User:Magister Mathematicae/daylog/0711-2

From Meta, a Wikimedia project coordination wiki

30 november[edit]

83.180.168.218: attacking user across wikis[edit]

That IP has been targeting some user called Ecemaml, replacing his userpages with pigs. He's vandalized:

29 november[edit]

65.25.105.176: multi wiki vandal[edit]

Not much, a few grabage pages I?ll delete later. I think Mike will add some notes from simple.wikibooks.

65.25.105.176 has been creating stupid Cookbook pages and vandalizing in that namespace at en. and simple.wikibooks for some time. Blocked on en a few days ago, but kept at it on simple. Thanks to Drini for being available. – Mike.lifeguard | @en.wb 21:50, 30 November 2007 (UTC)
Luxo's - has apparently been around the block.


Well, he just vandalized ang.wiktionary

He's been vandalizing wikis for 4 days. He has vandalized: 

ang.wikipedia
ang.wiktionary
en.wikibooks
en.wikinews
en.wikiversity
en.wikipedia
en.wiktionary
en.wikisource
fr.wikibooks
fr.wikipedia
la.wikipedia
simple.wikibooks
simple.wikipedia
simple.wiktionary

in the last 4 days. drini [es:] [commons:] 00:42, 1 December 2007 (UTC)



29 november[edit]

All quiet in the front. A couple of garbage pages, it seems the massive spam from the previous days is gone, hopefully for a while. Thank you Tim. drini [es:] [commons:] 14:39, 30 November 2007 (UTC)

28 november[edit]

New day, more garbage


Spam botnet[edit]

Some residuals from yesterday, some new. 

66.94.161.28 dz.wikipedia
189.50.208.18 ba.wiktionary
217.24.178.59 ba.wiktionary
220.227.138.82 as.wiktionary
201.238.175.60 bm.wiktionary
211.40.28.66 bs.wikiquote
210.19.150.4 bo.wikibooks
66.8.94.74 bm.wikiquote
213.215.246.250 ch.wikipedia
201.65.114.2 ch.wikipedia
82.114.150.117 ch.wiktionary
202.29.87.40 chr.wiktionary
200.252.91.150 co.wikipedia
84.19.174.44 cr.wikiquote
82.195.156.186 ia.wiktionary
200.144.17.34 mh.wiktionary
212.202.151.219 mg.wikibooks
203.113.148.130 mg.wikibooks
217.24.178.59 xh.wikibooks

27 november[edit]

Listing of spammer IPs[edit]

It seems the spammer finally decided to put all the steak on the flame. It's been a mad day, but its under control. They've been using about 50 different ips to spam all day. This is just a SMALL PORTION from the past hour: 

* 124.3.110.18 ch.wikipedia
* 124.3.110.18 fa.wikibooks
* 125.18.130.70 kw.wiktionary
* 125.19.185.212  ha.wiktionary
* 125.19.185.212 bm.wiktioanry
* 125.19.185.212 bug.wikipedia
* 125.19.185.212 dz.wiktionary
* 125.19.185.212 gd.wiktionary
* 125.19.185.212 ha.wiktionary
* 125.19.185.212 ik.wiktionary
* 125.19.185.212 kn.wikisource
* 125.19.185.212 zu.wikibooks
* 161.139.89.1 bug.wikipedia
* 165.228.128.11 cr.wiktionary
* 165.228.128.11 fy.wiktionary
* 165.228.128.11 kn.wikisource
* 165.228.128.11 nl.wikinews
* 165.228.128.11 os.wikipedia
* 165.228.130.12 bs.wiktionary
* 165.228.130.12 ca.wiktionary
* 165.228.130.12 gd.wikipedia
* 165.228.131.12 ks.wikibooks
* 190.67.19.198 de.wikiquote
* 192.100.124.220 ca.wiktionary
* 192.100.124.220 ch.wikibooks
* 195.229.242.57 bug.wikipedia
* 195.76.242.227  bn.wiktionary
* 195.76.242.227 gd.wikipedia
* 196.211.183.210 ch.wikipedia
* 200.160.75.59 za.wikibooks
* 200.203.216.18 chr.wiktionary
* 200.65.127.161 kn.wikisource
* 201.20.202.48 bxr.wikipedia
* 201.230.227.225 bxr.wikipedia
* 201.238.172.112 gd.wiktionary
* 202.83.125.130 ba.wiktionary
* 202.83.125.130 dz.wikipedia
* 202.83.125.130 za.wikiquote
* 210.0.216.227 da.wiktionary
* 210.212.35.2 fa.wikibooks
* 210.22.158.132 chr.wiktionary
* 211.40.28.66 bs.wiktionary
* 62.4.85.203 ha.wiktionary
* 62.4.85.203 ml.wikiquote
* 66.110.115.230 yo.wikipedia
* 81.169.128.183 kw.wiktionary
* 83.143.245.40 nl.wikinews
* 85.21.125.100 bo.wikibooks
* 85.21.125.100 dz.wiktionary

All of them have been blocked at server level.

Here are a few more residuals I've found today in the morning: 

125.60.243.104 tk.wikipedia
156.17.75.100 dv.wiktionary
200.226.134.53 species.wikimedia
200.129.43.168 my.wiktionary
200.174.88.130 pi.wiktionary
200.65.127.161 hy.wikibooks <-- blocked
201.65.114.2 zh.wiktionary
201.89.219.53 hy.wikibooks
202.29.33.126 dv.wiktionary
202.83.125.130 ia.wikibooks <-- blocked
202.83.125.130 sg.wiktionary <-- blocked
62.4.85.203 hy.wikibooks <-- blocked
62.4.85.203 lo.wiktionary <-- blocked
81.169.151.105 sg.wiktionary
82.140.73.56 pi.wiktionary
82.195.156.186 pi.wiktionary
85.18.242.26 lo.wiktionary

Inserte aquí texto sin formato

26 november 2007[edit]

165.228.128.11: Porn spam[edit]

Other ips with same pattern[edit]

These act the same inserting the random string or the .info porn spam:

25 november 2007[edit]

87.118.118.12 garbage vandalism[edit]

That IP has hit a tons of wikis today, and I haven't get the enough time to list it today, so I'll just keep on ckleaning it up and later block it. drini [es:] [commons:] 02:19, 26 November 2007 (UTC)

Open proxy by the look of it --Herby talk thyme 15:42, 26 November 2007 (UTC)

24 november 2007[edit]

Nuclear bombs crosswiki vandal[edit]

Starting yesterday, a crosswiki vandal has been trashing many wikis with "nuclear weapons" related vandalism. I didn't log it at first since I thought it was a one-time incidence, but today he trashed simple wiktionary:

Found 2 sockpuppets waiting to be activated:

  • Hum some Blob* accounts hit en wb a few hours back.... --Herby talk thyme 16:56, 24 November 2007 (UTC)

He's on 69.227.151.150 (pacbell.net) since yesterday luxo's tool shows

Edit conflict - I was about to post the same link! --Herby talk thyme 17:09, 24 November 2007 (UTC)

Yesterday I noticed:

More from today:

Found via checkuser:

23 november 2007[edit]

While I was away studying, Jorunn tracked more incidences of the proxies vandalizing many wikis with random strings like 3v3445vtt075nvn0g8d0nb

80.80.225.20 proxy spam[edit]

200.49.177.20[edit]

I deleted a dozen of garbage pages from this IP without realizing they were the same. However some info can be looked up with luxo's tool: [1]

22 november 2007[edit]

75.134.141.190: multiwiki vandalism[edit]

Open proxy vandalism[edit]

Today, a dozen of IPs (seemingly all open proxies) launched vandalism on dozen wikis (many targeting main page), the modus perandi is always to blank and replace by a random string like 90k9aN 3v3445vtt075nvn0g8d0nb

I'll list here a few, and below detail some particularly persistent ips:

Most of those IPs have a vandalism history going back several months.

195.175.37.71[edit]

The IP 195.175.37.71 has been blocked indefinitely on a dozen wikipedias, and has a vandalism history dating back to 2005.

222.231.8.174[edit]

200.94.111.209[edit]

I see an IP repeating, so I checked more deeply and the full list of today vandalism is:

    • This one is an open proxy, gone blocking --Herby talk thyme 09:19, 22 November 2007 (UTC)

201.230.227.125[edit]

This one is special in the sense that it's "clean" (first time used, no previous vandalism history) however modus operandi is still exactly the same: (see [2] )

  • Open proxy too (by the way I'm changing your blocks where I can Drini, keep up the good work :)) --Herby talk thyme 09:23, 22 November 2007 (UTC)


afternoon[edit]

I've been busy all day, so I stopped tracking the proxies (Jorunn has sent me a few by email). So here's briefly what's happened

  • 69.227.151.150 has vandalized several wikis (I found him on simple.wikibooks), and has already been blocked on half a dozen wikis today:

[3]

This IP is an open proxy as found by the cswikis (so this is just a continuation of the proxies attack).
Luxo tool [4] show this proxy has vandalized many many wikis in the past months, so I?m blocking it everywhere.

21 november 2007[edit]

85.140.220.171: Xrunner spam[edit]

Zeldaguidebook[edit]

I checked again the username mentioned on november 16, he did more vandalism:

20 november 2007[edit]

Well, I went away for a few days and the garbage piled up. First, I emptied about 20 pages listed at Multilingual speedy deletions, the interesting stuff from there:

That ip also spammed a dozen times enwiki past week

85.140.23.151:Xrunner spam[edit]

And now, the infamous Xrunner spam

208.27.234.156: vandalism[edit]

So I went and checked him and found:

if this continues... global blocking may be in order...

72.232.7.242 : spam[edit]

some spam about books online shopping:

Also, deleted:

16 november 2007[edit]

Thanks to Jorunn for the reports:

First, this is related to the mass blanker from 14th: [5] Now:

Xrunner spam: 85.140.23.55[edit]

I knew it, this IP started yesterday, I didn't block it so it continued today

  • [6] on zu.wiktionary: Talk:Ikhasi Elikhulu/
  • [7] on dv.wiktionary: w/w/w/w/w/index.php
  • [8] on st.wiktionary: w/w/w/w/w/index.php
  • [9] on beta.wikiversity: Project:Review_board/w/w/w/index.php

87.118.118.252[edit]

80.253.30.4[edit]

"hello! I've just registered at..." spammer.

Zeldaguidebook[edit]

He's been vandalized a dozen pages on rw.wikipedia a few days ago, but the account was never blocked:

checking the logs, he's also done

So that needs to be watched out, and if continues, blocked. drini [es:] [commons:] 13:51, 16 November 2007 (UTC)


15 november 2007[edit]

Xrunner spam: 85.140.23.55[edit]

Xrunner spammer on wikt:jbo:Talk:w/w/w/w/w/w/index.php

I'm not blocking for now (I'll be traveling weekend anyway so I won't be able to cope with the complaints) drini [es:] [commons:] 23:53, 15 November 2007 (UTC)

81.213.203.14[edit]

Minor spam from 81.213.203.14 , creating pages named "Abdallah and zhang wisdom end"

84.250.25.157[edit]


207.101.97.123[edit]

New decission[edit]

I'll quit the break earlier. It hurts me to see so much gargabe piling on, and spammers are leaving out their caves again. drini [es:] [commons:] 18:59, 14 November 2007 (UTC)

14 november 2007[edit]

Xrunner spam: 85.140.223.246[edit]

By the way Xrunner spammer still around

Crosswiki vandal: 195.5.116.246[edit]

This started yesterday:

I hope someone put a stop on him. drini [es:] [commons:] 03:48, 14 November 2007 (UTC)

Well, I see he's still active. All the following could have been avoided if people would think of sysop as a service position.

Again, people attack me for preventing this. They say you blocked without emergency!. They don't see the emergency because I block to prevent this from happening. What ever happened to "use common sense" and "assume good faith"? Have they become "blindly following rules" and "if you help me it's an insult?" drini [es:] [commons:] 14:32, 14 November 2007 (UTC)

P.S. The IP has been reverted only in a dozen cases, and it's been blocked in about five only.

Retrieved from "https://meta.wikimedia.org/w/index.php?title=User:Magister_Mathematicae/daylog/0711-2&oldid=2089970"