Vandalism reports: Difference between revisions

From Meta, a Wikimedia project coordination wiki
Browse history interactively
← Older editNewer edit →
Content deleted Content added
VisualWikitext
Line 45: Line 45:
:About half a year ago in the Netherlands - as well as several other Wiki's - I started with a series of articles concerning: "Material Waves of De Broglie". In the meantime my article as such is '''only in Holland''' completely deleted, replacing it without any discussion suddenly by a completely new one. For the moment still nobody has the guts to further edit there, because of that history. I too don't want to further comment this total erased quantumfysical lemma anymore, and preserved it in my own namespace. ǫ Faithfully yours: <font color=darkred>D.A. Borgdorff</font> → [[Special:Contributions/86.83.155.44|86.83.155.44]] 18:31, 27 June 2008 (UTC)
:About half a year ago in the Netherlands - as well as several other Wiki's - I started with a series of articles concerning: "Material Waves of De Broglie". In the meantime my article as such is '''only in Holland''' completely deleted, replacing it without any discussion suddenly by a completely new one. For the moment still nobody has the guts to further edit there, because of that history. I too don't want to further comment this total erased quantumfysical lemma anymore, and preserved it in my own namespace. ǫ Faithfully yours: <font color=darkred>D.A. Borgdorff</font> → [[Special:Contributions/86.83.155.44|86.83.155.44]] 18:31, 27 June 2008 (UTC)


===Witch-hunt===
====Witch-hunt====
This is turning into nothing less than a witch-hunt. Anon user was blocked on nl:Wikipedia for making a correction in his signature(!). Next he was discovered on es:Wikipedia, and got falsely accused of copyright violations, which resulted in several es:blocks and article space damage on nl:Wikipedia as well. And right after I have repaired that damage and es:Wikipedia unblocked him and apologized, the next accusation pops up. Whatever self-promotion there may be in these edits (note that so far no attempt has been made to prove this!), the damage done to Wikipedia by this stalking mob is already far greater. [[User:Guido den Broeder|Guido den Broeder]] 18:33, 27 June 2008 (UTC)
This is turning into nothing less than a witch-hunt. Anon user was blocked on nl:Wikipedia for making a correction in his signature(!). Next he was discovered on es:Wikipedia, and got falsely accused of copyright violations, which resulted in several es:blocks and article space damage on nl:Wikipedia as well. And right after I have repaired that damage and es:Wikipedia unblocked him and apologized, the next accusation pops up. Whatever self-promotion there may be in these edits (note that so far no attempt has been made to prove this!), the damage done to Wikipedia by this stalking mob is already far greater. [[User:Guido den Broeder|Guido den Broeder]] 18:33, 27 June 2008 (UTC)


Revision as of 18:34, 27 June 2008

Projects
Translate this page!
Template:Vandalism-side
Archives
1
See also Sub-pages

Most Wikimedia wikis are able to deal with vandalism on their own. This page is intended for certain reports:

  • Repeated noteworthy vandalism on a wiki that has no administrators (One time vandalisms can be reported to a steward on this page)
  • Cross server vandalism (i.e. a vandal attacking many different Wikimedia wikis) where coordination is helpful.

For pages that need to be deleted, see multilingual speedy deletions.

Reporting requirements:

  • The name(s) or IP address(es) of the offenders.
  • A description of their vandalism (spamming, adding junk, removing legitimate text, etc), preferably with links to examples.
  • The Wikimedia wikis affected.

Note on Wiki Spam: If the spamming is repeated and for a single site or sites, report it to the spam blacklist.

Current cross wiki vandalism

Please note the IPs quoted refer to current cross wiki vandalism. This is intended for colating information about cross wiki vandalism and advising of possible IP blocks that may prevent this on your wiki. Please join #wikimedia-adminconnect for cross wiki issues (any sysop from any project can join more info).

New reports should be placed at the top. For long term vandalism reports see lower down the page

Cross wiki selfpromotion

86.83.155.44 xwiki-contribs • xwiki-date (alt) • ST • IP info • WHOIS • robtex • gblock • glist • abuselog • bullseye, I am ashamed to say a fellow countryman, obstinately keeps adding references, many in the wrong language, to his quite insignificant (self-published, 30 copies) translation of an obscure physics work to at least a dozen wikipedia's (my own reverts were on bg, el, en, es, eu, it, pl, ro, ru, tr, uk, and zh, there's probably more). He has been blocked repeatedly on several wikipedias for varying amounts of time, to no avail. Wammes Waggel 15:12, 27 June 2008 (UTC)[reply]

I agree. BTW, he does the same on de. - Erik Baas 15:35, 27 June 2008 (UTC)[reply]
Ip 86.83.155.44 did absolutely not commit any cross-wiki vandalism: that IP user was only referring to an important source which was translated by this user. Te blocks this user got - by the way- were in most cases the result of minor improving edits in discussion contributions of that user himself (typo corrections etc) , and I think this witch-hunt against this user is a horrible example of the behaviour of some of the Dutch wikipedia users, who show no respect whatsoever for the valuable contributions of this IP user 86.83.155.44. Just to balance your thoughts, Regards, 89.146.9.130 15:28, 27 June 2008 (UTC) (known also as Tjako on Dutch wikipedia, and Pling on espanian wikipedia) P.S. I would like to add that IP 86.83.155.44 is certainly NOT a vandal, (see his contributins on lots of wiki's) so crosswiki measures are completely inappropriate.89.146.9.130 15:31, 27 June 2008 (UTC)[reply]
He is blocked (again !) on nl for making hundreds (!) of unnecessary edits to old items on talk- and archive pages, ignoring dozens of warnings. In my opinion he IS a vandal, annoying to the commmunity, and contributing next to nothing to Wikipedia. - Erik Baas 15:35, 27 June 2008 (UTC)[reply]
Oh, and he has one champion on NL, to wit, Tjako. Wammes Waggel 15:48, 27 June 2008 (UTC)[reply]
Ladies and gentlemen of this meta-wiki: please don't believe all those stated accusations, which in the meantime are handled by the (locked) en:Helpdesk and brought before the WMF. All my editted pages are already in research, frozen from June 8th onwards. With utmost regards: D.A. Borgdorff by n° 86.83.155.44 15:54, 27 June 2008 (UTC) those persons stalking me again all the time ... and now adding MoiraMoira joined up. dAb with 86.83.155.44 16:52, 27 June 2008 (UTC)[reply]
@86.83.155.44 - There is no reason at all to accuse normal long time Wikipedians of stalking. @ the meta-collagues dealing with the request here: The off-topic self reference involved was removed already a long time ago from wiki-nl where I am a mod and had to deal with this disruptive user way to often to my liking as such. I received a request from Wammes Waggel on my talk page today and upon having reviewed the situation wiki wide I referred him to this page since this is cross wiki and has no connection to the current block the user has on wiki-nl (but may be related to the other blocks on other wiki's). Kind regards, MoiraMoira 17:17, 27 June 2008 (UTC)[reply]
Maybe it would be wise for the overall Wiki Board to look into the disruptive behaviour of some moderators and users who even stalk users 'abroad' and the way some honest contributors are chased away. Unfortunately much of the talk is in Dutch. This would also imply such vast range of investigation that it probably would take years to anayze what's happening during the past months. I do however see that the atmosphere on the Dutch wiki gets more grimm by the day, where all kind of unfriendly language, personal attacks, and blocks and warnings which have nothing to do with the contents of the wikipedia gets more prominent by the day. Maybe it would be wise to take all moderators (admins) away from the Dutch wikipedia, and start all over again, with a complete new set of admins and stewards and bureaucrats. Unfortunately I don't know if this would be possible, but it certainly would be a great warning signal to all parties to behave more friendly, helpful to each other, with less arrogance, powerabuse, and more need to get discussions in control and with less emotional conflicts resulting from them. Sincerely yours, 89.146.9.130 17:26, 27 June 2008 (UTC) (also known as Tjako on Dutch wiki and Pling on Spanish wiki).[reply]
About half a year ago in the Netherlands - as well as several other Wiki's - I started with a series of articles concerning: "Material Waves of De Broglie". In the meantime my article as such is only in Holland completely deleted, replacing it without any discussion suddenly by a completely new one. For the moment still nobody has the guts to further edit there, because of that history. I too don't want to further comment this total erased quantumfysical lemma anymore, and preserved it in my own namespace. ǫ Faithfully yours: D.A. Borgdorff → 86.83.155.44 18:31, 27 June 2008 (UTC)[reply]

Witch-hunt

This is turning into nothing less than a witch-hunt. Anon user was blocked on nl:Wikipedia for making a correction in his signature(!). Next he was discovered on es:Wikipedia, and got falsely accused of copyright violations, which resulted in several es:blocks and article space damage on nl:Wikipedia as well. And right after I have repaired that damage and es:Wikipedia unblocked him and apologized, the next accusation pops up. Whatever self-promotion there may be in these edits (note that so far no attempt has been made to prove this!), the damage done to Wikipedia by this stalking mob is already far greater. Guido den Broeder 18:33, 27 June 2008 (UTC)[reply]

Language-category-vandal

Mass adding of 'useful' interwikilinks to language categories. Then he weaves some vandal-link in it: br, de, de, de, el, eo, bg, pt, ro, ro, sr, fy, fy, fy, fy, fi, fi, fi, gl, hr, hr, ...

He changes wiktionary and username. Watch out for massive interwikilink adding and do not hesitate to block. He comes back after a short block.

Usernames so far
Wiktionaries so far
  • bg
  • br
  • cy
  • da
  • de
  • el
  • eo
  • es
  • fi
  • fy
  • hsb
  • hr
  • is
  • li
  • lv
  • mn
  • nl
  • no
  • oc
  • pt
  • ro
  • simple
  • sk
  • sl
  • sq
  • sr
  • sv

Best regards, --birdy geimfyglið (:> )=| ∇ 11:01, 22 June 2008 (UTC)[reply]

script (reuires linux) to grab all changes to cats by a given user, if it's useful: [1]. -- ArielGlenn 00:55, 23 June 2008 (UTC)[reply]
Added Spanish name Bummer in the summer (checked by me on Spacebirdy's request). - Andre Engels 14:58, 24 June 2008 (UTC)[reply]
I made a page where one can zapp quickly through the recentchanges showing only categories, --birdy geimfyglið (:> )=| ∇ 15:09, 24 June 2008 (UTC)[reply]

Girl power IP

luxo:168.143.121.245 looks like enwikipedia, enwikibooks and en.wiktionary so far. Replaces pages with "girl power" things: en.wben.wpen.wikt.  – Mike.lifeguard | @en.wb 23:02, 6 June 2008 (UTC)[reply]

Now on mediawiki wiki.  – Mike.lifeguard | @en.wb 23:41, 6 June 2008 (UTC)[reply]

Cross-wiki vandal

66.142.195.205 xwiki-contribs • xwiki-date (alt) • ST • IP info • WHOIS • robtex • gblock • glist • abuselog • bullseye replaces good information with a lot of jibberish on en:/fr:/nl: and has been blocked there accordingly. Erik1980 23:55, 5 June 2008 (UTC)[reply]

Cross-wiki vandal

78.13.246.24 xwiki-contribs • xwiki-date (alt) • ST • IP info • WHOIS • robtex • gblock • glist • abuselog • bullseye So far I hve only seen this vandal on Dutch and English Wikipedia, but he/she is rapidly emptyingarticles or replacing them with some vague random words... Erik1980 23:55, 5 June 2008 (UTC)[reply]

Travian-vandal from 80.25.218.182

80.25.218.182 xwiki-contribs • xwiki-date (alt) • ST • IP info • WHOIS • robtex • gblock • glist • abuselog • bullseye adds some parameter to Travian links (example, if luxo wouldn't work). The site apparently does not change from this, I guess this must be his own ID for some internal purpose within Travian? Bináris tell me 17:19, 27 May 2008 (UTC)[reply]

Vandalism from 201.9.29.238

User 201.9.29.238 xwiki-contribs • xwiki-date (alt) • ST • IP info • WHOIS • robtex • gblock • glist • abuselog • bullseye attacked articles about Linus torvalds or Tux. Best regards, --birdy geimfyglið (:> )=| ∇ 16:12, 27 May 2008 (UTC)[reply]

Cross-wiki vandal

196.203.190.226 xwiki-contribs • xwiki-date (alt) • ST • IP info • WHOIS • robtex • gblock • glist • abuselog • bullseye, open proxy. --~Innvs: 03:15, 25 May 2008 (UTC)[reply]

Multi-IP vandal on several projects

Last days an user (or his bot) is modifying pages with erroneous code, and not good faith/purpose.

You'll can observe that on Global user contributions for 209.62.94.50.

He has used other IPs (Proxies?):

  1. 200.194.102.114 xwiki-contribs • xwiki-date (alt) • ST • IP info • WHOIS • robtex • gblock • glist • abuselog • bullseye
  2. 203.144.160.249 xwiki-contribs • xwiki-date (alt) • ST • IP info • WHOIS • robtex • gblock • glist • abuselog • bullseye
  3. 201.234.80.3 xwiki-contribs • xwiki-date (alt) • ST • IP info • WHOIS • robtex • gblock • glist • abuselog • bullseye

He doesn't include spam links but only things like <a href=.*> </a>. I have included that on ca:MediaWiki:Spam-blacklist (where, obviously I'm sysop).
Pasqual (ca) · CUT 08:46, 8 May 2008 (UTC)[reply]

Yes we know the XRumer bot attack is happening, and earlier in the morning a developer blocked a lot of those via the server , but they keep popping up, some of the stewards are working with the developers to counter this, please try to report know IP's doing this to here atleast, and we will try to get them blocked via server (temporarily atleast) though Global blocking implementation would have helped us a lot...--Cometstyles 08:54, 8 May 2008 (UTC)[reply]
Attacks are more frequent, and on cawiki, I think we can ignore them. If you can add temporally this expression (<a href=.*> </a>), ably we can block it. Otherwise "<a href= ..." is not allowed by MediaWiki, it never returns a link.
Pasqual (ca) · CUT 11:32, 8 May 2008 (UTC)[reply]
Since that is not a link, it cannot be blacklisted. The bots must be blocked. – Mike.lifeguard | @en.wb 12:10, 8 May 2008 (UTC)[reply]

For info - Commons & en wp earlier too. Blocked by me here & on Commons & reported to Birdy & Drini via mail at the time. They were not coming up as Open Proxies but I think they probably are & Xrumer was my though too. Thanks --Herby talk thyme 12:53, 8 May 2008 (UTC)[reply]

Virgin Media IP vandals

Cross-wiki vandalism from 63.224.144.226

User 63.224.144.226 xwiki-contribs • xwiki-date (alt) • ST • IP info • WHOIS • robtex • gblock • glist • abuselog • bullseye made massive vandalism on tl.wikipedia replaceing pages... also on stq, kg, la, ... with luxotool also some old vandalism had been found and removed. Best regards, --birdy geimfyglið (:> )=| ∇ 10:50, 1 May 2008 (UTC)[reply]

Related cross wiki vandalism IPs

I think this may be bot related. Commons had some strange edits about a week ago. Each edit was from a different IP but they were similar. The same pages have been vandalised today & I see similar activity on en wp.

May be worth investigation/review - cheers --Herby talk thyme 12:03, 25 April 2008 (UTC)[reply]

Yes, these edits are made by spambots. I found similar ones from these IPs:
I haven't checked all their contributions yet. Korg 05:34, 5 May 2008 (UTC)[reply]
Well, this is a well-known spambot who's using open proxies. How can we help you? … I just could block them on those projects where I'm a sysop. Or Drini could be asked to do so. Regards, —DerHexer (Talk) 08:14, 5 May 2008 (UTC)[reply]
Just catching up but Commons & en wp affected as well as here. Global blocking needed! Cheers --Herby talk thyme 09:13, 5 May 2008 (UTC)[reply]
When I'm back from university I'll do the blocks. Regards, —DerHexer (Talk) 11:26, 5 May 2008 (UTC) P. S.: The next ones tomorrow.[reply]
Thanks for the blocks. Korg 15:08, 8 May 2008 (UTC)[reply]

cross-wiki vandalism from 202.170.84.2

202.170.84.2 xwiki-contribs • xwiki-date (alt) • ST • IP info • WHOIS • robtex • gblock • glist • abuselog • bullseye sco, pih, zh, eo wiki were vandalized [2], [3],[4] (user already blocked on en.wiki for two weeks), also other projects as shown with luxotools (maybe it will show more in some days)
--birdy geimfyglið (:> )=| ∇ 14:29, 23 April 2008 (UTC)[reply]

Linux pages in English in non-English Wikipediae from 87.196.129.99

87.196.129.99 xwiki-contribs • xwiki-date (alt) • ST • IP info • WHOIS • robtex • gblock • glist • abuselog • bullseye creates stubs about Linux cross-wiki in non-English environments. Link www.kernel.org has been added to spamblacklist temporary to stop the stub creations.

Best regards, --birdy geimfyglið (:> )=| ∇ 16:04, 21 April 2008 (UTC)[reply]

Personal attack

A vandal (i think a student) created user pages about an academic person. Theese pages hr nl ja zh pl be cs pt deinclude personal attacks and swearwords. Theese accounts should block and pages delete because of google search.--Mach 09:55, 18 April 2008 (UTC)[reply]

czech wiki - indef block and page deleted --Chmee2 12:37, 18 April 2008 (UTC)[reply]
done on croatian wiki (hr) --Dalibor Bosits 13:26, 18 April 2008 (UTC)[reply]
done (be) --MaximLitvin 16:05, 18 April 2008 (UTC)[reply]
done (nl) MoiraMoira 16:44, 18 April 2008 (UTC)[reply]
done (de) by de:User:Syrcro, --birdy geimfyglið (:> )=| ∇ 16:52, 18 April 2008 (UTC)[reply]
done (pl) (pt) by locals, --birdy geimfyglið (:> )=| ∇ 09:24, 19 April 2008 (UTC)[reply]
done (ja) --Kanjy 09:47, 19 April 2008 (UTC)[reply]
done (zh) by zh:User:Cloudcolors, --birdy geimfyglið (:> )=| ∇ 14:42, 19 April 2008 (UTC)[reply]

Thanks for helping.--Mach 14:02, 19 April 2008 (UTC)[reply]

massive vandalism from 66.41.109.159

Massive vandalism in jbo-wiki: User 66.41.109.159 xwiki-contribs • xwiki-date (alt) • ST • IP info • WHOIS • robtex • gblock • glist • abuselog • bullseye jbo:Special:Contributions/66.41.109.159. Luxotool shows also vandalism in en.wiki. Other wikis yet not shown, there might be others, probably visible in some days.

Best regards, --birdy geimfyglið (:> )=| ∇ 01:59, 16 April 2008 (UTC)[reply]

dz.wikipedia vandal

User: Donuttowanoon xwiki-contribs • xwiki-date (alt) • ST • IP info • WHOIS • robtex • gblock • glist • abuselog • bullseye Donuttowanoon2 xwiki-contribs • xwiki-date (alt) • ST • IP info • WHOIS • robtex • gblock • glist • abuselog • bullseye and [5] creating pages in Dzongkha Wikipedia with Thai texts copied from Thai Wikipedia. He also blanked dz:Wikipedia:Autoconfirmed users. He claimed here that he is a 10 yrs old boy living in Thailand. According to his edit history in th:, this kid may vandal lo: and km: soon. Best regards, ---- 2T 07:46, 9 April 2008 (UTC)[reply]

Thanks for the report, he is now blocked on dz. Please keep us informed if You detect further problems. Many thanks, best regards, --birdy geimfyglið (:> )=| ∇ 12:06, 9 April 2008 (UTC)[reply]

Cross wiki spammer: in Islam-related articles

User/example diff: 77.31.112.228 xwiki-contribs • xwiki-date (alt) • ST • IP info • WHOIS • robtex • gblock difflink • glist • abuselog • bullseye, adding spamlinks in the middle of the entry, sometimes even in the middle of existing links. He went through all articles "Islam" crosswiki it seems.

Best regards, --birdy geimfyglið (:> )=| ∇ 19:33, 1 April 2008 (UTC)[reply]

Cross wiki spammer: John titor

User: 83.190.116.58 xwiki-contribs • xwiki-date (alt) • ST • IP info • WHOIS • robtex • gblock • glist • abuselog • bullseye creating empty pages with English links only, examples: az:John titor, vo:John titor, cy:John titor

Best regards, --birdy geimfyglið (:> )=| ∇ 13:49, 1 April 2008 (UTC)[reply]

Cross wiki vandal bots?

I'm going for the fact that we have some cross wiki vandal bot activity recently that seems to follow a pattern. I've currently spotted two IP involved 190.42.51.225 & 190.42.50.39. May be worth keeping an eye on - cheers --Herby talk thyme 14:43, 22 March 2008 (UTC)[reply]

Lisa Gerrard - vandal

User 71.192.59.22 xwiki-contribs • xwiki-date (alt) • ST • IP info • WHOIS • robtex • gblock • glist • abuselog • bullseye, Glitter1959 xwiki-contribs • xwiki-date (alt) • ST • IP info • WHOIS • robtex • gblock • glist • abuselog • bullseye and Dancinfool610 xwiki-contribs • xwiki-date (alt) • ST • IP info • WHOIS • robtex • gblock • glist • abuselog • bullseye are creating empty or English articles about Lisa Gerrard cross-wiki and uploading images of her locally with a link to a flickr-account, licencing under Cc-by-sa-2.0, while it seems obvious that these are not his. I tried to reach him several times like on vo, pih, ang. After the last he came to Meta, I explained to him again, to stop and he seemed to have read it because he answered but right after that he uploaded the image even here and then even continued on mediawiki-wiki.

I recommend to delete his images everywhere. Best regards, --birdy geimfyglið (:> )=| ∇ 15:01, 21 March 2008 (UTC)[reply]

I later learned he also edited on commons as ThePhantom28 xwiki-contribs • xwiki-date (alt) • ST • IP info • WHOIS • robtex • gblock • glist • abuselog • bullseye [6], where he also uploaded a copyrighted image. Also he seems to have more than one flickr account, found so far: dancinfool610 and thephantom28, with overlapping images.
Best regards, --birdy geimfyglið (:> )=| ∇ 01:43, 22 March 2008 (UTC)[reply]
Just found another account from where he claims to hold the rights: Glitter1959. Images are overlapping with the other two.
Best regards, --birdy geimfyglið (:> )=| ∇ 12:23, 24 March 2008 (UTC)[reply]
Other suspected flickr account: Sonya_the_photograph er, --birdy geimfyglið (:> )=| ∇

New IP: 76.118.195.114 xwiki-contribs • xwiki-date (alt) • ST • IP info • WHOIS • robtex • gblock • glist • abuselog • bullseye, blocked from huwiki for violation of the previous block. Acts on enwiki, Commons and some other wikis with the same profile, from the same ISP. Bináris 06:57, 13 April 2008 (UTC)[reply]

Vandal from 71.107.136.165

Attacked af, as, en, ka, ku, lv, lb wikipedia so far, inserting nonsense in Europa or America articles.

Best regards, --birdy geimfyglið (:> )=| ∇ 18:32, 13 March 2008 (UTC)[reply]

Vandal from 208.27.234.156

Attacking wo, av, jbo, chr, dz, got.wikipedia, en.wikipedia, page blanking or inserting nonsense. 208.27.234.156 seems to be known for such in the past, please compare [7]

Best regards, --birdy geimfyglið (:> )=| ∇ 16:26, 21 February 2008 (UTC)[reply]

Vandal from 69.94.191.109

The vandal replaced the picture of Ronald Raegan with some cat in the EN, FR and BG Wikipedia (didn't search others). The IP address seems to be of some school in Texas. --Петър Петров 15:53, 31 January 2008 (UTC)[reply]

Same editor, same trick on gawiki[8] and on enwiki[9] - now blocked - Alison ❤ 19:23, 31 January 2008 (UTC)[reply]
As announced on #wikimedia-adminconnect he ran through all or nearly all Ronald Reagan articles there are, best regards, --birdy geimfyglið (:> )=| ∇ 19:26, 31 January 2008 (UTC)[reply]
Do we know if there's any connection to the Rosa Parks vandalbot listed below? – Mike.lifeguard | @en.wb 21:26, 1 March 2008 (UTC)[reply]

Vandalbots on gdwikti

Just over the last few days. Constantly hitting the Talk:dame page. So far, all IPs have been open proxies. I portscanned them myself to verify:

  • 80.231.198.77 (no longer open)
  • 77.72.71.4
  • 63.238.76.250
  • 200.251.69.131

- I'm currently the only sysop on there - Alison ❤ 15:44, 29 January 2008 (UTC)[reply]

Rosa Parks vandalbot

Since yarrow is down, I can't link to luxo's, but 64.38.10.111 has been vandalizing across many wikipedias' Rosa Parks article. It is an open proxy.  – Mike.lifeguard | @en.wb 21:14, 27 January 2008 (UTC)[reply]

Vandalism is like [10].  – Mike.lifeguard | @en.wb 21:15, 27 January 2008 (UTC)[reply]

NO NOOKS vandal

Has used the following usernames for pagemove vandalism etc. on the no nooks theme (highly incomplete list, as these are only from 2 wikis): Blob12, Blob9, Blob10, Blobconk, Pluto 239, Rushlimbaugh.

The underlying IP 69.227.151.150 has hit:

  • commons (blocked)
  • en.wikibooks (blocked)
  • en.wikinews (blocked)
  • en.wikiquote (blocked)
  • en.wikisource
  • en.wikiversity (blocked)
  • en.wikipedia (blocked)
  • en.wiktionary (blocked)
  • fr.wikipedia
  • it.wikipedia
  • mediawiki
  • meta (blocked)
  • pl.wikipedia
  • pt.wikipedia
  • simple.wikibooks (blocked)
  • simple.wikiquote (blocked)
  • simple.wikipedia (blocked)
  • species
  • sv.wikipedia

– Mike.lifeguard | @en.wb 18:58, 8 December 2007 (UTC)[reply]

This is not an OP (so far as I can determine). – Mike.lifeguard | @en.wb 18:59, 8 December 2007 (UTC)[reply]

Long term vandals

BogaertB

BogbaertB is a cross wiki vandal, mainly on fr. and nl. (aka Mario Scolas on french Wikipedia)

"Unknown" vandal

International wiki-vandal, blocked indefinitely on several wiki's

Hi! I'm a moderator on the Dutch Wikipedia and I wanted to draw your attention to this user. Please have a look and act as you see fit. We blocked him/her indefinitely... Greetings, MigGroningen 18:24, 30 October 2006 (UTC)[reply]


Primetime

Primetime is an extremely misguided user who seems to think it's in Wikimedia's best interest to have him dump articles and images from current editions of the EB, OED, Merriam-Webster, etc and claim that he wrote them (plagiarism). When people see through his dissimulation, he will attempt to justify his blatant copyright flouting by claiming he's "Robin Hood". Once his main account is blocked he'll make a zillion sockpuppets to try and defend his "reputation" by making personal attacks, removing sockpuppet and block notices from his userpage, whining and trying to gain favor of uninvolved users, making legal threats and/or uploading more violations. Block any incarnation on sight and indefinitely; he has already been banned on English Wikipedia by Jimbo Wales himself. If your wiki has CheckUsers, have one of them find out the IPs he's been using; they're almost always open proxies and should be banned indefinately. See w:Wikipedia:Long term abuse/Primetime for more info and the masterlist of his sockpuppets on all wikis.


Vandal and username thief "Linuxbeak"

There is a widespread impersonator and vandal at work on Wikimedia and other wikis who creats accounts impersonating English Wikipedia user "en:User:Linuxbeak". He is been on en:Memory Alpha (Evidence), Abkhaz wp (ab:User:Linuxbeak), Afrikaans wp (af:Gebruikerbespreking:Linuxbeak), and has been reported at sr: and cs: (en:User:Linuxbeak#Someone took your username on sr:). The ab: account has yet to be blocked. According to the user being impersonated, this is the long-term vandal en:User:JarlaxleArtemis (en:Wikipedia:Long term abuse/JarlaxleArtemis), (Evidence).


影武者 (Kagemusha etc)

Popular vandal on East Asian language projects, including Chinese, Japanese, Korean, and Vietnamese, using mainly hinet.net, Taiwan based ISP. He was active on the project listed on the above, but found on other projects, including English Wikipedia and Commons.

His last known vandalism happened in July 2007.

Remarkable points:

  • Impersonification of admins of those wikis, jawiki and zhwiki in particular, both in their usernames and in their real names (if known).
  • Offensive usernames including other names, eitherh in usernames or real names.
    • In both cases on the above, userpages tend to contain offensive content.
    • In both cases, the accounts may contain non latin characters.
  • Offensive usernames including the Japanese monarchs or historical figures.

There are some useful pages about him including:


Recurrent vandalism

Multi-user, multi-pattern, cross-project vandal "tester"

en:Wikiquote has been experiencing concerted, rapid-fire, multiple-user attacks for two consecutive days, follwing a pattern that has happened at least twice before in the past few months. The most recent one also included a simultaneous attack on en:Wikinews. The person or people behind this create a bunch of usernames in rapid succession, frequently but not always following several patterns, including *ook, animals, "new user" words, cross-project sysop impersonation, offensive names, and others. Some of these names are leftover from earlier attacks — usernames that made no edits during the previous attack, but are "activated" for the new one. The attack begins with either unassuming usernames starting an innocuous trolling of joke posts to user talk pages or with the scatalogical usernames plastering insults and offensive terms over articles, user, pages, and talk pages (especially from Recent Changes and targeting anti-vandal sysops). Then another set of usernames starts posting local or cross-project vandalism warnings to the sysops, possibly impersonating a sysop from another project (not immediately distinguishable from an actual sysop belatedly registering a username to help in cross-project vandalism fighting). When the real sysops start blocking accounts and/or refusing to take the joke-posting bait, yet another set of usernames or IP addresses post complaints to sysop talk pages and Administrators' Noticeboard. Eventually these are all tied together by a careful consideration of timing, writing style, knowledge demonstrated by multiple users, and, most compelling, outright statement by the multiple users that they are the same person.

Supposedly these complex attacks are a product of someone testing anti-vandalism reactions (see q:Wikiquote:Administrators' noticeboard#Coming Clean and the surrounding topics for Wikiquote's recent problem), but this has happened before to Wikipedia (see w:User talk:216.164.203.90#Coming Clean), suggesting the true goal is the vandalism and the confusion it creates. One pernicious aspect of this attack is that the user participates in arguments between sysops of different projects after they've gotten annoyed with each other for blocking impersonators. (Or it may just be that the angry folks are all the impersonating user. It's hard to take time to consider the possibilities when you are manually fighting changes driven by an automated system, apparently leaving the vandal time to have fun pissing off the sysops with complaints against each other. See n:User talk:Jeffq and n:User talk:DragonFire1024#You got one too. (and subsequent topics) for an example.)

This is only a partial list of vandals and their sockpuppets (just on Wikiquote) involved in the past two days's attacks:

Some of these names (or variations) are also new users on Wikinews. Some vandalize on one project but not the other. Even though the contemporaneous creations during this rapid-fire, multi-user vandal attack should implicate one username if the other is used to vandalize another project, sysops are reluctant to block the account on the project where it isn't vandalizing. This leaves the untainted account available for future vandalism — see q:User:Mi nombre es Heraldo and its mention in q:WQ:AN for a concrete example.

The resulting confusion while trying to discuss so many new users doing so many different things across multiple projects in a short time makes it virtually impossible for small-project sysops to coordinate.

en:Wikiquote has only a handful of sysops, and has periods where none are watching. We cannot keep spending hours each day blocking such complex attacks, even if we bend or break our own policies to head off likely vandal accounts (which this vandal seems to be trying to encourage). I would like some advice on how we can do a better job of stopping these attacks, given our extremely limited resources. ~ Jeff Q (talk) 02:03, 30 October 2006 (UTC)[reply]

Also note, that although my username does NOT appear on the list, I was accused of being the same user as MyName on Wikinews-en. I have requested a checkuser on my own behalf which has turned up NOTHING on Wikiquote, but apparently shows that there are IP addresses trying to be me and setting me up on Wikinews-en. The apparent imposter on Wikinews-en was InvisibleSUn who made several accusations and threats to me. The user was blocked indefiantely afeter MyName on Wikinews-en admitted on the Admin Alert page to being the user behind the attacks. I have requested that an investigation into the IP's attempting to be me on Wikinews be launched as to further prove my innicence after being accused of being MyName, an imposter, troll and a vandal. Any new information on this incident, regarding me, should be placed on my Meta Talk page or my wikinews talk page. DragonFire1024 02:13, 30 October 2006 (UTC)[reply]
To expand on DragonFire1024's point, this vandal appears to have been trying to provoke hostility between sysops n:User:DragonFire1024 on en:Wikinews and q:User:InvisibleSun and myself (q:User:Jeffq) on en:Wikiquote by registering and using those usernames that weren't already registered across these projects and Meta. I may be the only one of the three that had registered usernames months/years ago on all three, but anyone investigating shouldn't take my word for it (that is, Meta's User:Jeffq). I've not been able to investigate all the implications and details of this most recent attack yet, as the thing already screwed my day up considerably, but I'm hoping we can straighten out any problems that were created in the next day or two. ~ Jeff Q (talk) 05:49, 30 October 2006 (UTC)[reply]
Please note that this vandalism has continued every day, at varying intervals between 20:00 and 02:00, right up through 2-3 November, both on Wikiquote and to a lesser extent on Wikinews. I don't know why no one is responding to this report. I must assume that I am either not filing it in the correct place, everyone here is too busy to respond, or they are not interested in working on this issue. I am not a frequent editor on Meta, so please forgive me if I am making some kind of mistake, but it would help if someone could clarify the reason for the silence. Thank you. ~ Jeff Q (talk) 10:34, 3 November 2006 (UTC)[reply]
Because this page isn't usually used for, to use an analogy, what w:WP:AIV is for, rather it's a semistatic, sedate listing of wanted posters, EG. w:WP:LTA. 68.39.174.238 01:25, 13 February 2007 (UTC)[reply]

The Swahili Football Vandal

Seeking advice on how to block a repeated vandal on the sw:wikipedia . Someone keeps vandalizing the sw page for soccer, http://sw.wikipedia.org/wiki/Mpira_wa_miguu . We revert, it gets vandalized again from a different IP. We are a small wikipedia with only a few active participants, and the administrators don't know all the ins and outs of protecting a page from this sort of attack. Can you offer clues? Thanks, Malangali 03:16, 12 December 2006 (UTC) 03:15, 12 December 2006 (UTC)[reply]

Tit vandal

Some bot is vandalizing from multiple IP addresses that related to the word "Tit". For example: http://en.wikipedia.org/w/index.php?title=Tit_for_tat&action=history

Some IP's have already been blocked, but the vandalism keeps coming from other IP addresses.

Wikipedia is Communism

actually a long term vandal, but a vandal with the same modus operandi has vandalised almost the entire database of the Zeelandic Wikipedia (zea: - zea:User:WIC). Steinbach (formerly Caesarion) 20:47, 19 February 2007 (UTC)[reply]

New post-"&" partial article erasing bot

I'm not sure that this is the appropriate place to mention this... I've just recently began seeing a new vandal bot at two of my MediaWiki sites, beginning on April 10th, 2007. The bot seems to remove large portions of articles after encountering an "&" character. Since this isn't spam, I'm unable to blacklist such edits. All I can do is revert the edit and then block the IP address. I would prefer not to have to close the sites to anonymous edits but that's about the only real solution that I can think of. I have a log of these edits available for review here http://www.seattleeva.org/wiki/User:Rjf/Spam#Odd_Random_Changes should anyone care to look into it. I'm not sure if we are seeing any similar vandalism at the core wikimedia sites? --D0li0 11:18, 12 April 2007 (UTC)[reply]

Solution

All of this vandalism appears to be coming from a new User-Agent which didn't exist until these began and only appears to identify this particular bot, so I've blocked it from accessing the site altogether by including in the apache configuration file: 

SetEnvIf User-Agent "Mozilla/4.0 \(compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 2.0.50727\)" vandal_agents

Next add this Deny line to applicable virtual hosts directory sections: 

<Directory />
 Deny from env=vandal_agents
</Directory>

This should work until the bot wises up and changes it's agent identification... --D0li0 04:08, 14 April 2007 (UTC)[reply]

Note that this User-Agent is just the one of IE 6.0 on Windows 2003 Server (Windows NT 5.2), SV1 = on a Security Version platform with a .NET client version of 2.0.50727. So you're also blocking that IE on machines with that same configuration, as well as that bot using the wininet library. Platonides 11:05, 11 June 2008 (UTC)[reply]

Mumfum vandal

Got a feeling it may be worth starting this one here. For sometime Wikibooks has enjoyed the company of one (or more) Mumfum vandal(s). It looks to me as tho they hit a number of wikis in succession on the 10th (Requests_for_CheckUser_information#Meta). The IP address for the meta one was the same as the books one so I'm wondering if others out there were affected? Equally whether some rather more co-ordinated action on IP addresses might be worthwhile. Hopefully stating the obvious I'll happily help wherever I can (& feel free to ask if anyone wants more info). The page move aspect of this vandal may point to an "on wheels" connection. If anyone is sure feel free to move this to that section - regards --Herby talk thyme 12:40, 12 April 2007 (UTC)[reply]

Pisskern Alien vandal

We have had a recurrent problem on the Norfuk Wikipedia with an individual registering a parachute account, and moving articles, usually pih:Norfuk Ailen and pih:Pitkern Ailen to crude variants. See our move log for illustration.

I whack the account as soon as I see it, and move the pages back, but it's getting tiresome. I add the pages into pih:Wikipedia:Protected titles before I nuke them, but the vandal then just uses some Unicode tricks to create titles that look the same, but are made from different characters.

I would like to make it so that users cannot move pages for a week after registering, but I'm not sure how this is done. Other than that, I'm stuck for ideas on how to combat this vandal. Does anyone have any ideas? Pallmall 08:39, 29 May 2007 (UTC)[reply]

You (an admin?) can "protect" the page using "block unregistered users" (just on "move" if you want). This prevents very new accounts (2/3 days I think) from moving the page. I would also suggest that you request Check user information on the accounts to see if there is an underlying IP behind some or all the accounts. --Herby talk thyme 08:51, 29 May 2007 (UTC)[reply]

Atsushi, Atsushi2, Atsushi3

Recently there has been a Japanese User misusing his userpage on dozens of Wikipedia-editions for long texts in Japanese. If you check the Usernames "Atsushi", "Atsushi2", "Atsushi3" using the contribution tool [11], you see that he's is doing that for quite a long time now. He has been blocked on several languages, sometimes only his userpage because it seems he's only using that page for editing. His editing history on fr, just as an example how he spams recent-changes with this nonsense. Doing no "real" vandalism he might be considered as harmless, yet all this japanese text could also be copyvio material, as nearly noone, especially on the smaller Wikipedias might be able to check it. I have no idea how to deal with this rather unusual vandalism, but still think something should be done on a meta level to stop him. --Christian Günther 07:18, 1 April 2008 (UTC)[reply]

For a quicker look on his accounts. See [12] ie. [13] [14] --Christian Günther 07:32, 1 April 2008 (UTC)[reply]

Vandal 125.24.52.147

km.wiki is being heavily vandalized by IP 125.24.52.147 and none of the active admins are online. Also, it looks like he is unrepentant. Please take the necessary steps to block him. Thanks! --Jose77 02:48, 27 January 2008 (UTC)[reply]

Seems to have stopped now, I'll keep a look out for more. Nakon 03:26, 27 January 2008 (UTC)[reply]
Also 125.24.181.89 and Superbot have picked up where they left off. Woodym555 13:30, 27 January 2008 (UTC)[reply]
Khmer now has a temp sysop, vandals blocked, vandalism cleaned up for now. Woodym555 00:50, 28 January 2008 (UTC)[reply]

http://es.wikiquote.org/

Helow, I am GArber in Spanish Wikiquote. The 190.84.63.207 es the spam bot, please block this IP., Thanks--85.57.215.38 20:33, 1 March 2008 (UTC)[reply]

http://es.wikiquote.org/

Helow, I am GArber in Spanish Wikiquote. The es.wikiquote.org is being heavily vandalized by IP 69.79.240.190, please block this IP. Thanks--85.57.215.38 20:33, 1 March 2008 (UTC)[reply]

Gracias, --birdy geimfyglið (:> )=| ∇ 13:21, 25 March 2008 (UTC)[reply]

Related pages

Retrieved from "https://meta.wikimedia.org/w/index.php?title=Vandalism_reports&oldid=1060703"