chongqed.org news

Server move finally finished

Tue, 10 Jan 2006 07:29:35 GMT

Server move finally finished

After a couple of technical problems, chongqed.org now resides on a new server. The new server should be a lot faster; we can now install all the Perl modules we ever wanted and thus I hope that chongqed.org's quality of service will be improved by the move.

marketingfuture.com - a spammer?

Wed, 09 Mar 2005 07:29:35 GMT

marketingfuture.com - a spammer?

In the last two days, I have my cleaning bot clean the Spanish GNU wiki. It seems to be abandoned; nobody was removing all the spam and thus I found it with more than 1,000 spammy edits the other day. Today, it was relatively quiet there. The page that my bot had to revert most often is a page created by one of the spammers: Qiyang. So I entered the term Qiyang into Google and the first result is for a SEO company that boasts "7 year experience of search engine optimization". And further: "You can be highly successful in China - you just have to know how to do it correctly". So I guess the obvious question is: Is marketingfuture.com a major spamming organization?

Default blacklist for DokuWiki: http://blacklist.chongqed.org

Mon, 07 Feb 2005 07:29:35 GMT

Default blacklist for DokuWiki: http://blacklist.chongqed.org

I just found out that the DokuWiki engine uses chongqed.org's blacklist as the default blacklist for spam prevention!

The chongqed.org newsfeed

Thu, 20 Jan 2005 07:29:35 GMT

The chongqed.org newsfeed

Everybody just has to have one these days, and that's why chongqed.org now has one too: a RSS feed. If you want to stay informed about the world of wiki spam and about chongqed.org, simply direct your feed reader to this address: http://chongqed.org/cgi-bin/feed.pl.

rel="nofollow" update

Wed, 19 Jan 2005 07:29:35 GMT

rel="nofollow" update

As a follow-up on the Google story, I can now report that the good folks maintaining the MediaWiki software have already implemented this for WikiPedia! Thanks!

Google to eliminate comment and wiki spam?

Wed, 19 Jan 2005 07:29:35 GMT

Google to eliminate comment and wiki spam?

Google announced yesterday that they will give us a weapon against comment spam: the rel="nofollow" attribute for links. This gives you a per-link choice about search engine indexing as opposed to the per-page choice, authors have had until now. The idea is that blog software is supposed to give any link in a comment that attribute while the links in the blog post itself can still be followed and bloggers can thus still influence the page rank of pages or google bomb each other. This seems like a excellent idea and I wonder why they didn't come up with it (much) earlier. Of course, this can easily be brought to the wiki world. I hope that the maintainers of wiki engines take notice and implement this (at least as an option) ASAP.

A broken spam bot?

Tue, 14 Dec 2004 07:29:35 GMT

A broken spam bot?

In the recent days, I noticed vandalism on several wikis. The vandal always comes with the hostname 64.125.108.5.available.above.net. Searching Google for this hostname reveals that he is busy on most every wiki out there. Usually, all he does is remove everything following the first few lines of a page. Since he is returning quite frequently and since I cannot imagine somebody so bored that he will spent his days deleting stuff from wikis, my guess is that he is using a bot. Probably a script kiddy that harbors some grudge against wikis. You can find on example of his weird hobby on the Know-how wiki.

chongqed DOSed

Mon, 13 Dec 2004 07:29:35 GMT

chongqed DOSed

Yesterday, we had the first denial-of-service attack on chongqed.org. The attacker had the hostname dpc6682009069.direcpc.com, his browser (or whatever it was he used to do this), didn't send any referrer strings. It did send the user agent string Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.0.3705; .NET CLR 1.1.4322). The attack started at 20:48 (GMT +1) and ended at 21:40. During those 52 minutes, he sent 2825 page requests to the keywords and spammers pages (all of them served by a script). Hoping that he did not use a proxy, I have informed his ISP. I also implemented a surge protection scheme for the script that serves all those pages. It seems that chongqed.org is working: we are able to annoy the hell out of some spammers out there.

Finally: A European spammer

Wed, 01 Dec 2004 07:29:35 GMT

Finally: A European spammer

Seems like the Chinese wiki spamming frenzy encouraged some American and European spammers to vandalize a wiki or two. Those guys are really doing their spamming at a Chinese scale. They don't just add a few links, they add dozens. Our first spammer in this sorry category seems to be a Mr. A. Keegan from Norfolk, UK. He owns the domains adultfriendfindernow.com, adultfriendsite.com, dating999.com, diet-pills-now.net, fabuloussextoys.com, findbestpills.com, and kucko.com. Well, at least he's been spamming for those recently. Who knows what other domains are his. It's interesting to look at the whois records. At some point he must have thought that having his name in those records isn't too smart when you are trying to pay the rent by spamming. So he tried the services of "Domains by Proxy, Inc.", left away his phone number, and his name. Seems he hasn't yet settled on one method to obscure his identity. Here's some chongqing for Mr. Keegan: adipex, adipex online, adult dating, adult dating online, adult finder, adult friend, adult friend find, adult friend finder, adult friend finder coupon, adult personals, adult personals online, adult sex, adult sex toys, adult toy store, adult toys, adultfriendfinder, adultfriendfinder com, adutltfriendfinder, anal toy, big dildo, brutal dildo, buy adipex, buy cialis, buy didrex, buy levitra, buy phentermine, buy propecia, buy soma, buy tramadol, buy ultram, buy viagra, buy viagra online, carisoprodol, cheap cialis, cheap didrex, cheap levitra, cheap phentermine, cheap propecia, cheap soma, cheap tramadol, cheap viagra, christian dating online, christian dating service online, cialis, cialis online, cialis viagra, dating, dating online, dating personals online, dating service online, dating site online, dating web site online, didrex, didrex online, dildo, dildo vibrator, free adult personals, free dating online, free personals online, friend finder, generic cialis, generic viagra, huge dildo, internet dating online, internet dating service online, jack rabbit vibrator, levitra, levitra online, on line dating online, online dating online, online dating service online, order phentermine, order viagra, personals online, phentermine, phentermine online, phentermine prescription, photo personals, photo personals online, propecia, purchase phentermine, rabbit vibrator, sex movie, sex personals, sex shop, sex store, sex toy, sex toy shop, sex toy store, sex toys, sex videos, singles dating online, soma, soma online, tramadol, tramadol online, ultram, ultram online, viagra, viagra levitra, viagra online, viagra prescription, vibrator, vibrators.

haibo.com: spammers!

Tue, 02 Nov 2004 07:29:35 GMT

haibo.com: spammers!

I guess I finally found one of the companies that do the spamming for a lot of Chinese websites: haibo.com. I just found spam for super glue which (from an advertizing kind of view) was pretty well done. The super glue manufacturer that was spamvertized is pasco-stationery.com. And at the bottom of www.pasco-stationery.com, you can find this little ad: "Designed & Supported By Haibo Network Inc.". A look at haibo.com through the Babelfish, pretty much settled it.

More from the wire mesh spammer

Thu, 28 Oct 2004 07:29:35 GMT

More from the wire mesh spammer

The wire mesh spammer from China is now resorting to using a proxy on the comcast.net network. He is currently spamming wikis at an amazing speed using that proxy with his usual crappy keywords: wire mesh, musical instrument, battery, garden tool, etc. His favorite, of course, is wire mesh. And he seems to be determined to push no less than 53 domains that are somehow connected to the wire mesh network. I wrote an email to abuse at comcast.net and I really hope that they will close this proxy.

Nutty spammer

Tue, 19 Oct 2004 07:29:35 GMT

Nutty spammer

The chongqed.org wiki has been spammed again. This time, the spammer had the IP address 61.179.12.211, which (again!) points to China. The really interesting part of this story comes from my server logs: He came from the WikiSpam page on the KaminskiWiki. That WikiSpam page contains the usual blacklist along with a link to chongqed.org that you can find on many wikis these days. He looked at spammers.chongqed.org for half a minute and then took a look at our antispam links. From there he went straight to our wiki, looked at its HomePage for another 30 seconds and then spammed it. Just like that. Here are his keywords:

Phone Mr. Zhang

Wed, 13 Oct 2004 07:29:35 GMT

Phone Mr. Zhang

I just found the telephone number of a spammer from China! This guy has been spamming for guanghui12.51.net. If you run this page through the BabelFish, you get a lot of incomprehensible gibberish, but we all understand this paragraph: "This domain name passes through the massive advertisements propaganda by the intercom as the key word, the search place prominent, the current capacity is huge, wants to transfer: Disposable transfer price 8,000 Yuan Consults the telephone: 022-27378036, Mr. Zhang" In fact, the keyword used was "intercom" and the advertisement propaganda was massive. Good ol' Mr. Zhang seems to be amongst the spammers in the latest spam run from China. Oh, by the way: the area code for China seems to be 0086 and 8,000 Yuan are roughly $970 or 785 Euro.

Chinese spam frenzy

Tue, 12 Oct 2004 07:29:35 GMT

Chinese spam frenzy

The wiki community is currently hit by a huge wave of spam from China. There are several spammers now that will vandalized pages by dumping incredible amounts of spam on any wiki page they can find. Fortunately, this is happening just after we updated our database and scripts to be able to deal with Chinese keywords. Combine this with the current frenzy and you'll figure out why our database has grown substantially in the last couple of days. Our indeces of spammers and keywords are now divided into Chinese and non-Chinese keywords. This doesn't mean that the latter does not contain Chinese spammers, though. Thus we are currently offering four lists of spammers and their keywords:

The worst offenders ("the nefarious ramifications of Pure Evil" as our new friend Emile would put it) are 1so.com.cn, best88.com, chunmeng.com, cz-huifa.com, ponytest.com, shop263.com, sinoart.com.cn, suolide.googlebaidu.com, and most certainly one of the most evil spammers of all times: ec51.com.

Another pissed-off spammer

Wed, 06 Oct 2004 07:29:35 GMT

Another pissed-off spammer

We have another case of a pissed-off spammer. This one has been spamming for hukuki.net and is from Turkey. He has been spamming mostly guest books, but here and there he also liked to plant links to hukuki.net on wikis, especially on the wikipedia where Angela noted in April: "hukuki.net are spamming hundreds of wikis, and many of the small Wikipedias have been attacked. It was added to the law article here. Most of the others had it put on their Main Page and disclaimers page. Often they hide the link by typing something [http://hukuk*.net _], so it just appears as an underscore of the page, which can easily be missed. Please watch out for this and revert it immediately.". A couple of days ago, he asked on Joe's user page on the wiki to be taken off our "blacklist". Apparently he had found out that he was in the chongqed.org database and on the wiki blacklist that you can find on many wikis out there. Seems he didn't like that. It also seems like he doesn't think he is a spammer. He claims that all he did was write his opinion on guest books (where is opinion was always something like "cool page" or "good job", always shorter than http://www.hukuki.net). He also claims that his edits on wikipedia were for the better of..., I don't know, mankind perhaps. OK, so neither of us knows Turkish, so we cannot judge his own website. But whether it is useful or not, we don't think you should be spamming for anything. Joe answered him something to that effect and he didn't like it. Instead sending a sensible reply back to Joe, he sent a quite emabarassing email that ended with "Please do not reply. I accepted I am a spammer. Good chance and clear idea...". And he decided to go on a rampage and spam the hell out of wikipedia. His briliant trick was not to spam for his site this time, but for Wikipedia, Yahoo, Google, Altavista, c2.com, usemod.com, emacswiki.org, and chongqed.org. Nice job! And the final answer to the question whether we should let him off the hook or not. NOT! The details about the hukuki.net story can be found on the chongqed.org wiki on Joe's user page and on the DiscussChongqed page. And you can find Joe's views on this on his blog

First spam on the chongqed.org wiki

Sat, 25 Sep 2004 07:29:35 GMT

First spam on the chongqed.org wiki

It happened! The chongqed.org wiki has finally been spammed. The spammer had the IP address 211.147.229.121 which points to China (of course). The funny part is that he came from Google where he was searching for " www.emmss. com". That's how he found our SpamReport page on the wiki. He didn't look at any other pages, just went ahead and spammed that page. Not in a particularly smart way, I might add. He used a strange syntax that is probably legal on certain bulleting boards, but it didn't win him much on our wiki. He also spammed many other pages that Google returned for his search on emmss.com. Seems somebody was smart enough to use the domain name emmss.com as a searcht term that guaranteed to return spammable guestbooks. Of course, we should chongq him right away. But there is one problem: All his keywords where in Chinese. I can't read Chinese and I don't even know how our database system would react to characters with that encoding. So I can't really chongq him. Looking at the domain names he spammed for, it seems that it was the usual lot: SEO outfits and the odd kitchen supply store. That's why we need your help: If you speak (or at least read) Chinese, could you please contact us to help fight the Chinese wiki spam that is so prevalent? Just write an email to manni@chongqed.org or show up on the chongqed.org wiki. And here is the list of spamvertized domains: 2881.com, 58882.com, 592mir.com, 99lhc.org, 99lhc.org, agreatserver.com, chinazrzz.com, dakuohai.net, google1000.com, hk9697.com, jmd.com.cn, ke-fei.com, rainbowvc.com, sakurakitchen.com.cn, su968.com, sz-daking.com, sz-google.com, szhx.net, sztongyi.com, tekall.com, vivaful.com, and yibt.com.

Cigarettes, degrees, green cards, and mortgages

Tue, 14 Sep 2004 07:29:35 GMT

Cigarettes, degrees, green cards, and mortgages

It seems that the wiki community is being plagued by another spam wave. Again. This time, the spammer has a netvision.net.il IP address and the whole operation is caried out in a very stupid manner:

The spammer doesn't seem to care whether his links work or don't work.
The spammer doesn't seem to care whether he has already spammed a page or not.
The spamvertized websites all redirect to different sites on the adprofile.net network. But many of these redirects aren't set up directly. The spam links for online diplomas and cigarettes, e.g., both get you to the online-diploma spam page.
The spammer is using (what he thinks is) html. But the <a href= tags have alt attributes. They also have title attributes which is ok (html-wise), but he didn't quote his keywords. Google would have a hard time with that spam.

I have added all the domain keyword combos to the database, chongqing not only the spamvertized domains but also adprofile.net: mortgage, mortgages, refinance mortgage, refinance mortgages, online university, online degree, online universities, online degrees, online education, aiuonline, devry college, university of phoenix, foreign exchange, forex, forex trading, green card, cigarettes, cigarette, cheap cigarettes, spyware, spyware removal, web hosting, hosting, domain hosting, site hosting, online dating, dating, dating service, poker, online poker, and poker room.

New features on chongqed.org

Sun, 15 Aug 2004 07:29:35 GMT

New features on chongqed.org

Today, chongqed.org sees one change and one addition. Let's start with the change: the index of spammers and the keyword index now each have links to little pages that have two textareas. These textareas contain the html and wiki code you need to link to chongq.org, chongqing a special keyword in the process. The addition is far more exciting: chongqed.org now has its own wiki! A few comments on our blogs (Joe's blog, Manni's blog), made us aware of the fact that chongqed.org doesn't have something like a forum where you can give us feedback. Because chongqed.org primarily serves the wiki community, we settled for a wiki instead of some web forum. You can find the chongqed.org wiki at http://wiki.chongqed.org/. Have fun, share your opinions, and please don't spam us.

chongqed.com

Wed, 11 Aug 2004 07:29:35 GMT

chongqed.com

chongqed.org now has a rival site: chongqed.com. Here's the story: I was on a short vacation last week and when I got back I found a little email conversation in my inbox that Joe had forwarded me. A spammer named Lior Yashinski had issued an ultimatum. He told us to remove the site usagc.us from our database or he would "mess up with your site and get it removed from the search engines". Since Lior didn't want to hear that I was away and that Joe couldn't remove anything from the database, he got ahead and registered chongqed.com. I don't know what his plans exactly are, but he seems to be determined to spend time and money to lower chongqed.org's page rank by getting some page rank for chongqed.com. Well, fine. We don't really care about our page rank. We never planned to sell the domain or run ads, so we aren't followers of some page rank cult. Why he does all this is a little more clear. As he says himself, he is a spammer (or was) and he doesn't approve of chongqed.org and how we are trying to ruin his reputation and that of his clients. Well, what can we say to this? If you don't want to ruin your reputation, you can simply behave and refrain from spamming in any way. If you piss in my garden and I tell the neighbors about it, who is ruining your reputation? Me? Sorry, but I don't think so.

Pissed-off spammer's comments

Tue, 13 Jul 2004 07:29:35 GMT

Pissed-off spammer's comments

A little update: Seems like that pissed-off spammer didn't trust our spammer submission form, he also posted comments to my blog and Joe's blog. The comment on my blog seems to be in German, but sounds a lot like the Babel Fish to me.