)
That's pretty lenient, a 5 year hardblock is standard procedure for open proxies; immediate blocks are also what policy dictates if there is abuse coming from a proxy. I also scan every single IP to make sure that it is actually a zombie proxy. east.718 at 03:08, December 17, 2007
I appreciate your effort, and if you could publicly log the information somewhere with wikilinks, I would have no more objections (even though Wikipedia is not a playground and I don't like the idea of unprotecting articles to catch zombies). In any case, I am leaving a note at AN to see if some other admin is interested in this. Thanks for the explanations. -- ReyBrujo (talk) 03:13, 17 December 2007 (UTC)
I would appreciate it if you wait a while before posting it in such a high-profile area - if my bot continues to operate at no error percentage for a month or so more, I will submit it for review there myself as helpful and error-free adminbots are generally tolerated. There are other admins who are aware of this bot, and safeguards are in place if it goes down or flies off the rails in some manner. east.718 at 03:22, December 17, 2007
Well, if there are safeguards, if you make the information public at a sub-page in your user namespace (or at least add the items as semiprotected here), if you review every block done, and if you deactivate the bot if there are problems, I have no problem waiting for the review. Without such public immediate log, it would not be possible to determine if the bot is working or not. -- ReyBrujo (talk) 03:26, 17 December 2007 (UTC)
(outdent) I already review every block, and have set up a page here where blocks and deletions will be documented. I'm not sure what you're talking about regarding the semi-protection though. east.718 at 03:33, December 17, 2007
I meant, that if you were not able to create a report page, at least have the bot write the article names at this page as if it were handled manually. -- ReyBrujo (talk) 03:43, 17 December 2007 (UTC)