User:GeneralNotability/Paper sockfarm AAR/IP Edits
Please don't judge my SQL-writing abilities. Databases are not my forte.
COIBot database dump[edit]
MariaDB [s51230__linkwatcher]> SELECT diff,lang,pagename,user,date FROM linkwatcher_linklog where ip=1 AND (domain like 'com.mdpi.%' and ((fullurl like '%2078%' and fullurl like '%2489%' and fullurl like '%263%') OR (fullurl like '%2073%' AND fullurl LIKE '%431X%' AND fullurl LIKE '%60%')) OR (domain LIKE 'net.researchgate.%' AND (fullurl LIKE '%320448810%' OR fullurl LIKE '%327265925%')));
+------------------------------------------------------------------------------------+--------+------------------------------------------------------------------------------------------------------------+-----------------+------------+
| diff | lang | pagename | user | date |
+------------------------------------------------------------------------------------+--------+------------------------------------------------------------------------------------------------------------+-----------------+------------+
| https://en.wikipedia.org/w/index.php?diff=911672686&oldid=895926396 | en | Polish Wikipedia | 94.254.211.208 | 2019-08-20 |
| https://en.wikipedia.org/w/index.php?diff=911674999&oldid=907093824 | en | Russian Wikipedia | 178.168.191.149 | 2019-08-20 |
| https://ru.wikipedia.org/w/index.php?diff=101712473&oldid=101639570 | ru | РуÑÑÐºÐ°Ñ Ð’Ð¸ÐºÐ¸Ð¿ÐµÐ´Ð¸Ñ | 178.168.191.149 | 2019-08-20 |
| https://de.wikipedia.org/w/index.php?diff=191518209&oldid=191287087 | de | Deutschsprachige Wikipedia | 94.254.210.173 | 2019-08-20 |
| https://en.wikipedia.org/w/index.php?diff=911729830&oldid=909965287 | en | Urdu Wikipedia | 178.168.176.27 | 2019-08-20 |
| https://en.wikipedia.org/w/index.php?diff=911778967&oldid=911544450 | en | Chinese Wikipedia | 178.168.158.5 | 2019-08-21 |
| https://en.wikipedia.org/w/index.php?diff=911800649&oldid=895926715 | en | Swedish Wikipedia | 188.146.228.136 | 2019-08-21 |
| https://en.wikipedia.org/w/index.php?diff=911801238&oldid=895920319 | en | Dutch Wikipedia | 37.47.207.136 | 2019-08-21 |
| https://en.wikipedia.org/w/index.php?diff=911803469&oldid=905345396 | en | Arabic Wikipedia | 5.184.41.139 | 2019-08-21 |
| https://fr.wikipedia.org/w/index.php?diff=161993541&oldid=161555503&rcid=392554890 | fr | Black Mirror (s�rie t�l�vis�e) | 37.30.0.139 | 2019-08-21 |
| https://en.wikipedia.org/w/index.php?diff=911817135&oldid=911781436 | en | Jurassic World: Fallen Kingdom | 188.146.234.47 | 2019-08-21 |
| https://en.wikipedia.org/w/index.php?diff=911821920&oldid=911615301 | en | Bohemian Rhapsody (film) | 37.30.18.113 | 2019-08-21 |
| https://en.wikipedia.org/w/index.php?diff=912008199&oldid=902087183 | en | Portuguese Wikipedia | 178.168.180.233 | 2019-08-22 |
| https://en.wikipedia.org/w/index.php?diff=912012875&oldid=911381605 | en | The Nun (2018 film) | 37.214.193.107 | 2019-08-22 |
| https://en.wikipedia.org/w/index.php?diff=912032265&oldid=911981352 | en | Spider-Man: Into the Spider-Verse | 178.168.191.91 | 2019-08-22 |
| https://ru.wikipedia.org/w/index.php?diff=101755039&oldid=101751549 | ru | Человек-паук: Через вÑеленные | 178.168.180.89 | 2019-08-22 |
| https://en.wikipedia.org/w/index.php?diff=912138552&oldid=910717676 | en | Story of Yanxi Palace | 178.120.233.130 | 2019-08-23 |
| https://zh.wikipedia.org/w/index.php?diff=55788233&oldid=55714355 | zh | 延禧攻略 | 178.120.233.130 | 2019-08-23 |
| https://en.wikipedia.org/w/index.php?diff=912150626&oldid=903250605 | en | Catalan Wikipedia | 178.120.254.29 | 2019-08-23 |
| https://en.wikipedia.org/w/index.php?diff=912230232&oldid=912213193 | en | Spider-Man: Into the Spider-Verse | 37.214.245.155 | 2019-08-24 |
| https://en.wikipedia.org/w/index.php?diff=912243425&oldid=911374682 | en | Finnish Wikipedia | 37.214.218.181 | 2019-08-24 |
| https://en.wikipedia.org/w/index.php?diff=912288241&oldid=911171451 | en | Serbo-Croatian Wikipedia | 94.254.202.200 | 2019-08-24 |
| https://en.wikipedia.org/w/index.php?diff=912306519&oldid=886806955 | en | Basque Wikipedia | 188.146.101.165 | 2019-08-24 |
| https://en.wikipedia.org/w/index.php?diff=912312928&oldid=876326426 | en | Malay Wikipedia | 94.254.203.113 | 2019-08-24 |
| https://en.wikipedia.org/w/index.php?diff=912313220&oldid=905223373 | en | Esperanto Wikipedia | 37.30.49.169 | 2019-08-24 |
| https://en.wikipedia.org/w/index.php?diff=912315705&oldid=910333279 | en | Armenian Wikipedia | 178.168.158.80 | 2019-08-24 |
| https://en.wikipedia.org/w/index.php?diff=912369448&oldid=906528063 | en | Danish Wikipedia | 188.146.46.127 | 2019-08-25 |
| https://en.wikipedia.org/w/index.php?diff=912390759&oldid=911744248 | en | Web 2.0 | 94.254.206.198 | 2019-08-25 |
| https://en.wikipedia.org/w/index.php?diff=912466330&oldid=908656190 | en | Azerbaijani Wikipedia | 178.168.156.30 | 2019-08-25 |
| https://de.wikipedia.org/w/index.php?diff=192222719&oldid=191953518 | de | Enzyklop�die | 88.128.80.128 | 2019-09-13 |
| https://de.wikipedia.org/w/index.php?diff=192223086&oldid=190731324 | de | Informationsqualit�t | 88.128.80.128 | 2019-09-13 |
| https://simple.wikipedia.org/w/index.php?oldid=7008929&rcid=14446532 | simple | CNN Coco Bandicoot | 180.190.167.238 | 2020-06-28 |
| https://en.wikipedia.org/w/index.php?diff=839887485&oldid=810850538 | en | DBpedia | 94.254.230.223 | 2018-05-06 |
| https://en.wikipedia.org/w/index.php?diff=877074042&oldid=877053479 | en | LinkedIn | 94.254.249.28 | 2019-01-06 |
| https://en.wikipedia.org/w/index.php?diff=879132358&oldid=878970914 | en | Social media | 188.147.103.111 | 2019-01-19 |
| https://en.wikipedia.org/w/index.php?diff=879536464&oldid=878703237 | en | Pinterest | 5.173.232.137 | 2019-01-21 |
| https://de.wikipedia.org/w/index.php?diff=192223255&oldid=191213630 | de | Social Media | 88.128.80.128 | 2019-09-13 |
| https://ru.wikipedia.org/w/index.php?oldid=106915067 | ru | Social media Republic of Crimea | 178.34.158.19 | 2020-05-09 |
+------------------------------------------------------------------------------------+--------+------------------------------------------------------------------------------------------------------------+-----------------+------------+
Analysis[edit]
The IPs primarily pushed the earlier paper associated with this sockfarm, "Multilingual Ranking of Wikipedia Articles with Quality and Popularity Assessment in Different Topics". The main activity here was in mid-August 2019, starting approximately one week after that paper was published on MDPI (14 August 2019). A couple of other papers associated with the same group were also pushed in smaller amounts.
As with later iterations of this farm, we see the apparent use of templates for the added text; comparing, for example, w:en:Special:Diff/911672686 and w:en:Special:Diff/911674999, where it is obvious that numbers and a handful of words are being filled in by a script. I have not had the non-English contributions analyzed by proficient speakers, but the English contributions are written in an awkward way that suggests a non-native writer or machine translation, see for example w:en:Special:Diff/911817135 which uses the awkward phrasing In June 2018 Jurassic World: Fallen Kingdom achieved the first place in the global popularity ranking of the films. The English contributions also have the odd quirk of writing large numbers as, for example, "10 thousand" (I would consider 10,000 or ten thousand to be standard, while the mixed spelling and numbers is unusual). In non-English contributions we see this sockfarm's normal use of localization for numbers. We also see the use of named references in a few places (such as w:ru:Special:Diff/101755039)
There are a few differences between sock edits which I am unable to account for at this time. Some edits introduce a new heading, while others do not, and sometimes spaces are placed around the word in the header (see w:en:Special:Diff/912288241 and w:en:Special:Diff/912243425). There appears to be at least some intelligence in how the headings are added; for example, the additions are often placed under a "statistics" or "quality" heading if present, sometimes with an individual sub-heading.
Note that the simplewiki edit by 180.190.167.238 appears to be a false positive - it seems that that user copied w:en:CNN to simplewiki while the former still contained a link to one of the spam papers.
Observed IPs/ranges[edit]
Ranges are from the whois.toolforge.org's search results.
- 5.173.232.137 (talk • contribs • WHOIS • block user • block log • guc • checkip) (Poland)
- 37.30.0.0/21 (talk • contribs • WHOIS • block user • block log • guc • checkip) (Poland)
- 37.47.0.0/16 (talk • contribs • WHOIS • block user • block log • guc • checkip) (Poland)
- 37.212.0.0/14 (talk • contribs • WHOIS • block user • block log • guc • checkip) (Belarus)
- 88.128.80.128 (talk • contribs • WHOIS • block user • block log • guc • checkip) (Germany)
- 94.254.128.0/17 (talk • contribs • WHOIS • block user • block log • guc • checkip) (Poland)
- 178.34.152.0/21 (talk • contribs • WHOIS • block user • block log • guc • checkip) (Russia/Ukraine)
- 178.168.128.0/18 (talk • contribs • WHOIS • block user • block log • guc • checkip) (Belarus)
- 188.146.0.0/15 (talk • contribs • WHOIS • block user • block log • guc • checkip) (Poland)