Vandalism reports

From Meta, a Wikimedia project coordination wiki
Jump to: navigation, search
Vandalism reports
Before reporting, please take note of the following premises:
Most Wikimedia wikis are able to deal with vandalism on their own. This page is intended only for certain reports
Reporting requirements
  • The username(s) or IP address(es) of the offenders.
  • A description of their vandalism (spamming, adding junk, removing legitimate text, etc), preferably with diffs to examples.
  • The Wikimedia wikis affected.
  • Suggestions for monitoring strategies, blocks etc.

When reporting please use informative headings like:

=== username(s), IP address ===
*{{luxotool|IP address}} <!-- for IP addresses -->
*{{sultool|Username}} <!-- for usernames -->
Description, evidence, diffs, etc. --~~~~
Note on spam
  • If the spamming is cross-wiki, malware sites, repeated or severe, please report it to the spam blacklist.
Related pages
If the username is clearly offensive, libellous or contains private information do NOT post it here. Email the private OTRS queue for stewards: - Thank you.
Archives & subpages
Vandalism reports Vandalism reports/Archive 1 Vandalism reports/Archive 2
Vandalism reports/Archive 3 Vandalism reports/Archive 4 Vandalism reports/Archive 5
Vandalism reports/Archive 6 Vandalism reports/Archive 7 Vandalism reports/BogaertB
Vandalism reports/Unknown
Crosswiki requests
MetaWiki requests

Current cross-wiki vandalism[edit]

Please place new reports at the top of this section. Thank you.

Massive vandalism by IP addresses in zh-yue Wikipedia[edit]

There has been massive vandalism by IP addresses in zh-yue Wikipedia since yesterday. Now an IP address is blanking many normal articles and replacing the content with "{{delete|vandalism}}". As the administrators are not so active there, please find someone to stop it as soon as possible. Thanks. -- 01:40, 18 July 2014 (UTC)

Local admin handled this just after you posted. --Rschen7754 01:42, 18 July 2014 (UTC)

Long term vandalism of Citadme[edit]

There is an user that has been vandalizing the Spanish wikiquote for years. He has been repeteadly banned but he always comes back with a new account. He is now using the username New Wineskins. Currently there are no active administrators, so the only thing I can do is reverting his editions. [1]. --Fjsalguero (talk) 16:11, 15 July 2014 (UTC)


  1. Faking exif-data to promote his political views DR on Commons and (Commons AN/U section second opinion for deletion review)
  2. Providing false information to OTRS
  3. Already blocked on Commons, enwiki, cswiki, and eowiki for vandalism and as puppetmaster

People like that shouldn't be allowed on any of our projects. We have to keep our NPOV true, otherwise we all can volunteer on Facebook. --Hedwig in Washington (talk) 04:10, 24 June 2014 (UTC)

  • I recommend Hedwig read Global ban, because that is what he is asking for. The user is currently indef blocked on three wikis; however, mere indef block is not adequate to meet the standards for a global ban.
  • On Commons, the user went immediately from a one-day block to indef. Hedwig is correct, there was an apparent false statement submitted with an upload, "own work." Most likely, the user has strong political attachments, and all this is a matter of personal and collective survival. Revert warring over a deletion template is a clear sign of a clueless user, and the user, indeed, only had a handful of contributions to Commons, two files standing, and no prior disruption (though, what is common for naive contributors, some of his files were deleted for missing permission information.) Contrary to what was implied, the photo was not "fake," it was simply modified from the real photo, there was no "image fraud" in that sense, only misleading or deceptive source information.
  • "On a political mission" is not grounds for a block on Commons, in spite of the block reason for this user there, see commons:Blocking policy#Use. The appropriate reason is called "Vandalism," but more normal language would be "insertion of deliberately false information." I see no notification of the user of the Commons:AN/U discussion. There was simply a request and a granted indef, and no other comment. This is not a community ban as contemplated in the Ban policy. The actual offense was serious (I'm assuming an actual lie about "own work," rather than some more complicated situation). However, the indef blocking admin reveals a judgmental political opinion, complicating all this.
  • This user (CentralAuth) is most active, by far, on uk.wikipedia. The user was blocked there twice, one day each, by the same administrator, 9 November 2013, for personal attack, insults, or threats, and on 15 June 2014, for revert warring. The block was upped to block user talk editing but not extended in length. The user argued with and attacked the blocking admin, common with very hot political issues. Those of us who live in more politically settled areas, much safer, may have difficulty understanding all this. However, the talk page block was to be expected. User is in good standing there, with editor and rollbacker privileges. (User is also an "uploader" on ruwiki, but not high contributions.)
  • There is, so far, no sign of continued disruptive editing on ukwiki. The user was questioned about sock puppetry on other wikis, and he claimed it was a necessity, but that he wasn't doing anything like that on So that leaves:
  • enwiki. See the discussion at [2]. The user acknowledges sock puppetry, with User:Керди, readily, was blocked for it, and is off block. The user is civil with Ymblanter, the user who first blocked him on Commons (see also his comment on that user's talk page). The page he created is under AfD, and is trending Keep.
  • cswiki. indef blocked, no contributions showing. I speculate that he created the same page he created on enwiki. On some wikis, simply creating that page would be considered an offense.
  • bewiki. Account Керди is blocked. I haven't researched it, but this was very likely for socking, because the same article was involved, created there by Jeromjerom, who is not blocked, but was warned for socking.[3]
  • bgwiki. (not blocked) Account Керди was active. Same article. So is Jeromjerom, who was blocked for 3RR violation there. I don't see true socking. The article was created by Керди, but the revert warring was all by Jeromjerom. It was all silly (though, I'm sure, important to Jeromjerom), revert warring over a deletion template is the mark of a clueless editor (on both sides, by the way.) He should disclose that sock.
  • eowiki. (indef blocked.) Block reason (partial translation): (Entrudas links to external sites, blocked in enwiki , cswiki and Commons for copyright problems and sock puppets). There is only a single edit showing eowiki, [4],to an article for creation page, requesting creation of the same article as he actually created on other pages wikis.
  • User has also created the same page on a few other wikis.
  • This is cross-wiki single-purpose editing. It is not contrary to policy. However, if it causes local disruption, persisting, on enough wikis that he's independently banned (not merely blocked), this is grounds for ad hoc action by a steward (which will normally be refused if the editor has positive contributions on any of the wikis, such as ukwiki here), or a global ban discussion, but only after the preconditions are satisfied.
  • I had thought of suggesting that Hedwig to to SRG, which is where a lock request would go, but am not. Properly, this should go nowhere, as yet, beyond warning the user. I will warn and attempt to guide Jeromjerom in some location and by email, particularly about that sock on bgwiki, and, as well, on his unnecessary disruptive editing, and caution him, also, on cross-wiki page creation, he's doing it way too quickly. He's harming his cause.
  • My own political position, I'll disclose: I stand for opposing parties learning to collaborate and cooperate, and it could start here. But if people are banned for having strong political positions, that can't happen. We can seek neutrality, and from there, begin to explore cooperation. It doesn't happen instantly, but it's possible. That is, I have a long-term agenda, myself, but it requires that we stand for neutrality policy. Even where I disagree with the views of others. --Abd (talk) 20:10, 24 June 2014 (UTC)
  • If Керди, Хьюго and Рома are sockpuppets of Jeromjerom, then there were also abuses in ukwiki (as users have SUL): block evasion by Керди[5] when Jeromjerom was blocked; voting by two accounts in desysop nomination (Jeromjerom and Хьюго).--Anatoliy (talk) 22:09, 24 June 2014 (UTC)
  • Block evasion by Керди, as a sock, was admitted and documented already. I have seen no evidence linking Хьюго with Jeromjerom; both accounts are unblocked, it's unlikely. Рома was not a sock, but an earlier account name, as Jeromjerom points out below. So all that amounts to one substantial claim, already acknowledged on ukwiki, block evasion through w:uk:User:Керди -- acknowledged as Jeromjerom 20 June 2014 --, and that is over and done with.--Abd (talk) 01:28, 25 June 2014 (UTC)
  • Керди - yes, this is my "puppet"[6]. I found it! Рома - that's me! At first I was Jeromjerom, then changed its name to Рома, then again in Jeromjerom [7]. Who is Хьюго I have no idea!. --Jeromjerom (talk) 22:35, 24 June 2014 (UTC)

With regard to cross-wiki spam .... Articles I created several other projects is not cross-wiki spam! Some people thought the Russian Wikipedia article about Putin incorrect and tried under false pretenses to remove it. They began to accuse me of spam, but it's not spam! Look at other wikis I did not create the article: in Vietnamese, Romanian, Malaysian, Lithuanian, Georgian and so on ... - it's other people. But even being accused of spam. Today, the English Wikipedia article left, finds her significant. I was blocked on Wikipedia for one week. Now I can edit it. In the Czech Wikipedia is blocked for that twice tried to create an article that was removed twice. In Durga wiki I'm active and did not do bad. As for photos ... it was not "fake," it was simply modified from the real photo, there was no "image fraud"!!!! --Jeromjerom (talk) 22:39, 24 June 2014 (UTC)

Your contributions may be good, but your methods are bad.--Anatoliy (talk) 23:32, 24 June 2014 (UTC)
@Abd: First I'd like to say thank you. Your research is thorough and I really admire your goal of having communication before blocking. It can lead a vandal/bad user to be a good and trusted user. Further: disclosing the ban on enwiki here is a good thing as well, thanks for that as well.
Back to the case. I did read global ban and I believe this request is fully within scope. Global ban is to be used in order to protect our projects. Let me reply to your comments one by one:
  1. Revert warring over a deletion template is a clear sign of a clueless user SUL tells me that this user has a total of 8,031 edits as of 6/24/2014, not counting his sockpuppets. He's surely not a clueless user.
  2. No image fraud Faking meta data is fraud. Period. If we can't rely on meta data, we are in big trouble and violation needs to be punished accordingly.
  3. Political mission is no reason for a block Very true and it has to stay that way. Otherwise Wikipedia/Commons can't be trusted and are useless. See my point above as well. His approach is different: He's trying to push an agenda by using sockpuppets, intimidation, and fraud. This is not a neutral point of view. It is not always possible to be 100% neutral, granted.
  4. Insertion of deliberately false information. That's my point. We don't need more false information, we need more reliable, true information. There is no place in our projects for people trying to pull us into a political conflict and making Wikipedia useless for reporting on such events. Our readers have to come first and they deserve a Wikipedia that is as correct, true, and neutral as humanly possible.
  5. I see no notification of the user of the Commons:AN/U discussion The user got informed about the block by the blocking admin A.Savin, that is sufficient for obvious vandalism.
  6. However, the indef blocking admin reveals a judgmental political opinion, complicating all this. Log entry: (Vandalism: fake image uploader, on political mission) It can be argued if the political mission remark should have been placed. IMHO it helps later on to identify what was going on. The block reason was fake image uploader and therefor perfectly ok.
  7. ukwikipedia: User is in good standing there, with editor and rollbacker privileges. This user can't be considered in good standing with two recent blocks for edit warring and personal attacks.
  8. The user argued with and attacked the blocking admin, common with very hot political issues Hot political issues don't give users a free pass to violate policy and commit vandalism.
  9. There is, so far, no sign of continued disruptive editing on ukwiki. Seems like it, but that doesn't give this user a white vest.
  10. The user acknowledges sock puppetry That is great, saves some time. Doesn't wash him clean either.
  11. enwikipedia:The page he created is under AfD, and is trending Keep. The page he created has never been discussed or scrutinized by me. As far as I can tell the topic itself is way in scope. The topic is not the problem, the user is.
  12. cswikipedia:On some wikis, simply creating that page would be considered an offense. Log entry: (Jednorázový provokační účet) roughly meaning provoking account only.
  13. bewikipedia: Sockpuppet Керди blocked. Log entry: (Забаронена выкарыстоўваць віртаў для галасавання) My Belarus is lousy and so is google translator. As far as I could see, it's a reentry of the faked image.
  14. bgwikipedia:clueless user He's far from clueless given the fact of +8k edits and being a sockmaster.
  15. eowikipedia: preventive blocking?
  16. User has also created the same page on a few other wikis. Nothing wrong with that in general. As I said, the topic is fine (IMHO)
  17. However, if it causes local disruption See all the warnings on many projects, just again on enwiki he's complaining about removal of his double votes. Comment in log: rv, you disrupted this AfD enough with your socks, now keep away from it. That has to stop. In my simple mind, the user knows what he's doing, so there needs to be a global block and that is that. If the community decides that an +8k user still doesn't know the ropes, fine. In that case I am willing to work with Abd to resolve this issue for good. If Abd want's me to work with him that is and Jeromjerom agrees as well. Nevertheless, I think enuf said/written here.

Question Question: Shall I transfer this discussion to m:SRG? --Hedwig in Washington (talk) 07:21, 25 June 2014 (UTC)

  • Thanks, Hedwig.
  • Clueless. Yes, that number of edits would ordinarily indicate an experienced user. However, his behavior was clearly clueless. He gained no advantage by revert warring over a speedy deletion template. He gained no advantage by blatant, obvious, red-flag-block-me socking. Sure, he might be knowledgeable and experienced but temporarily deranged. It happens. What I'm seeing, now, is a user who admits he made mistakes. That's a great step, seriously problematic users don't do that.
  • Image fraud. Small point: "image fraud" would mean a fake image, i.e, a constructed image that makes something appear to have happened that did not happen. What he is alleged to have done is "copyright fraud," i.e, claiming "own work" if it wasn't. I have asked the user about this, and, so far, he has not responded. He might be embarrassed, or he might not yet understand the importance of this. This is a very serious charge. Grounds for a global lock, I don't think so, but grounds for a ban from Commons, quite possibly. It was the real basis for the block on Commons, not political mission.
  • No notification. That means no notification that a block/ban was being considered. This does not mean that the block was wrong. The user's talk page access was not shut down, so he was not banned, but only blocked. He could appeal it. He has not. (And I would not advise him to appeal just yet.)
  • Opinion of blocking admin. The opinion was not about Jeromjerom, but about the event shown in the deleted photo, it was a judgment A.Savin made about the Ukrainian political body shown in the photo, that's all. It's not related to the situation of Jeromjerom himself, only to the history of the block. Because the admin claimed "political mission," his own possible political view takes on some small relevance. But the issue for global bans would be local bans (a bare minimum of two) as a basis, and the user is not banned anywhere yet, as "ban" is defined in global ban policy.
  • Deliberately false information. Again, the charge of weight. However, the evidence has been deleted. so what we can discuss is hearsay, from the Commons deletion request. I have been advising the user to simply tell the truth about that image, i.e., what he knows. If he lied, say so. But sometimes things happen that we don't understand. I don't know as a proven fact that he lied. There is no pattern of false report, so far.
  • global disruption. Yes, there was global disruption. Take a clueless user (clueless about deletion policy) and let him go cross-wiki and create a highly controversial article -- even though found to be a notable topic, eventually, on enwiki --, and it's Very Important to him, mix and stir, and watch disruption bubble up. Global disruption has stopped, with, AFAIK, one small exception, on enwiki (where he made an allowed request).
  • removal of double votes. No, that was not what he complained about. The user believed that he had been told he could now, off block, participate in the AfD. He then made a comment which was deleted, by another administrator. He complained about that, to the admin. I personally think the deletion of comments was unnecessary, but this user needs to understand how communities make decisions, and to not take everything so personally. What he had added would have created some push toward deletion, actually, because the argument was irrelevant, and he didn't understand that. (Supposedly that shouldn't matter, but editors are human and irritated by socking and by irrelevant arguments.) He still thinks inclusion/exclusion -- or content -- are about "truth," a classic newbie error. He reported facts that, if found in reliable source, would be a basis for inclusion, but he didn't give reliable source. Classic Argument Not To Make in a Deletion Discussion. Had the discussion closed with Delete, he may not know, I suspect, what he could do. He'd need advice and help, probably, with a Deletion Review. However, it didn't go that way.
  • Working with him. Thanks, Hedwig. That could be valuable.
  • Vandalism. Commons policy about blocking includes as a reason "vandalism," and includes the "insertion of false information" as an example. Cross-wiki, however, removing a speedy deletion tag or recreating a deleted article, where the article is possibly notable isn't called "vandalism." In this context, "vandalism" is an inflammatory charge, because vandals destroy or deface things. Including false information happens all the time, because people misinterpret sources or hold opinions and interpret fact according to their opinion, and can err. Most people would not call a false claim of ownership of an image "vandalism," though. They would call it "false claim." And presumably the person knows whether they took the photo or not! So what we really have here is a single incident, that is being presented as if it were a pattern.
  • Political mission. This is real. This can be a basis for a ban on a wiki, when that mission manifests as a pattern of disruptive behavior. However, this is not a global ban reason. A continued pattern of disruptive behavior can be.
  • Steward requests/Global. I recommend not, though it is your right to do so. Without a global ban, per policy, locking a user with his history could be disruptive. Likely: a ukwiki sysop or respected user requests unlock and, this being effectively a global ban, of a user with contributions of weight, without a global ban RfC, it's granted, so we are back to square one.
  • Global ban process. Hedwig, you have given arguments, some of them possibly relevant to a global ban. But a global ban RfC, per policy, requires precedent specific conditions which do not exist. He is not "banned" on any wiki, as defined in the policy. Premature global ban RfCs waste a lot of time. Please don't go there. This problem can be addressed much more simply. If problems continue, there are remedies available short of an RfC that might avoid it.
  • The way forward. Hedwig, you have already agreed to it. Let's support this user, guiding him toward constructive engagement. Let's assure him that he can continue to make constructive contributions, and warn him if he strays from that, with warnings that are not hostile, but supportive. I have his user talk page watchlisted, I get email notifications of changes there. So far, I see him responding positively (by comparison). Let's encourage that.
  • And thanks, again. --Abd (talk) 13:53, 25 June 2014 (UTC)
  • Sorry for the fact that broke the rules. In the Ukrainian Wikipedia I created 511 articles. 2 articles are considered Good articles. Contribution to home Wikipedia is great. If you want to block me currently, - then block!..... but, please, not in the Ukrainian Wikipedia... I have nothing more to say. --Jeromjerom (talk) 08:07, 25 June 2014 (UTC)
Public advice: send me an email through the wiki system. I will respond and you will then have my personal email address. Do this with several users you trust. Do it with anyone who consents to email from you, on-wiki, and preferably do it with a ukwiki sysop. If you are globally locked, you will be unable to log into your account, anywhere. But you will, if you have done this, still be able to communicate with users by email, outside the wiki system, and they may be able to assist. I, for one, would advise you by email. I would not appeal on-wiki unless I saw a strong and clear basis. Right now, if you were locked, I'd consider appeal, but it would be much better if it were someone else to start.
Let's hope this is just a precaution, it won't be needed. I don't think you will be locked, or that there will be further problems, so no more blocks, either. Keep it that way! --Abd (talk) 13:53, 25 June 2014 (UTC)
  • Jeromjerom will not be locked. There is nothing within the policy on global locking that would justify such an action, as the user is in good standing on multiple projects that they contribute to. As for a global ban, this is the wrong venue to request it, though I don't see that any request to ban would be valid under policy either. Thanks, Ajraddatz (talk) 18:00, 25 June 2014 (UTC)
  • Thanks, Ajraddatz. I completely agree. However, there were some real grounds for concern in the report. I have addressed them, here and on the user's ukwiki talk page. He has acknowledged now, everything he did: he lied in the Commons discussion about having taken the photo himself,[8] he revert warred and socked (with one sock that I know of), feeling harassed over an ethnic/political conflict, and he is unlikely to do these things again, but he is now visible and will be quickly seen if something else comes up. The matter of image metadata may remain a mystery, but once we know that it wasn't his image, he got it from somewhere, that's not important. Thanks to everyone who participated here. --Abd (talk) 21:12, 25 June 2014 (UTC)


For the past few years a user has been using multiple accounts to add promotional language and copyright-violating images to Wikipedia articles on Romanian celebrities. He is active on a large number of Wikimedia projects: most prominently on English Wikipedia, Romanian Wikipedia, and Wikimedia Commons, but also on several other Wikipedias (German, French, Spanish, etc.). He has become particularly persistent over the past six months. Cross-wiki coordination of efforts to curb the disturbance would be useful.

The oldest account we're aware of is en:User:Beleiutz. On the English and Romanian Wikipedias he has repeatedly stated that his name is Vlad Mateescu and that he represents the Walt Disney company, Pinewood Shepperton, the Romanian Copyright Office, and other private and public organizations [9] [10] [11] [12] [13] [14]. Despite this he has refused to provide any evidence that he holds the copyright to the images he uploads (many of which appear to be found on the web or are television stills which Disney or Pinewood Shepperton wouldn't own the rights to anyway). Web searches for this name turn up profiles, interviews, and blog posts where he claims to be a company director, supervisor, or other official representative of many other organizations, including Warner Bros., Pixar, Paramount Pictures, Universal Studios, and even the Wikimedia Foundation! The attempts to impersonate WMF officials offsite were reported to the WMF, and it looks like the sites have now been taken down, though I wouldn't be surprised if they reappear in the future.

Here's a listing of the known accounts:

He also edits from a wide range of IPv4 and IPv6 addresses, though lately it's usually been IPv6.

A possibly incomplete list of past noticeboard reports and administrators'/bureaucrats' discussions:

The following characteristics can be used to spot the sockpuppets:

  • They are concerned exclusively with articles on Romanian celebrities and the films and TV shows the appear in.
  • New articles, and textual additions to existing articles, tend to be strongly promotional in tone.
  • They make repeated attempts to upload and link copyright-infringing images, often giving falsified source and licensing information. Sometimes they create Flickr-washing accounts to evade detection of the copyright infrinement.
  • Their edit summaries are usually strings of nonsense characters, or (if in English) brief, vague, and grammatically incorrect (e.g., "improve Delia article").
  • They make extensive use of RefLinks, particularly with the IPv6 accounts.
  • They have the annoying habit of wikilinking common words which shouldn't be wikilinked.
  • Lately the accounts do not communicate. As soon as one sock is discovered, it is abandoned and a new one is created.

A few months ago the possibility of an IPv6 rangeblock was discussed but was found not to be feasible. In light of the scale of the disruption, perhaps this matter could be revisited here. —Psychonaut (talk) 15:49, 31 January 2014 (UTC)


Global linkspamming; non-malware, just advertising. |FDMS (WP: en, de) 23:08, 14 January 2014 (UTC)

It seems mainly replacing links to a paper with links to the same paper from a different website, could be a well intentioned user, suggest that if behavior persist the user be contacted. Snowolf How can I help? 06:24, 2 June 2014 (UTC)


Mainly advertising/spamming only account, will continue to monitor. Warnings on enwiki, latest incidents. TeleComNasSprVen (talk) 16:36, 10 January 2014 (UTC)

Locked Locked, obvious spambot, in future defer to SRG for faster response times, as this page is seldom monitored sadly. Snowolf How can I help? 06:21, 2 June 2014 (UTC)

Massive addition of pages[edit]

During the last 2,5 years five accounts (single-purpose accounts) have:

  • uploaded lots of photos from Flickr to Commons from an Italian photographer;
  • before that those photos have been added to many wikipages (many depict with clearly-notable people), any related thumb included a redlink to [[Augusto De Luca]];
  • then hundreds of pages have been massively created on hundreds of wikis, most of by automatic translators;
  • those creations had also involved wikiquote;
  • some days ago an account "Augusto De Luca" has been created;
  • within two days (at a very high rate then) an overall of 557 userpages has been created for that user
  • similar attempts had been done on other non-WMF wikis which are not used as references on WMF wikis (please check your wikis because those are user-generated contents)
That's the hughest case of SEO-like onwiki promotion I've ever seen.
Please keep in mind SEOers tend to emphasize the importance of their customers, your evaluation of contents should then be quite stricter.
--Vituzzu (talk) 21:30, 30 March 2014 (UTC)
Comments Talk:Vandalism reports#Massive addition_of pages
If it is of interest to the global community, Abd has started a crosswiki campaign to remove the speedy deletion tags from the userpages. TeleComNasSprVen (talk) 20:43, 24 April 2014 (UTC)
See Talk. And what does this have to do with vandalism? --Abd (talk) 03:51, 25 April 2014 (UTC)

Long-term, recurrent vandalism[edit]

None currently listed; See the archives