Vandalism reports/Archives/Archive 3
|
This is an archive. Please post new vandalism alerts on vandalism reports under the respective section. Thank you. |
210.11.188.20 (Melbourne High School)
[edit]Already blocked on en.wp (abuse report) and en.wiktionary, I've just spotted it on fr. Thank you, Comte0 21:31, 24 February 2010 (UTC)
- As you note, it's a school ip, and low-volume. And that IP is also used for fine contributions to English Wikiversity and the Fiji Hindi Wikipedia. –SJ+ help translate 02:16, 7 March 2010 (UTC)
Jauche vs. Mist
[edit]The same as yesterday--Ot 07:09, 23 January 2010 (UTC)
- Locked by pathoschild and unreverted edits reverted, checking through edits atm and thank you for the report! James (T C) 07:16, 23 January 2010 (UTC)
Neusiedler Güllenausfuhr
[edit]already blocked in two wikis--Ot 08:54, 21 January 2010 (UTC)
- That account was already locked. Thanks — Mike.lifeguard | @en.wb 18:48, 21 January 2010 (UTC)
Firstjetpilot - cross-wiki book spammer
[edit]Hi all. Found this guy on ga.wikipedia first and a quick cross-wiki check shows that he's only here to spam his book across as many Heinkel-related aviation articles as he possibly can - and all in English :/ He's already been reverted on our wiki, but seems to be everywhere right now.
- Cross-wiki check : here
- Website : http://www.pen-and-sword.co.uk/?product_id=1762 - http://www.erichwarsitz.com
- Alison ❤ 09:53, 13 January 2010 (UTC)
- locked. Kylu 02:41, 17 January 2010 (UTC)
Software spamming through PDF watermarking and overwriting
[edit]The user Mvcfalcon (Crosswiki contribs) is uploading and overwriting PDF files with watermarks in order, it seems, to spam an OCR software. The user also wrote an article on en.wiki about the software house selling that software, now deleted. He's uploading newer versions of already existing files with edit summaries like OCRed and web-optimized version. He's also uploading to Commons copies of PDF files existing on local wikis. I think a global block and a massive revert of his contributions are needed. The it.wiki account has been blocked indefinite by me. --Massimiliano∞ 01:09, 28 August 2009 (UTC)
- Hello Massimiliano, I have locked the account and warned commons, and reverted some things there and on it.wikisource, on some wikis I can't see the link in his pdf uploads, maybe I am not looking hard enough and it should be reverted to be on the safe side. Thanks for reporting and best regards, --birdy geimfyglið (:> )=| 04:40, 28 August 2009 (UTC)
Mass creation of articles in the wrong language in small Wikipedias
[edit]User:Kiteretsu and User:Md. Farhan have been creating articles in the wrong language in various small Wikipedias (copy and paste from ms.wikipedia, en.wikipedia or ar.wikipedia to fj.wikipedia, st.wikipedia or ak.wikipedia) They are also blanking pages. --Jorunn 00:03, 10 August 2009 (UTC)
- Hello Jorunn, thanks for the report, I have cleaned the wikis and blocked the users for page blanking, if they continue elsewhere maybe it will be necesary to lock their accounts too, best regards, --birdy geimfyglið (:> )=| 06:57, 10 August 2009 (UTC)
Language-category-vandal
[edit]Mass adding of 'useful' interwikilinks to language categories. Then he weaves some vandal-link in it: br, de, de, de, el, eo, bg, pt, ro, ro, sr, fy, fy, fy, fy, fi, fi, fi, gl, hr, hr, la, ...
He changes wiktionary and username. Watch out for massive interwikilink adding and do not hesitate to block. He comes back after a short block.
- Usernames so far
- Araf [stalktoy] – [cross-wiki edits]
- Autofellatorbot [stalktoy] – [cross-wiki edits]
- Bird from space [stalktoy] – [cross-wiki edits]
- Bocadilla [stalktoy] – [cross-wiki edits]
- Bummer in the summer [stalktoy] – [cross-wiki edits]
- Cerberus [stalktoy] – [cross-wiki edits]
- Cross Wikivandal [stalktoy] – [cross-wiki edits]
- Cunn Tlikka [stalktoy] – [cross-wiki edits]
- Dicksniffer [stalktoy] – [cross-wiki edits]
- Du ha en jattebra kropp [stalktoy] – [cross-wiki edits]
- Exicornt [stalktoy] – [cross-wiki edits]
- Frysky for love [stalktoy] – [cross-wiki edits]
- Faggot Cunt [stalktoy] – [cross-wiki edits]
- Freedom to most Kurds [stalktoy] – [cross-wiki edits]
- Grawp [stalktoy] – [cross-wiki edits]
- Growing panda [stalktoy] – [cross-wiki edits]
- I love Arnaut Daniel more than At de Mons [stalktoy] – [cross-wiki edits]
- I love female Serbian basketball players [stalktoy] – [cross-wiki edits]
- I love Lene Marlin [stalktoy] – [cross-wiki edits]
- I want to make love with Ripsipiirakka [stalktoy] – [cross-wiki edits]
- Jene Simonsen [stalktoy] – [cross-wiki edits]
- Kebab in my butt [stalktoy] – [cross-wiki edits]
- Kouign amman [stalktoy] – [cross-wiki edits]
- Kunn Tlikka [stalktoy] – [cross-wiki edits]
- MorelikeMikethe will-never-get-a-wife guard lol [stalktoy] – [cross-wiki edits]
- OnWheels [stalktoy] – [cross-wiki edits]
- Participater in anal threesomes [stalktoy] – [cross-wiki edits]
- Páne Minková [stalktoy] – [cross-wiki edits]
- Peedpants [stalktoy] – [cross-wiki edits]
- Pluhijijkj [stalktoy] – [cross-wiki edits]
- Poop on my chest bitch [stalktoy] – [cross-wiki edits]
- Primetime [stalktoy] – [cross-wiki edits]
- Sinner [stalktoy] – [cross-wiki edits]
- Somucheasiertomakesockpupps [stalktoy] – [cross-wiki edits]
- Sonofabeach [stalktoy] – [cross-wiki edits]
- Spacebirdlet [stalktoy] – [cross-wiki edits]
- Spise boy [stalktoy] – [cross-wiki edits]
- Sting like a Wasp [stalktoy] – [cross-wiki edits]
- Thoushaltnot [stalktoy] – [cross-wiki edits]
- Ustvari [stalktoy] – [cross-wiki edits]
- Wanker from hell [stalktoy] – [cross-wiki edits]
- Willy on Wheels [stalktoy] – [cross-wiki edits]
- Wonderfail [stalktoy] – [cross-wiki edits]
- Wiktionaries so far
- bg
- br
- cy
- da
- de
- el
- eo
- es
- fi
- fy
- hsb
- hr
- is
- la
- li
- lv
- mn
- nl
- no
- oc
- pt
- ro
- simple
- sk
- sl
- sq
- sr
- sv
- tr
Best regards, --birdy geimfyglið (:> )=| ∇ 11:01, 22 June 2008 (UTC)
- script (reuires linux) to grab all changes to cats by a given user, if it's useful: [2]. -- ArielGlenn 00:55, 23 June 2008 (UTC)
- Added Spanish name Bummer in the summer (checked by me on Spacebirdy's request). - Andre Engels 14:58, 24 June 2008 (UTC)
- I made a page where one can zapp quickly through the recentchanges showing only categories, --birdy geimfyglið (:> )=| ∇ 15:09, 24 June 2008 (UTC)
Girl power IP
[edit]luxo:168.143.121.245 looks like enwikipedia, enwikibooks and en.wiktionary so far. Replaces pages with "girl power" things: en.wben.wpen.wikt. – Mike.lifeguard | @en.wb 23:02, 6 June 2008 (UTC)
- Now on mediawiki wiki. – Mike.lifeguard | @en.wb 23:41, 6 June 2008 (UTC)
- See enwiki[3]. It's definitely a proxy - though likely closed, from checkuser results. It's registered to w:Pop Warner, apparently. I've just blocked on enwiki for 1 month for vandalism - Alison ❤ 09:08, 8 August 2008 (UTC)
Cross-wiki vandal
[edit]66.142.195.205 global-contribs (old) • xwiki blocks • IP lookup • WHOIS • robtex • gblock • glist • abuselog • bullseye • IP info • lwcheckuser replaces good information with a lot of jibberish on en:/fr:/nl: and has been blocked there accordingly. Erik1980 23:55, 5 June 2008 (UTC)
Cross-wiki vandal
[edit]78.13.246.24 global-contribs (old) • xwiki blocks • IP lookup • WHOIS • robtex • gblock • glist • abuselog • bullseye • IP info • lwcheckuser So far I hve only seen this vandal on Dutch and English Wikipedia, but he/she is rapidly emptyingarticles or replacing them with some vague random words... Erik1980 23:55, 5 June 2008 (UTC)
Travian-vandal from 80.25.218.182
[edit]80.25.218.182 global-contribs (old) • xwiki blocks • IP lookup • WHOIS • robtex • gblock • glist • abuselog • bullseye • IP info • lwcheckuser adds some parameter to Travian links (example, if luxo wouldn't work). The site apparently does not change from this, I guess this must be his own ID for some internal purpose within Travian? Bináris tell me 17:19, 27 May 2008 (UTC)
Vandalism from 201.9.29.238
[edit]User 201.9.29.238 global-contribs (old) • xwiki blocks • IP lookup • WHOIS • robtex • gblock • glist • abuselog • bullseye • IP info • lwcheckuser attacked articles about Linus torvalds or Tux. Best regards, --birdy geimfyglið (:> )=| ∇ 16:12, 27 May 2008 (UTC)
Cross-wiki vandal
[edit]MATURAM xwiki-contribs (alt • mw) • xwiki blocks • CA • gblock • glist • abuselog • SC • lwcheckuser
global contributions Already blocked in de and en:WP. --87.149.65.61 16:45, 15 February 2010 (UTC)
Done by Drini — Dferg (talk) 20:38, 16 April 2010 (UTC)
Cross-wiki vandal "Spider's Web: A Pig's Tale in..."
[edit]- Spider's Web: A Pig's Tale in Dutch (talk • contribs • block • xwiki-contribs • xwiki-date (alt • mw) • CA • gblock • xwiki blocks • SC • lwcheckuser)
- Spider's Web: A Pig's Tale in German (talk • contribs • block • xwiki-contribs • xwiki-date (alt • mw) • CA • gblock • xwiki blocks • SC • lwcheckuser)
- Spider's Web: A Pig's Tale in Vietnamese (talk • contribs • block • xwiki-contribs • xwiki-date (alt • mw) • CA • gblock • xwiki blocks • SC • lwcheckuser)
Crosswikivandalism with spam of a nonsense article and setting of incorrect interwikilinks to produce false bot edits, see e.g. botedits in de and en. --Engie 20:13, 16 April 2010 (UTC)
- They have been globally locked. --Bsadowski1 20:14, 16 April 2010 (UTC)
- Done - this is Bambifan101. Thanks for reporting, — Dferg (talk) 20:20, 16 April 2010 (UTC)
- Thanks, here are two acconts more. Regards --Engie 20:19, 16 April 2010 (UTC)
- Spider's Web: A Pig's Tale in Turkish (talk • contribs • block • xwiki-contribs • xwiki-date (alt • mw) • CA • gblock • xwiki blocks • SC • lwcheckuser)
- The Portugese expert (talk • contribs • block • xwiki-contribs • xwiki-date (alt • mw) • CA • gblock • xwiki blocks • SC • lwcheckuser)
- Done too. — Dferg (talk) 20:21, 16 April 2010 (UTC)
- Thanks, here are two acconts more. Regards --Engie 20:19, 16 April 2010 (UTC)
80.218.11.191 spaming it.Wikinews with copy/paste from Wikipedia
[edit]Check 80.218.11.191 on it.Wikinews, have created several pages with copy/paste from Wikipedia. More, check Categoria:Da_cancellare_subito for more articles to delete, the administrators in it.Wikinews not currently active Shooke 14:10, 3 April 2010 (UTC)
I have blocked the IP for now. --Jyothis 15:26, 3 April 2010 (UTC)
- Thanks, it.Wikinews not have active administrators, Shooke 19:24, 4 April 2010 (UTC)
- Hay 2, que editaron hace pocos días. Quizá quieras contactarles para los borrados. Saludos, — Dferg (talk) 19:37, 4 April 2010 (UTC)
Nipponese Dog Calvero / Kagemusha (KAGE) / Shadow / 影武者
[edit]Description
[edit]Popular vandal on English and East Asian language projects, including Chinese, Japanese, Korean, and Vietnamese, using mainly hinet.net, Taiwan based ISP which allocates IP-adresses dynamically. Also spreading activities to other projects nowadays. Identified on wiki-en als Nipponese Dog Calvero, on wiki-ja identified as KAGE or Kagemusha. Remarkable points:
- Impersonification of admins of those wikis, jawiki and zhwiki in particular, both in their usernames and in their real names (if known).
- Offensive usernames including other names, eitherh in usernames or real names.
- In both cases on the above, userpages tend to contain offensive content.
- In both cases, the accounts may contain non latin characters.
- Offensive usernames including the Japanese monarchs or historical figures.
- Has a preoccupation with a person (a vietnamese priest) called in various ways and spelling Peter Nguyen, Nguyen Van Hung, Nguyễn Văn Hùng, Peter Nguyen Van Hung, Peter Nguyễn Văn Hùng, Petrus Nguyen. Whether this person is notable or not is to be dealt with on your local wiki but the vandal for one reason or another wishes to place this person on every wiki version and pushes this vehemently with sockpuppets. He also vandalises the lemma removing valid sources and changes it wrongly.
How to deal with matters
[edit]Blocked accounts have been placed in bold. Please check whether on your wiki version still unblocked sockpuppet accounts exist and take action asap since accounts are used when left unblocked eventually. Please update this list by making blocked accounts on your wiki bold as well here. Many checkusers have been performed on several wiki-versions. This is the combined file. Please update with new accounts. IP addresses listed are all dynamic in nature so are reallocated per log in session. Blocking them is unneccesary in retrospect, just block the ones currently active for 3 days (maximum allocation time) when caught in the act. Consider whether a hard rangeblock is a possibility on your wiki when no collateral damage is done because of lack of edits totally. A soft block (only disallowing anonymous edits) can also be considered when you don't want to exclude registered legitimate users. This is a measure to be discussed dealt with according to local policies and possibilities of course.
Measures taken sofar
[edit]- block for 114.44.0.0/16 on wiki-en on april 12 2009
- block for 114.44.0.0/16 on wiki-fr for 4 months on april 20 2009
- block for 114.44.0.0/16 on wiki-it for 1 month on july 8 2009
- hard block for 114.44.0.0/16 on wiki-nl for 1 year on april 15 2009 - hard block possible after scanning of the range for edits either logged in or anonymous on wiki-nl . Only one legitimate sul user found, (all others were sockpuppets of the vandal or anonymous edits of the vandal) which has been informed to apply for an exemption although only active on wiki-zh.
- hard block for 61.219.36.0/24 on wiki-nl; similar to above
SUL and non SUL accounts
[edit]Below a list of accounts. Also pre-sul some may belong to the vandal. Be careful to check this on your local wikipedia. SUL accounts should be blocked everywhere, preferably cross-wiki (locking). User is known to reactivate old "sleepers" so be careful since they suddenly can become active up to over 2 years old.
File
[edit]IP-addresses used
[edit]Non-SUL accounts
[edit]SUL accounts
[edit]Please note: on wiki-en also other projects as wikibooks, wikinews, wikiversity etc are usually created. PLEASE COULD ALL THESE ACCOUNTS BE LOCKED BY A STEWARD
The extensive file above has been compiled by me with much help from other wiki-versions colleague admins and checkuser results wikiwide. I do hope all sul accounts can be locked as soon as possible to slow down this vandal. Please update here with new accounts made and/or IP-adresses used. Kind regards, MoiraMoira 19:06, 6 July 2009 (UTC) (admin on wikipedia-nl)
83.39.236.126
[edit]- Vandalism on the site "Monoteismo" by 83.39.236.126. Repeatedly changing the wording to include obscenities. Also, vandalic comments on his own changes. http://es.wikipedia.org/wiki/Especial:Contribuciones/83.39.236.126 --82.98.91.190 13:11, 20 November 2008 (UTC)
200.215.40.3
[edit]- Cross-wiki sock puppet that was blocked indefinitely on enwiki after manipulating several user accounts (unfortunately, the IPs are in such an immense range that it is not a good solution to block all of them; innocent people are in the midst of this). See Wikipedia:Requests for checkuser/Case/200.215.40.3.
- Made edits from after September of last year until February of 2008 as 200.215.40.3 global-contribs (old) • xwiki blocks • IP lookup • WHOIS • robtex • gblock • glist • abuselog • bullseye • IP info • lwcheckuser.
- Was involved in block evasion in enwiki late last month (obviously no longer using the identity of the first IP). 189.73.73.229 global-contribs (old) • xwiki blocks • IP lookup • WHOIS • robtex • gblock difflink • glist • abuselog • bullseye • IP info • lwcheckuser was blocked (see block log) for removal of content on Italian Wikipedia (itwiki). Was later unblocked as it appeared to be an "error", however, if this IP matches positive in conjunction with the other socks, then the attempts by that IP were for the same purpose.
- In itwiki, the blocking admin recieved a message from the IP (in Italian; apparently, the user speaks multiple languages). A rough translation would be:
- "I have been blocked for the "removal of content", but what content did I remove? Rather, I added: this. Or say that the Pope is not the head of the Catholic Church? 189.73.73.229 (talk) 03:25, April 25, 2008 (EDT)"
...this means that the user simply doesn't recognize other terms (ie:Pope (disambiguation), which should have the same meaning in all languages ...as in enwiki, the user is making the same attempts as the ones in ptwiki, itwiki and so forth).
- "I have been blocked for the "removal of content", but what content did I remove? Rather, I added: this. Or say that the Pope is not the head of the Catholic Church? 189.73.73.229 (talk) 03:25, April 25, 2008 (EDT)"
- The user has most recently been revealed as 189.31.111.134 global-contribs (old) • xwiki blocks • IP lookup • WHOIS • robtex • gblock • glist • abuselog • bullseye • IP info • lwcheckuser, however, as of the day this report was filed, 189.29.202.107 global-contribs (old) • xwiki blocks • IP lookup • WHOIS • robtex • gblock • glist • abuselog • bullseye • IP info • lwcheckuser made two edits on Portuguese Wikipedia, and so I am still awaiting the results from a checkuser on that.
- The most notorious edits were on Portugese Wikipedia. Articles like Sua Santidade were worst affected (until it was forced to be semi-protected). Also, according to all of the WHOIS queries, the user lives in Brazil (most of the queries say "Florianopolis"), thus, Portugese is likely the mother tongue. On enwiki, one of the socks were even named "Duke of Florianopolis" (see report).
- Here are some diffs and histories of pages that were affected in the many projects of Wikipedia: pt 1 pt 2 pt diff || en 1 diff || it 1 it 2 it diff (repeated) || la (content deletion)
- Wikimedia projects that are most heavily affected:
de.wikipedia.org ...pages: Suffraganbischof and Corpus Juris Canonici
el.wikipedia.org ...pages: Καρδινάλιος
en.wikipedia.org ...see sock reports
es.wikipedia.org ...pages: Shenouda III, Vulgata, Corpus Iuris Canonici, Urbi et Orbi, Sede episcopal
gl.wikipedia.org ...pages: Papa, Igrexa Católica Romana and Igrexa Ortodoxa
it.wikinews.org ...pages: No-Cav Day, infuria la polemica sugli attacchi a Napolitano e Benedetto XVI
it.wikipedia.org ...pages: Concistoro, Papa della Chiesa ortodossa copta, Eminenza, Shenuda III and Chiesa cattolica
la.wikipedia.org ...pages: Sinuthius III and Collegium Sanctae Crucis Vigornii
nl.wikipedia.org ...pages: Primaat (persoon)
no.wikipedia.org ...pages: Padova bispedømme
pt.wikipedia.org ...pages:
- ...all (or most) of the IPs are listed on the checkuser request and all of their global contributions are linked from there. Hopefully, I have covered everything (may be a little too much). Finally, since edits were made to different projects, there is still the potential of further global edits made by any of these accounts. Thus, as I said on the checkuser request (for confirmation), I would highly suggest an indefinite global block for all accounts (or active IPs in the future) to prevent creation/globalization of the same accounts so that further cross-wiki issues may cease. Also, I am open to any suggestions as this issue has gotten out of control in recent months. ~Troy 19:10, 29 August 2008 (UTC)
- Note: for more information regarding the IPs' contribs and their connections, see the request for checkuser that was filled out here. Also, if anyone is interested, I may send a Wikipedia email in accordance with Wikipedia's privacy policy. I do have some important information regarding how to track IP vandalism/sock puppetry in general, so I am prepared to give you that information if you are willing to know. Thank you. ~Troy 23:07, 29 August 2008 (UTC)
- I (finally) started trying to dig into this. I may be confused but I started with one of the wikis you listed... la:wp. Many of the pages you listed as being an issue there don't even seem to exist (and I cannot see that they ever did). So could you clarify a bit here? Thanks. ++Lar: t/c 02:58, 28 October 2008 (UTC)
- It's okay, you don't have to look at them all. I scrambled to get them on in the first place, and I'm not too surprised that I've made mistakes on identifying them all (my apologies). I have removed the pages I couldn't access from this list (see my diff on this comment) and the best way to track them is to go on my contribs on Latin wp. Should that help? ~Troy 18:44, 30 October 2008 (UTC)
- I (finally) started trying to dig into this. I may be confused but I started with one of the wikis you listed... la:wp. Many of the pages you listed as being an issue there don't even seem to exist (and I cannot see that they ever did). So could you clarify a bit here? Thanks. ++Lar: t/c 02:58, 28 October 2008 (UTC)
151.49.0.0/18
[edit]Anonymous only (?). Allowing account creation should be OK.
- Resetting sandboxes on multiple wikis, after any other edit. e.g. w:de:Spezial:Beiträge/151.49.25.66
- Doing nonsense editing on sandboxes, like self-reverting over long series of edits. e.g. w:de:Spezial:Beiträge/151.49.61.27
- Vandalism to user talk pages[4]
- Notifying on the talk page does not help, he just empties his talk page after any edit there.