Forum:Spambot attack

From Uncyclomedia, the UnMeta-wiki
Jump to: navigation, search
Forum: Home > Spambot attack


I've been informed recently that Uncyclopedia Icelandic and Galician were attacked. As was reported previously done in the style of attack is similar to performed Uncyclopedias Flemish and Frisian.

However, the attack carried out in Desgalipedia my doubts whether this was actually done by spambot. At least two articles Pudi noted that:

If you can not read the link in red...
... click on the images

The attack was in four articles but picked these two for the simplicity of how the attack was made. With this, I have absolute certainty that the attacks in recent days were not made by spambot but by someone who knows our projects and deliberate attack. Rhubella beach.jpgRhubella Marie, the rat sockpreppie 2077 preppieditsRhubella.jpg 17:17, 14 September 2011 (UTC)

Contents

[edit] Idea

Why don't we implement the global block at Uncyclomedia? --Helder Oliveira (talk) 20:48, 14 September 2011 (UTC)

  • I don't know, maybe it would be interesting for the Russian Uncyc to block all editions from Telemar (201.19.x.x) but not to block Telemar for the Portuguese-language projects. But I suspect that all those IPs, below, could be blocked without pity in the Portuguese language projects. They are all blocked in Malucopedia, and there has been few episodes of spambot attacks:
91.198.0.0/16
46.73.0.0/16
115.111.0.0/16
182.72.0.0/16
212.92.0.0/16
64.31.0.0/16
120.89.0.0/16
69.147.0.0/16
66.90.0.0/16
74.208.16.0/24
173.208.0.0/16
173.234.0.0/16
67.202.0.0/16
67.159.0.0/18
216.218.0.0/16
184.105.0.0/16
96.30.0.0/16
193.200.0.0/16
65.49.0.0/16
64.255.0.0/16

But I would question the blocks on:

187.90.0.0/16
187.77.0.0/16

because I think 187 is a brazilian internet provider. Cthulhu.fhtagn (talk) 22:47, 14 September 2011 (UTC)

Hum... Cthulhu I'd like you to reassess what I said now, because just say something nonsensical. I would like to analyze the IP ranges to block this day.

Firstly I have no evidence yet that was Lev Cow or other known vandals and on top of what I described and you want to attack Uncyclopedias. Another thing is that the attack was carried out IP of various origins. And non-Brazilian.

  • 212.124.102.121 (bloquear) (14:53, 14 de setembro de 2011 -- 15:27, 14 de setembro de 2011) [5] (Bloqueado - 212.124.0.0/16)

This was checked that the IP vandal and accused American origin. The ban IPs that are either American or even Australian. Be careful because it may be making false accusations. Rhubella beach.jpgRhubella Marie, the rat sockpreppie 2077 preppieditsRhubella.jpg 03:59, 15 September 2011 (UTC)

Do you think any of those IPs are not used by spambots? Feel free to unblock them. Cthulhu.fhtagn (talk) 10:26, 15 September 2011 (UTC)
I tell you to check on Uncyclopedia that were attacked. The IP does not match that introduced me to my list. So are not the same person. Rhubella beach.jpgRhubella Marie, the rat sockpreppie 2077 preppieditsRhubella.jpg 16:58, 15 September 2011 (UTC)

[edit] Another attack on UnCommons

UnCommons was attacked by spammers, and I blocked the IP range 199.15.0.0/16. Cthulhu.fhtagn (talk) 16:22, 19 September 2011 (UTC)

Ok, vou dar uma olhada... mas estou meios ocupada com algumas crianças persas aqui. Rhubella beach.jpgRhubella Marie, the rat sockpreppie 2077 preppieditsRhubella.jpg 17:27, 19 September 2011 (UTC)

Here's the list of IPs that belong to brazilian ISPs for the sake of curiosity (although do not contain class A and B ips used by some companies like Banco do Brasil). And about of these spam bots attacks, most of them come from open proxies all around the world, don't matter the country of origin. Range blocks are not really effective in this case as they are generally using ips in different ranges. I'd recommend range block only if realize that the vandal is using the same range (the is, sample of 2 or greater required).

There's no simple rule for blocking them and even the mediawiki proxy blocker make mistakes and false positives as you may see here and here. What I've done last year was blocking IPs (not range blocks) from does sites that list public ip proxys. Over 9000 3000 ips was blocked. You may see them in the logs, but I do not ensure that there isn't any false positive, specially for nom-portuguese wikis.

Truewww (talk) 08:48, 25 September 2011 (UTC)

[edit] Unciklopédia under attack

There are two types of vandalism occurring here:

  • In older Uncyclopedias, the spambots attack with links junk product sites of them.
  • In newer Uncyclopedias, IP's are a huge mess with pages with texts evil idiots.
He had the same idea about it, so here is discussing ways to identify the IP's and today I saw some vandalism the same way being made in Hungary... :(

The great thing is that in case of vandalism made ​​by IP'so range is 20 or 30 minutes on average. If a user would suggest that literally makes a very sharp exchange of range. However, many times when I try to trace an IP by the locator I hate when I see an enormous distance between the sites between the two IP's used. Rhubella beach.jpgRhubella Marie, the rat sockpreppie 2077 preppieditsRhubella.jpg 03:53, 26 September 2011 (UTC)

[edit] Counterattacking the spambots

In another wiki that I, accidentaly, became administrator and bureaucrat, the SWFTools wiki, a very interesting tool was installed. It's called RecentChangesCleanup (see article in Portuguese, at wikinet or the official description).

It allows the user of the tool to hide everything that is unconvenient from the Recent Changes. I suggest that every wiki that is under attack by spambots or suffering from massive IP vandalism to adopt this tool, so that any user that clicks in Recent Changes will get the real Recent Changes (pages that were created, messages between users, etc) instead of the noise (spam bot attacks, banning of spam bots, vandalisms, reversion of vandalisms, etc). Cthulhu.fhtagn (talk) 13:14, 17 December 2011 (UTC)

But, to spot the spambots to delete them, we have to see them, or am I just missing something? Roye7777777 ~ Talk 17:40, 17 December 2011 (UTC)
If an admin marks an edit from RC to hide, It will be marked as bot edit and others can see it if they click on Show bots button.(as documentation said) Mjbmr (talk) 18:24, 17 December 2011 (UTC)
It will not be a bad welcome to use this tool. Another thing, in recent weeks other three uncys were attacked among which one neither I nor Cartoonist are stewards. That is, only Carlb can reverse the damage done by these spambots. Rhubella beach.jpgRhubella Marie, the rat sockpreppie 2077 preppieditsRhubella.jpg 20:34, 17 December 2011 (UTC)
I don't know this. If sysops want to delete the content, that content would not be visible on the first sight (unless showing it by "show bot edits") Cartoonist | Spit it out (talk) | E-mail | UnMeta | 01:19, 18 December 2011 (UTC)
Personal tools
View and edit namespaces data

Variants
Actions
Navigation
Reports and requests
Community
Contact
Toolbox