Vandalism reports

From Meta, a Wikimedia project coordination wiki
Jump to: navigation, search
Vandalism reports
Before reporting, please take note of the following premises:
Most Wikimedia wikis are able to deal with vandalism on their own. This page is intended only for certain reports
Reporting requirements
  • The username(s) or IP address(es) of the offenders.
  • A description of their vandalism (spamming, adding junk, removing legitimate text, etc), preferably with diffs to examples.
  • The Wikimedia wikis affected.
  • Suggestions for monitoring strategies, blocks etc.

When reporting please use informative headings like:

=== username(s), IP address ===
*{{luxotool|IP address}} <!-- for IP addresses -->
*{{sultool|Username}} <!-- for usernames -->
Description, evidence, diffs, etc. --~~~~
Note on spam
  • If the spamming is cross-wiki, malware sites, repeated or severe, please report it to the spam blacklist.
Related pages
Notice
If the username is clearly offensive, libellous or contains private information do NOT post it here. Email the private OTRS queue for stewards: stewards-at-wikimedia.org - Thank you.
Archives & subpages
Vandalism reports Vandalism reports/Archive 1 Vandalism reports/Archive 2
Vandalism reports/Archive 3 Vandalism reports/Archive 4 Vandalism reports/Archive 5
Vandalism reports/Archive 6 Vandalism reports/Archive 7 Vandalism reports/Beleiutz
Vandalism reports/Beleiutz/Accounts Vandalism reports/Beleiutz/Articles Vandalism reports/BogaertB
Vandalism reports/Unknown
Cross-wiki requests
Meta-Wiki requests

Current cross-wiki vandalism[edit]

Please place new reports at the top of this section. Thank you.

卐卐卐卐卐卐卐卐卐‎[edit]

Can someone please hide his name and all trace of him on huwiki (and from this section if you think it's necessary)? We don't like to see swastikas even though in the logs only. Csigabi (talk) 17:21, 29 July 2015 (UTC)

Jozsibacsi19[edit]

Vandal un huwikibooks. He and his sockpuppets have been blocked on huwiki by local admins and by Stryn on huwikibooks for an indefinite time. However he revealed the IRL names of some of the huwiki editors and admins. Can someone please hide these pages at his/her first convenience? This and this. Thx. Csigabi (talk) 08:54, 22 July 2015 (UTC)

Hi, there are some active local admins there on hu.wb, please request it to them. Regards.--Syum90 (talk) 09:26, 22 July 2015 (UTC)

I already did. Apparently they are not available right now. Thanks anyway. Csigabi (talk) 09:39, 22 July 2015 (UTC)

Symbol wait.svg Doing... @Csigabi: I've contacted with Billinghurst, and he's managing this case.--Syum90 (talk) 09:52, 22 July 2015 (UTC)

@Syum90: Thanks, I am followong the progress. Normally we could wait for the local admins' actions but IRL data are too sensitive so they should be removed as soon as possible. Csigabi (talk) 09:56, 22 July 2015 (UTC)

@Billinghurst: Thanks for your quick actions. I really appreciate them. Csigabi (talk) 10:02, 22 July 2015 (UTC)

Yes check.svg Done by Billinghurst.--Syum90 (talk) 10:21, 22 July 2015 (UTC)

Ternohovha[edit]

See Special:CentralAuth/Ternohovha. --Максим Підліснюк (talk) 18:05, 13 July 2015 (UTC)

Yes check.svg Done, thanks for reporting. --Stryn (talk) 18:11, 13 July 2015 (UTC)

159.224.160.157[edit]

I've deleted many of its creations and blocked it on several wikis; I've also requested its global block.--Syum90 (talk) 13:44, 7 July 2015 (UTC)
Yes check.svg Done Globally blocked by QuiteUnusual.--Syum90 (talk) 08:24, 8 July 2015 (UTC)

Shenzibanzaied[edit]

The vast majority of these edits are on ladwiki, though there are some elsewhere. It's a little hard to describe completely, because it seems to be mostly mischief-making. For example, on ladwiki, a number of words have "u" converted to "v", as if this were Latin, rather than Ladino. Others show small spelling changes, frequently similar to ones common in the language, but just not quite right.
This becomes a little clearer to see in the other two wikis where there are multiple edits: scowiki and eswiki.

  • In scowiki, on the page sco:Plant and sco:Cake, this is pretty easy to see.
  • On the page es:Gallactorrea, s/he adds a fact that is correct (it can happen to males). But s/he adds it in a grammatically shaky fashion—and removes a perfectly good reference in the process.

Even though this vandalism isn't really "in your face", I'm pretty convinced that none of this user's edits are valid at all. --StevenJ81 (talk) 20:27, 6 July 2015 (UTC)

Blocked for two weeks on ladwiki. Reverted all vandalism cross-wiki. StevenJ81 (talk) 16:02, 13 July 2015 (UTC)

Robertrodrigo[edit]

Cross-wiki spammer. Thanks in advance. --TheStrayCat (talk) 21:12, 30 June 2015 (UTC)

Yes check.svg DoneDerHexer (Talk) 21:23, 30 June 2015 (UTC)

178.235.108.150[edit]

Cross-wiki spammer. --WTM (talk) 21:13, 27 June 2015 (UTC)

178.158.16.216[edit]

178.158.16.216 cross-wiki-contribsIP inforobtexgblockglist Cross-wiki vandalism and cross-wiki spam. --Максим Підліснюк (talk) 17:38, 10 June 2015 (UTC)

Sheikh Ikram Sic[edit]

Sheikh_Ikram_Sic [SULinfo] – [cross-wiki edits] Vandal-only account. Active on bn.wiki, with an incursion on en.wiki earlier today--Formica rufa (talk) 19:21, 14 May 2015 (UTC)

208.48.241.18[edit]

Cross-wiki vandal:[1], [2],[3],[4],[5], [6], [7]. --Petrov Victor (talk) 19:15, 13 May 2015 (UTC)

Потужний львівський танчик[edit]

Cross-wiki vandal page moves. --Thestraycat57 (talk) 02:43, 20 April 2015 (UTC)

Doesn't seem to be a cross-wiki vandal. Only vandalized on shwiki and already blocked locally there. --Stryn (talk) 05:20, 20 April 2015 (UTC)

Sofia Lindberg[edit]

global advertising her website konto-report. See also the files uploaded to commons where she places links and "source information" to the specific website. --Pentachlorphenol (talk) 20:58, 23 March 2015 (UTC)

90.35.234.92[edit]

Vandalising on multiples pages on chwiki. Thanks. Thibaut120094 (talk) 14:27, 19 March 2015 (UTC)

‎69.178.193.150[edit]

Andromède75[edit]

Account created only for voting on Merchandise_giveaways/Nominations, probable sock-puppet. Orignally from the French WP, no other edit for the last 3 years. --Yann (talk) 16:25, 11 May 2015 (UTC)

Long-term, recurrent vandalism[edit]

2602:30A:C04E:1400:8CBA:C520:6F13:EECB[edit]

96.228.244.95[edit]

Still active in various wikipedia versions. Also known as 63.92.225.57 cross-wiki-contribsIP inforobtexgblockglist, the same vandalism from both IPs. --mfb (talk) 09:36, 28 October 2014 (UTC)
..and with IP 66.194.104.5 cross-wiki-contribsIP inforobtexgblockglist. I have been reverting those edits for many days now.... --Hemuska (talk) 12:04, 29 October 2014 (UTC)
The section got archived but he is still active with his main IP, always the same type of vandalism. --mfb (talk) 09:47, 23 January 2015 (UTC)
I globally blocked it now for 6 months. --MF-W 15:35, 23 January 2015 (UTC)

MS Vandal[edit]

The following user name have been used as sock-puppet for vandal activities.

Would appreciate if the common IP can be blocked / mail to me to be blocked. Yosri (talk) 17:29, 11 January 2015 (UTC)

They all (the first 6) edited from different (3) IPs. Some (SibukPolitik and below) last edited way back in 2014 March-April, thus can't be tracked anymore.
Another one: 1MalaysiaGolfDidahulukan [SULinfo] – [cross-wiki edits]. Bennylin 15:12, 11 March 2015 (UTC)

Beleiutz[edit]

See Vandalism reports/Beleiutz for current or recent claimed activity --Abd (talk) 14:45, 16 September 2014 (UTC)

Bitafarhadi[edit]

hi dear - (this is a global vandalism user) (and blocked in any wiki) , he is have any vandalism edit in *.wiki and have any user id Wikipedia:Sockenpuppe = user:Piroz12 ,user:Sarafarzad , user:R tehrani , user:Sarafarzad and used this accounts only for vandalism , in fa.wiki and en.wiki Rollback all edit and blocked , check usered in en.wiki. --Florence (talk) 00:49, 24 November 2014 (UTC)

@Elfix: . this user back with username Sardari b [SULinfo] – [cross-wiki edits] , thanks --Florence (talk) 12:56, 24 November 2014 (UTC)
Yes check.svg Done Elfix 13:14, 24 November 2014 (UTC)
Big Like and Thanks dear --Florence (talk) 13:24, 24 November 2014 (UTC)
hi @Elfix:, sorry he is back with name Tina ramzi [SULinfo] – [cross-wiki edits] with Global Contributions --Florence (talk) 19:56, 8 December 2014 (UTC)
Previously locked.  — billinghurst sDrewth 12:45, 4 January 2015 (UTC)

this user is not need stoped vandalism , plz lock user ip, he is cross-wiki vandal (Wikipedia_sockpuppets_of_Bitafarhadi) , (w:fa:رده:سوءاستفاده‌کنندگان از حساب‌های کاربری زاپاس/Bitafarhadi) thanks --Florence (talk) 00:27, 19 March 2015 (UTC)

The recent wave of Wikimedia spam[edit]

How and why it's done and how it can be stopped.

The recent wave of linkspam on Wikimedia projects follows a very common pattern:

  • a new account is created
  • a new page is created
  • the page is filled with a good amount of text (typically 6 to 8 lines) with a URL at the end or in the middle

The objective of these spammers is to trick Google's anti-linkspam algorithms in counting these links as valid links, thus elevating the target page in search results.

Why is this done on Wikimedia projects.

  • Wikimedia pages score high in search results themselves, which makes Google algorithms attach a high add value to each target page
  • New Wikimedia page are indexed by Google almost instantly (try it!), which means that even if the linkspam page itself is deleted within a few hours, the positive Google algorithm effect has already happened and will remain valid for the target site for 1 tot 2 weeks.

How can these spammers create so many new accounts and post so many of these linkspam pages and continue to do it without stopping?

  • The actual spammers are relatively innocent people, lured by email and other spam offering "work from home" (usually indicated as "data entry") jobs with attractive payment promises
  • Once sign up, they get clear instructions on which sites to target, how to create those accounts, and how to post these messages
  • It's not just Wikimedia; comment sections of popular news sites, blogs and forums are targeted as well
  • The sad thing is that the actual spammers typically never earn any money; to earn money they need to send a link to the linkspam pages that they created to the hiring company and one of the conditions for payment is that the page still needs to be up and available after 6 weeks. Obviously this hardly ever is the case.
  • By the time the sucker wakes up to reality and quits his "job", the damage is already done and countless new suckers have been lured in. (A part of the linkspam they post actually points to sites which offer these very "data entry / work from home" jobs.)

What can Wikimedia do about this? It would actually be very simple for Wikimedia to put an end to this once and for all.

  • Today every new article in the main namespace is indexed nearly instantly by Google.
  • If the Wikimedia software were changed to automatically add a <No-Index> tag to every new page, that was automatically removed after (let's say) 3 days, the value of those pages for the spammers drops to zero, and they will soon move on to new grounds.

W\|/haledad (zegt u het maar) 7 feb 2015 19:45 (CET)

I think you're giving the spammers a bit too much credit. They're not that smart... - dcljr (talk) 23:19, 10 March 2015 (UTC)

needs to keep close watch on 180.234.ABC.XYZ cross wiki vandal edits[edit]

On Marathi language wikipedia I found three vandlising attempts to remove all the content from article mr:w:हितेन तेजवानी (article history). These IPs seem to show Bangladesh origin and making cross wiki edits in low key articles at first glance seeming to be constructive but many of them in reality can not be assured to be so. I contacted Bangali language editor on his talk page in his reply he also complained, he says, " We have also noticed in Bengali Wikipedia that IP addressess (180.234.ABC.XYZ) have been vandalising some of the articles here for quite a long time. I can assure you, no edit war is going on in bn wiki. It is plain vandalism. He is changing the info of the article and providing false information by making mutiple small edits. If he is vandalising in mr wiki also, then I think a global block is needed. "

In another Marathi wikipedia article the IPs played with article names in very different scripts namely telgu and tamil, I went on to request tamil language wikipedian to look in to the issue.

As such (to my knowledge) Bangladesh has a very vibrant and constructive wikimedian community. I am bit surprised with vandalism coming from Bangladesh IPs. With given positive background rest of Bangla wikimedian community I did not use any protectionism or edit filters imidiately locally. If this vandalism continues we will need to take the same seriously. I am reporting here for a close watch on this IP range for cross wiki vandalism and apropriate action if necessary.

Mahitgar (He who knows ,wants to know and and loves to keep others informed) (talk) 16:50, 11 March 2015 (UTC)

The 180.234.0.0/16 seems to be a Bangladeshi provider (Augere Wireless Broadband Bangladesh Limited) and as such would seem likely to be one person on a dynamic IP connection. For such a large range, there is no easy ability to monitor externally to the wiki. It would seem that there will need to be abuse filters applied to manage, or minimise the impact of the vandal. If it becomes problematic then it may need anon only blocking.  — billinghurst sDrewth 00:43, 12 March 2015 (UTC)

Agree, For most wikis I suppose local edit filters likely to be more effective. And at mr we are capable enough to handle this if it goes further. Before that as such I always prefer to find some way to communicate and convince vandals, so spill over effect can be minimised and we also get time to study the pattern better. I will keep you informed here if any need arises. Thanks and Regards

Mahitgar (He who knows ,wants to know and and loves to keep others informed) (talk) 02:31, 12 March 2015 (UTC)

Spam[edit]

please check these users global edits:

Thanks. ARASH PT  talk  20:07, 27 March 2015 (UTC)

Yes I saw these user (probably socks) spamming on Indonesian sister projects (Javanese Wikipedia), I haven't blocked it since the report is here maybe locking it is better than locally blocking it on many wikis.--AldNonymousBicara? 20:13, 27 March 2015 (UTC)
I have locked Mosros - it is clearly an SPA dedicated to crosswiki spam. The others are less obvious. QuiteUnusual (talk) 12:55, 10 April 2015 (UTC)

User is using Multiple accounts[edit]

Status:    Not done

On Pashto Wikipedia, I think the ps:user:Khangul is using multiple accounts as sock-puppets to Irritate other users , Remember that the Khangul is also administrator on Pashto Wikipedia but he does not let us work on Wikipedia and always discourage other users, So please Investigate him that Is Khangul using multiple accounts or not? If he is using then I request to block his IP and account Globally--UsmanKhann (talk) 23:18, 9 April 2015 (UTC)

No evidence has been presented to justify a CheckUser. "I think" is not evidence. Future requests should be made at Steward requests/Checkuser and not here. QuiteUnusual (talk) 13:08, 10 April 2015 (UTC)

Cyyycyyy[edit]

Status:    Done

User:Cyyycyyy in classical Chinese Wikipedia, creat personal attacks user pages again and again, or replace other user's talk pages with personal attack sentences written in classical Chinese. see also here.--122.90.105.197 14:11, 15 July 2015 (UTC)

Blocked by Billinghurst for two weeks.--Syum90 (talk) 14:29, 15 July 2015 (UTC)