Vandalism reports

From Meta

Jump to: navigation, search
Translate this page!

de: Vandalensperrung

en: Vandalism reports

es: Vandalismo en curso

fa: گزارشات خرابکاری

fr: Vandalisme en cours

ja: 進行中の荒らし行為

sv: Sabotage

zh: 当前的破坏者
Archives
1
See also Sub-pages

Most Wikimedia wikis are able to deal with vandalism on their own. This page is intended for certain reports:

  • Repeated noteworthy vandalism on a wiki that has no administrators (One time vandalisms can be reported to a steward on this page)
  • Cross server vandalism (i.e. a vandal attacking many different Wikimedia wikis) where coordination is helpful.

For pages that need to be deleted, see multilingual speedy deletions.

Reporting requirements:

  • The name(s) or IP address(es) of the offenders.
  • A description of their vandalism (spamming, adding junk, removing legitimate text, etc), preferably with links to examples.
  • The Wikimedia wikis affected.

Note on Wiki Spam: If the spamming is repeated and for a single site or sites, report it to the spam blacklist.

Contents

[edit] Current cross wiki vandalism

Please note the IPs quoted refer to current cross wiki vandalism. This is intended for colating information about cross wiki vandalism and advising of possible IP blocks that may prevent this on your wiki. Please join #wikimedia-admin for cross wiki issues (any sysop from any project can join more info).

New reports should be placed at the top. For long term vandalism reports see lower down the page

[edit] Multi-IP vandal on several projects

Last days an user (or his bot) is modifying pages with erroneous code, and not good faith/purpose.

You'll can observe that on Global user contributions for 209.62.94.50.

He has used other IPs (Proxies?):

  1. 200.194.102.114 [cross-wiki-contribs]
  2. 203.144.160.249 [cross-wiki-contribs]
  3. 201.234.80.3 [cross-wiki-contribs]

He doesn't include spam links but only things like <a href=.*> </a>. I have included that on ca:MediaWiki:Spam-blacklist (where, obviously I'm sysop).
Pasqual (ca) · CUT 08:46, 8 May 2008 (UTC)

Yes we know the XRumer bot attack is happening, and earlier in the morning a developer blocked a lot of those via the server , but they keep popping up, some of the stewards are working with the developers to counter this, please try to report know IP's doing this to here atleast, and we will try to get them blocked via server (temporarily atleast) though Global blocking implementation would have helped us a lot...--Cometstyles 08:54, 8 May 2008 (UTC)
Attacks are more frequent, and on cawiki, I think we can ignore them. If you can add temporally this expression (<a href=.*> </a>), ably we can block it. Otherwise "<a href= ..." is not allowed by MediaWiki, it never returns a link.
Pasqual (ca) · CUT 11:32, 8 May 2008 (UTC)
Since that is not a link, it cannot be blacklisted. The bots must be blocked. – Mike.lifeguard | @en.wb 12:10, 8 May 2008 (UTC)

For info - Commons & en wp earlier too. Blocked by me here & on Commons & reported to Birdy & Drini via mail at the time. They were not coming up as Open Proxies but I think they probably are & Xrumer was my though too. Thanks --Herby talk thyme 12:53, 8 May 2008 (UTC)

[edit] Virgin Media IP vandals

  • 195.188.152.14 [cross-wiki-contribs] - IP of Willy on Wheels vandal
  • 195.188.152.16 [cross-wiki-contribs] - main IP of Willy vandal
  • 82.42.237.114 [cross-wiki-contribs] - suspected open proxy
  • 82.42.237.84 [cross-wiki-contribs] - has been used for vandalism. Recently blocked for 1 year on en.wikibooks, en.wikiquote, and until 3rd June 2008 11am on en.wikipedia. However, there is a user who makes good edits from it - albeit sporadically.

[edit] Cross-wiki vandalism from 63.224.144.226

User 63.224.144.226 [cross-wiki-contribs] made massive vandalism on tl.wikipedia replaceing pages... also on stq, kg, la, ... with luxotool also some old vandalism had been found and removed. Best regards, --birdy geimfyglið (:> )=| ∇ 10:50, 1 May 2008 (UTC)

[edit] Related cross wiki vandalism IPs

I think this may be bot related. Commons had some strange edits about a week ago. Each edit was from a different IP but they were similar. The same pages have been vandalised today & I see similar activity on en wp.

May be worth investigation/review - cheers --Herby talk thyme 12:03, 25 April 2008 (UTC)

Yes, these edits are made by spambots. I found similar ones from these IPs:
I haven't checked all their contributions yet. Korg 05:34, 5 May 2008 (UTC)
Well, this is a well-known spambot who's using open proxies. How can we help you? … I just could block them on those projects where I'm a sysop. Or Drini could be asked to do so. Regards, —DerHexer (Talk) 08:14, 5 May 2008 (UTC)
Just catching up but Commons & en wp affected as well as here. Global blocking needed! Cheers --Herby talk thyme 09:13, 5 May 2008 (UTC)
When I'm back from university I'll do the blocks. Regards, —DerHexer (Talk) 11:26, 5 May 2008 (UTC) P. S.: The next ones tomorrow.
Thanks for the blocks. Korg 15:08, 8 May 2008 (UTC)

[edit] cross-wiki vandalism from 202.170.84.2

202.170.84.2 [cross-wiki-contribs] sco, pih, zh, eo wiki were vandalized [1], [2],[3] (user already blocked on en.wiki for two weeks), also other projects as shown with luxotools (maybe it will show more in some days)
--birdy geimfyglið (:> )=| ∇ 14:29, 23 April 2008 (UTC)

[edit] Linux pages in English in non-English Wikipediae from 87.196.129.99

87.196.129.99 [cross-wiki-contribs] creates stubs about Linux cross-wiki in non-English environments. Link www.kernel.org has been added to spamblacklist temporary to stop the stub creations.

Best regards, --birdy geimfyglið (:> )=| ∇ 16:04, 21 April 2008 (UTC)

[edit] Personal attack

A vandal (i think a student) created user pages about an academic person. Theese pages hr nl ja zh pl be cs pt deinclude personal attacks and swearwords. Theese accounts should block and pages delete because of google search.--Mach 09:55, 18 April 2008 (UTC)

czech wiki - indef block and page deleted --Chmee2 12:37, 18 April 2008 (UTC)
done on croatian wiki (hr) --Dalibor Bosits 13:26, 18 April 2008 (UTC)
done (be) --MaximLitvin 16:05, 18 April 2008 (UTC)
done (nl) MoiraMoira 16:44, 18 April 2008 (UTC)
done (de) by de:User:Syrcro, --birdy geimfyglið (:> )=| ∇ 16:52, 18 April 2008 (UTC)
done (pl) (pt) by locals, --birdy geimfyglið (:> )=| ∇ 09:24, 19 April 2008 (UTC)
done (ja) --Kanjy 09:47, 19 April 2008 (UTC)
done (zh) by zh:User:Cloudcolors, --birdy geimfyglið (:> )=| ∇ 14:42, 19 April 2008 (UTC)

Thanks for helping.--Mach 14:02, 19 April 2008 (UTC)

[edit] massive vandalism from 66.41.109.159

Massive vandalism in jbo-wiki: User 66.41.109.159 [cross-wiki-contribs] jbo:Special:Contributions/66.41.109.159. Luxotool shows also vandalism in en.wiki. Other wikis yet not shown, there might be others, probably visible in some days.

Best regards, --birdy geimfyglið (:> )=| ∇ 01:59, 16 April 2008 (UTC)

[edit] dz.wikipedia vandal

User: Donuttowanoon [cross-wiki-contribs] Donuttowanoon2 [cross-wiki-contribs] and [4] creating pages in Dzongkha Wikipedia with Thai texts copied from Thai Wikipedia. He also blanked dz:Wikipedia:Autoconfirmed users. He claimed here that he is a 10 yrs old boy living in Thailand. According to his edit history in th:, this kid may vandal lo: and km: soon. Best regards, ---- 2T 07:46, 9 April 2008 (UTC)

Thanks for the report, he is now blocked on dz. Please keep us informed if You detect further problems. Many thanks, best regards, --birdy geimfyglið (:> )=| ∇ 12:06, 9 April 2008 (UTC)

[edit] Cross wiki spammer: in Islam-related articles

User/example diff: 77.31.112.228 [cross-wiki-contribs] difflink, adding spamlinks in the middle of the entry, sometimes even in the middle of existing links. He went through all articles "Islam" crosswiki it seems.

Best regards, --birdy geimfyglið (:> )=| ∇ 19:33, 1 April 2008 (UTC)

[edit] Cross wiki spammer: John titor

User: 83.190.116.58 [cross-wiki-contribs] creating empty pages with English links only, examples: az:John titor, vo:John titor, cy:John titor

Best regards, --birdy geimfyglið (:> )=| ∇ 13:49, 1 April 2008 (UTC)

[edit] Cross wiki vandal bots?

I'm going for the fact that we have some cross wiki vandal bot activity recently that seems to follow a pattern. I've currently spotted two IP involved 190.42.51.225 & 190.42.50.39. May be worth keeping an eye on - cheers --Herby talk thyme 14:43, 22 March 2008 (UTC)

[edit] Lisa Gerrard - vandal

User 71.192.59.22 [cross-wiki-contribs], Glitter1959 [cross-wiki-contribs] and Dancinfool610 [cross-wiki-contribs] are creating empty or English articles about Lisa Gerrard cross-wiki and uploading images of her locally with a link to a flickr-account, licencing under Cc-by-sa-2.0, while it seems obvious that these are not his. I tried to reach him several times like on vo, pih, ang. After the last he came to Meta, I explained to him again, to stop and he seemed to have read it because he answered but right after that he uploaded the image even here and then even continued on mediawiki-wiki.

I recommend to delete his images everywhere. Best regards, --birdy geimfyglið (:> )=| ∇ 15:01, 21 March 2008 (UTC)

I later learned he also edited on commons as ThePhantom28 [cross-wiki-contribs] [5], where he also uploaded a copyrighted image. Also he seems to have more than one flickr account, found so far: dancinfool610 and thephantom28, with overlapping images.
Best regards, --birdy geimfyglið (:> )=| ∇ 01:43, 22 March 2008 (UTC)
Just found another account from where he claims to hold the rights: Glitter1959. Images are overlapping with the other two.
Best regards, --birdy geimfyglið (:> )=| ∇ 12:23, 24 March 2008 (UTC)
Other suspected flickr account: Sonya_the_photograph er, --birdy geimfyglið (:> )=| ∇

New IP: 76.118.195.114 [cross-wiki-contribs], blocked from huwiki for violation of the previous block. Acts on enwiki, Commons and some other wikis with the same profile, from the same ISP. Bináris 06:57, 13 April 2008 (UTC)

[edit] Vandal from 71.107.136.165

Attacked af, as, en, ka, ku, lv, lb wikipedia so far, inserting nonsense in Europa or America articles.

Best regards, --birdy geimfyglið (:> )=| ∇ 18:32, 13 March 2008 (UTC)

[edit] Vandal from 208.27.234.156

Attacking wo, av, jbo, chr, dz, got.wikipedia, en.wikipedia, page blanking or inserting nonsense. 208.27.234.156 seems to be known for such in the past, please compare [6]

Best regards, --birdy geimfyglið (:> )=| ∇ 16:26, 21 February 2008 (UTC)

[edit] Vandal from 69.94.191.109

The vandal replaced the picture of Ronald Raegan with some cat in the EN, FR and BG Wikipedia (didn't search others). The IP address seems to be of some school in Texas. --Петър Петров 15:53, 31 January 2008 (UTC)

Same editor, same trick on gawiki[7] and on enwiki[8] - now blocked - Alison ❤ 19:23, 31 January 2008 (UTC)
As announced on #wikimedia-admin he ran through all or nearly all Ronald Reagan articles there are, best regards, --birdy geimfyglið (:> )=| ∇ 19:26, 31 January 2008 (UTC)
Do we know if there's any connection to the Rosa Parks vandalbot listed below? – Mike.lifeguard | @en.wb 21:26, 1 March 2008 (UTC)

[edit] Vandalbots on gdwikti

Just over the last few days. Constantly hitting the Talk:dame page. So far, all IPs have been open proxies. I portscanned them myself to verify:

  • 80.231.198.77 (no longer open)
  • 77.72.71.4
  • 63.238.76.250
  • 200.251.69.131

- I'm currently the only sysop on there - Alison ❤ 15:44, 29 January 2008 (UTC)

[edit] Rosa Parks vandalbot

Since yarrow is down, I can't link to luxo's, but 64.38.10.111 has been vandalizing across many wikipedias' Rosa Parks article. It is an open proxy.  – Mike.lifeguard | @en.wb 21:14, 27 January 2008 (UTC)

Vandalism is like [9].  – Mike.lifeguard | @en.wb 21:15, 27 January 2008 (UTC)

[edit] NO NOOKS vandal

Has used the following usernames for pagemove vandalism etc. on the no nooks theme (highly incomplete list, as these are only from 2 wikis): Blob12, Blob9, Blob10, Blobconk, Pluto 239, Rushlimbaugh.

The underlying IP 69.227.151.150 has hit:

  • commons (blocked)
  • en.wikibooks (blocked)
  • en.wikinews (blocked)
  • en.wikiquote (blocked)
  • en.wikisource
  • en.wikiversity (blocked)
  • en.wikipedia (blocked)
  • en.wiktionary (blocked)
  • fr.wikipedia
  • it.wikipedia
  • mediawiki
  • meta (blocked)
  • pl.wikipedia
  • pt.wikipedia
  • simple.wikibooks (blocked)
  • simple.wikiquote (blocked)
  • simple.wikipedia (blocked)
  • species
  • sv.wikipedia

– Mike.lifeguard | @en.wb 18:58, 8 December 2007 (UTC)

This is not an OP (so far as I can determine). – Mike.lifeguard | @en.wb 18:59, 8 December 2007 (UTC)

[edit] Long term vandals

[edit] BogaertB

BogbaertB is a cross wiki vandal, mainly on fr. and nl. (aka Mario Scolas on french Wikipedia)

[edit] "Unknown" vandal

[edit] International wiki-vandal, blocked indefinitely on several wiki's

Hi! I'm a moderator on the Dutch Wikipedia and I wanted to draw your attention to this user. Please have a look and act as you see fit. We blocked him/her indefinitely... Greetings, MigGroningen 18:24, 30 October 2006 (UTC)


[edit] Primetime

Primetime is an extremely misguided user who seems to think it's in Wikimedia's best interest to have him dump articles and images from current editions of the EB, OED, Merriam-Webster, etc and claim that he wrote them (plagiarism). When people see through his dissimulation, he will attempt to justify his blatant copyright flouting by claiming he's "Robin Hood". Once his main account is blocked he'll make a zillion sockpuppets to try and defend his "reputation" by making personal attacks, removing sockpuppet and block notices from his userpage, whining and trying to gain favor of uninvolved users, making legal threats and/or uploading more violations. Block any incarnation on sight and indefinitely; he has already been banned on English Wikipedia by Jimbo Wales himself. If your wiki has CheckUsers, have one of them find out the IPs he's been using; they're almost always open proxies and should be banned indefinately. See w:Wikipedia:Long term abuse/Primetime for more info and the masterlist of his sockpuppets on all wikis.


[edit] Vandal and username thief "Linuxbeak"

There is a widespread impersonator and vandal at work on Wikimedia and other wikis who creats accounts impersonating English Wikipedia user "en:User:Linuxbeak". He is been on en:Memory Alpha (Evidence), Abkhaz wp (ab:User:Linuxbeak), Afrikaans wp (af:Gebruikerbespreking:Linuxbeak), and has been reported at sr: and cs: (en:User:Linuxbeak#Someone took your username on sr:). The ab: account has yet to be blocked. According to the user being impersonated, this is the long-term vandal en:User:JarlaxleArtemis (en:Wikipedia:Long term abuse/JarlaxleArtemis), (Evidence).


[edit] 影武者 (Kagemusha etc)

Popular vandal on East Asian language projects, including Chinese, Japanese, Korean, and Vietnamese, using mainly hinet.net, Taiwan based ISP. He was active on the project listed on the above, but found on other projects, including English Wikipedia and Commons.

His last known vandalism happened in July 2007.

Remarkable points:

  • Impersonification of admins of those wikis, jawiki and zhwiki in particular, both in their usernames and in their real names (if known).
  • Offensive usernames including other names, eitherh in usernames or real names.
    • In both cases on the above, userpages tend to contain offensive content.
    • In both cases, the accounts may contain non latin characters.
  • Offensive usernames including the Japanese monarchs or historical figures.

There are some useful pages about him including:


[edit] Recurrent vandalism

[edit] Multi-user, multi-pattern, cross-project vandal "tester"

en:Wikiquote has been experiencing concerted, rapid-fire, multiple-user attacks for two consecutive days, follwing a pattern that has happened at least twice before in the past few months. The most recent one also included a simultaneous attack on en:Wikinews. The person or people behind this create a bunch of usernames in rapid succession, frequently but not always following several patterns, including *ook, animals, "new user" words, cross-project sysop impersonation, offensive names, and others. Some of these names are leftover from earlier attacks — usernames that made no edits during the previous attack, but are "activated" for the new one. The attack begins with either unassuming usernames starting an innocuous trolling of joke posts to user talk pages or with the scatalogical usernames plastering insults and offensive terms over articles, user, pages, and talk pages (especially from Recent Changes and targeting anti-vandal sysops). Then another set of usernames starts posting local or cross-project vandalism warnings to the sysops, possibly impersonating a sysop from another project (not immediately distinguishable from an actual sysop belatedly registering a username to help in cross-project vandalism fighting). When the real sysops start blocking accounts and/or refusing to take the joke-posting bait, yet another set of usernames or IP addresses post complaints to sysop talk pages and Administrators' Noticeboard. Eventually these are all tied together by a careful consideration of timing, writing style, knowledge demonstrated by multiple users, and, most compelling, outright statement by the multiple users that they are the same person.

Supposedly these complex attacks are a product of someone testing anti-vandalism reactions (see q:Wikiquote:Administrators' noticeboard#Coming Clean and the surrounding topics for Wikiquote's recent problem), but this has happened before to Wikipedia (see w:User talk:216.164.203.90#Coming Clean), suggesting the true goal is the vandalism and the confusion it creates. One pernicious aspect of this attack is that the user participates in arguments between sysops of different projects after they've gotten annoyed with each other for blocking impersonators. (Or it may just be that the angry folks are all the impersonating user. It's hard to take time to consider the possibilities when you are manually fighting changes driven by an automated system, apparently leaving the vandal time to have fun pissing off the sysops with complaints against each other. See n:User talk:Jeffq and n:User talk:DragonFire1024#You got one too. (and subsequent topics) for an example.)

This is only a partial list of vandals and their sockpuppets (just on Wikiquote) involved in the past two days's attacks:

Some of these names (or variations) are also new users on Wikinews. Some vandalize on one project but not the other. Even though the contemporaneous creations during this rapid-fire, multi-user vandal attack should implicate one username if the other is used to vandalize another project, sysops are reluctant to block the account on the project where it isn't vandalizing. This leaves the untainted account available for future vandalism — see q:User:Mi nombre es Heraldo and its mention in q:WQ:AN for a concrete example.

The resulting confusion while trying to discuss so many new users doing so many different things across multiple projects in a short time makes it virtually impossible for small-project sysops to coordinate.

en:Wikiquote has only a handful of sysops, and has periods where none are watching. We cannot keep spending hours each day blocking such complex attacks, even if we bend or break our own policies to head off likely vandal accounts (which this vandal seems to be trying to encourage). I would like some advice on how we can do a better job of stopping these attacks, given our extremely limited resources. ~ Jeff Q (talk) 02:03, 30 October 2006 (UTC)

Also note, that although my username does NOT appear on the list, I was accused of being the same user as MyName on Wikinews-en. I have requested a checkuser on my own behalf which has turned up NOTHING on Wikiquote, but apparently shows that there are IP addresses trying to be me and setting me up on Wikinews-en. The apparent imposter on Wikinews-en was InvisibleSUn who made several accusations and threats to me. The user was blocked indefiantely afeter MyName on Wikinews-en admitted on the Admin Alert page to being the user behind the attacks. I have requested that an investigation into the IP's attempting to be me on Wikinews be launched as to further prove my innicence after being accused of being MyName, an imposter, troll and a vandal. Any new information on this incident, regarding me, should be placed on my Meta Talk page or my wikinews talk page. DragonFire1024 02:13, 30 October 2006 (UTC)
To expand on DragonFire1024's point, this vandal appears to have been trying to provoke hostility between sysops n:User:DragonFire1024 on en:Wikinews and q:User:InvisibleSun and myself (q:User:Jeffq) on en:Wikiquote by registering and using those usernames that weren't already registered across these projects and Meta. I may be the only one of the three that had registered usernames months/years ago on all three, but anyone investigating shouldn't take my word for it (that is, Meta's User:Jeffq). I've not been able to investigate all the implications and details of this most recent attack yet, as the thing already screwed my day up considerably, but I'm hoping we can straighten out any problems that were created in the next day or two. ~ Jeff Q (talk) 05:49, 30 October 2006 (UTC)
Please note that this vandalism has continued every day, at varying intervals between 20:00 and 02:00, right up through 2-3 November, both on Wikiquote and to a lesser extent on Wikinews. I don't know why no one is responding to this report. I must assume that I am either not filing it in the correct place, everyone here is too busy to respond, or they are not interested in working on this issue. I am not a frequent editor on Meta, so please forgive me if I am making some kind of mistake, but it would help if someone could clarify the reason for the silence. Thank you. ~ Jeff Q (talk) 10:34, 3 November 2006 (UTC)
Because this page isn't usually used for, to use an analogy, what w:WP:AIV is for, rather it's a semistatic, sedate listing of wanted posters, EG. w:WP:LTA. 68.39.174.238 01:25, 13 February 2007 (UTC)

[edit] The Swahili Football Vandal

Seeking advice on how to block a repeated vandal on the sw:wikipedia . Someone keeps vandalizing the sw page for soccer, http://sw.wikipedia.org/wiki/Mpira_wa_miguu . We revert, it gets vandalized again from a different IP. We are a small wikipedia with only a few active participants, and the administrators don't know all the ins and outs of protecting a page from this sort of attack. Can you offer clues? Thanks, Malangali 03:16, 12 December 2006 (UTC) 03:15, 12 December 2006 (UTC)

[edit] Tit vandal

Some bot is vandalizing from multiple IP addresses that related to the word "Tit". For example: http://en.wikipedia.org/w/index.php?title=Tit_for_tat&action=history

Some IP's have already been blocked, but the vandalism keeps coming from other IP addresses.

[edit] Wikipedia is Communism

actually a long term vandal, but a vandal with the same modus operandi has vandalised almost the entire database of the Zeelandic Wikipedia (zea: - zea:User:WIC). Steinbach (formerly Caesarion) 20:47, 19 February 2007 (UTC)

[edit] New post-"&" partial article erasing bot

I'm not sure that this is the appropriate place to mention this... I've just recently began seeing a new vandal bot at two of my MediaWiki sites, beginning on April 10th, 2007. The bot seems to remove large portions of articles after encountering an "&" character. Since this isn't spam, I'm unable to blacklist such edits. All I can do is revert the edit and then block the IP address. I would prefer not to have to close the sites to anonymous edits but that's about the only real solution that I can think of. I have a log of these edits available for review here http://www.seattleeva.org/wiki/User:Rjf/Spam#Odd_Random_Changes should anyone care to look into it. I'm not sure if we are seeing any similar vandalism at the core wikimedia sites? --D0li0 11:18, 12 April 2007 (UTC)

[edit] Solution

All of this vandalism appears to be coming from a new User-Agent which didn't exist until these began and only appears to identify this particular bot, so I've blocked it from accessing the site altogether by including in the apache configuration file:

SetEnvIf User-Agent "Mozilla/4.0 \(compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 2.0.50727\)" vandal_agents

Next add this Deny line to applicable virtual hosts directory sections:

<Directory />
 Deny from env=vandal_agents
</Directory>

This should work until the bot wises up and changes it's agent identification... --D0li0 04:08, 14 April 2007 (UTC)

[edit] Mumfum vandal

Got a feeling it may be worth starting this one here. For sometime Wikibooks has enjoyed the company of one (or more) Mumfum vandal(s). It looks to me as tho they hit a number of wikis in succession on the 10th (Requests_for_CheckUser_information#Meta). The IP address for the meta one was the same as the books one so I'm wondering if others out there were affected? Equally whether some rather more co-ordinated action on IP addresses might be worthwhile. Hopefully stating the obvious I'll happily help wherever I can (& feel free to ask if anyone wants more info). The page move aspect of this vandal may point to an "on wheels" connection. If anyone is sure feel free to move this to that section - regards --Herby talk thyme 12:40, 12 April 2007 (UTC)

[edit] Pisskern Alien vandal

We have had a recurrent problem on the Norfuk Wikipedia with an individual registering a parachute account, and moving articles, usually pih:Norfuk Ailen and pih:Pitkern Ailen to crude variants. See our move log for illustration.

I whack the account as soon as I see it, and move the pages back, but it's getting tiresome. I add the pages into pih:Wikipedia:Protected titles before I nuke them, but the vandal then just uses some Unicode tricks to create titles that look the same, but are made from different characters.

I would like to make it so that users cannot move pages for a week after registering, but I'm not sure how this is done. Other than that, I'm stuck for ideas on how to combat this vandal. Does anyone have any ideas? Pallmall 08:39, 29 May 2007 (UTC)

You (an admin?) can "protect" the page using "block unregistered users" (just on "move" if you want). This prevents very new accounts (2/3 days I think) from moving the page. I would also suggest that you request Check user information on the accounts to see if there is an underlying IP behind some or all the accounts. --Herby talk thyme 08:51, 29 May 2007 (UTC)

[edit] Atsushi, Atsushi2, Atsushi3

Recently there has been a Japanese User misusing his userpage on dozens of Wikipedia-editions for long texts in Japanese. If you check the Usernames "Atsushi", "Atsushi2", "Atsushi3" using the contribution tool [10], you see that he's is doing that for quite a long time now. He has been blocked on several languages, sometimes only his userpage because it seems he's only using that page for editing. His editing history on fr, just as an example how he spams recent-changes with this nonsense. Doing no "real" vandalism he might be considered as harmless, yet all this japanese text could also be copyvio material, as nearly noone, especially on the smaller Wikipedias might be able to check it. I have no idea how to deal with this rather unusual vandalism, but still think something should be done on a meta level to stop him. --Christian Günther 07:18, 1 April 2008 (UTC)

For a quicker look on his accounts. See [11] ie. [12] [13] --Christian Günther 07:32, 1 April 2008 (UTC)

[edit] Vandal 125.24.52.147

km.wiki is being heavily vandalized by IP 125.24.52.147 and none of the active admins are online. Also, it looks like he is unrepentant. Please take the necessary steps to block him. Thanks! --Jose77 02:48, 27 January 2008 (UTC)

Seems to have stopped now, I'll keep a look out for more. Nakon 03:26, 27 January 2008 (UTC)
Also 125.24.181.89 and Superbot have picked up where they left off. Woodym555 13:30, 27 January 2008 (UTC)
Khmer now has a temp sysop, vandals blocked, vandalism cleaned up for now. Woodym555 00:50, 28 January 2008 (UTC)

[edit] http://es.wikiquote.org/

Helow, I am GArber in Spanish Wikiquote. The 190.84.63.207 es the spam bot, please block this IP., Thanks--85.57.215.38 20:33, 1 March 2008 (UTC)

[edit] http://es.wikiquote.org/

Helow, I am GArber in Spanish Wikiquote. The es.wikiquote.org is being heavily vandalized by IP 69.79.240.190, please block this IP. Thanks--85.57.215.38 20:33, 1 March 2008 (UTC)

Gracias, --birdy geimfyglið (:> )=| ∇ 13:21, 25 March 2008 (UTC)

[edit] Related pages

Retrieved from "http://meta.wikimedia.org/wiki/Vandalism_reports"
Personal tools