Vandalism reports

From Meta, a Wikimedia project coordination wiki
Jump to: navigation, search
Vandalism reports
Before reporting, please take note of the following premises:
Most Wikimedia wikis are able to deal with vandalism on their own. This page is intended only for certain reports
Reporting requirements
  • The username(s) or IP address(es) of the offenders.
  • A description of their vandalism (spamming, adding junk, removing legitimate text, etc), preferably with diffs to examples.
  • The Wikimedia wikis affected.
  • Suggestions for monitoring strategies, blocks etc.

When reporting please use informative headings like:

=== username(s), IP address ===
*{{luxotool|IP address}} <!-- for IP addresses -->
*{{sultool|Username}} <!-- for usernames -->
Description, evidence, diffs, etc. --~~~~
Note on spam
  • If the spamming is cross-wiki, malware sites, repeated or severe, please report it to the spam blacklist.
Related pages
If the username is clearly offensive, libellous or contains private information do NOT post it here. Email the private OTRS queue for stewards: - Thank you.
Archives & subpages
Vandalism reports Vandalism reports/Archive 1 Vandalism reports/Archive 2
Vandalism reports/Archive 3 Vandalism reports/Archive 4 Vandalism reports/Archive 5
Vandalism reports/Archive 6 Vandalism reports/Archive 7 Vandalism reports/Beleiutz
Vandalism reports/Beleiutz/Accounts Vandalism reports/Beleiutz/Articles Vandalism reports/BogaertB
Vandalism reports/Unknown
Cross-wiki requests
Meta-Wiki requests

Current cross-wiki vandalism[edit]

Please place new reports at the top of this section. Thank you.

Vlad Georgian (Beleiutz sockpuppet)[edit]

The above-noted account is a sockpuppet of the cross-wiki vandal Beleiutz. It has the same editing interests (Jorge, Paula Seling, Mihaela Rădulescu, Disney, etc.) and same modus operandi (uploading copyvios of these Romanian celebrities [1] [2], entering nonsense edit summaries [3], etc.) The account's already blocked as a confirmed sockpuppet on Romanian Wikipedia but has been recently active on other wikis. Please globally lock this account and if possible perform a CU to locate additional accounts. (See the long-term abuse report for further details.) —Psychonaut (talk) 15:05, 26 March 2015 (UTC)

Sofia Lindberg[edit]

global advertising her website konto-report. See also the files uploaded to commons where she places links and "source information" to the specific website. --Pentachlorphenol (talk) 20:58, 23 March 2015 (UTC)[edit]

Vandalising on multiples pages on chwiki. Thanks. Thibaut120094 (talk) 14:27, 19 March 2015 (UTC)


vandalising the on the wikimania 2015 wiki, such as the main page there. [4] Aude (talk) 19:40, 26 February 2015 (UTC)

This is resolved now. Aude (talk) 19:44, 26 February 2015 (UTC)

Javad Ramezani[edit]

User:Billinghurst kindly added Javad Ramezani to the global blacklist yesterday, but the Iranian user (constantly changing IP) is back again today, no doubt in circumventing the listing by adding new articles in non-Latin alphabet based Wikipedias. Apart from the already-present Japanese entry, the most recent addition is w:mr:जे रमज़ानचा. I've merged the newest item on Wikidata to the older item, d:Q18729000 to keep a track of the abuse history (more here), and upon Billinghurst's request, I'm reporting this here to ask what can be done next. Jared Preston (talk) 10:37, 5 February 2015 (UTC)

There is one article which wasn't catched by the global blacklist: so:Javad ramezani --Pasleim (talk) 23:30, 11 February 2015 (UTC)

Many IP addresses for same user[edit]

The IP editor who is the subject of the section immediately below has officially gone ape-shit, creating hundreds of junk articles under many different IP addresses (1 IP4 and I think 19 IP6 addresses) at the following wikis:

Follow the links (to respective Special:NewPages) for the relevant IP addresses. There's too many of them bother posting them here. Looks like the IP6 addresses all start with "2602:30A:C04E:1400" and the IP4 address is cross-wiki-contribsIP inforobtexgblockglist. - dcljr (talk) 03:21, 5 February 2015 (UTC)


Creation of several stubs in English on non-English wikis for the sole purpose of pushing them past article-count milestones, which the user then "helpfully" reported at Wikimedia News (now reverted). All the user's contribs at non-English Wikipedias still have to be deleted. (luxotool has been unreliable for me this evening, so here's the individual contribs pages: ch, dz, ik, tum) - dcljr (talk) 04:15, 30 January 2015 (UTC)

Or should I have reported this at Steward requests/Miscellaneous? I can never remember... - dcljr (talk) 04:19, 30 January 2015 (UTC)
Upon furthur reflection, I suppose under the AGF principle this really should have been reported at Steward requests/Miscellaneous. But I'm keeping this here in case someone can tell that this is a longtime vandal acting more subtly under a different guise. (Please delete the pages once you've investigated — unless it's not necessary to wait, of course.) - dcljr (talk) 05:11, 30 January 2015 (UTC)
Note: Same douche-baggery from 2602:30A:C04E:1400:F0A8:9C28:2ABE:C89F cross-wiki-contribsIP inforobtexgblockglist — but this user has already been blocked. - dcljr (talk) 01:44, 31 January 2015 (UTC)
This is still Decker, isn't it? I blocked the IPs and deleted the pages. --MF-W 09:52, 31 January 2015 (UTC)
You'd know better than I. It didn't seem quite as clear-cut to me this time, since the pages were, apart from being in English on non-English wikis, basically well-formed pages that might (conceivably) have just been from an over-eager, misguided newbie. Still, I have no problem with someone else reacting "with maximum prejudice" *wink*, especially after the 2nd IP6 showed up. Thanks for investigating and deleting. - dcljr (talk) 00:57, 1 February 2015 (UTC)
Oops, wait... these pages have not been deleted yet: ch, dz, ik, tum. - dcljr (talk) 01:05, 1 February 2015 (UTC)
Now done. - dcljr (talk) 01:43, 4 February 2015 (UTC) ...[edit]

Cross-wiki spamming with copyviols. These are only the IP numbers I found reverting in n:it:Discussione:La Georgia ha decretato lo stato di guerra/Commenti, there are likely others. Targets talk pages and the object has a distinct pattern. -- Codicorumus  « msg 21:14, 29 January 2015 (UTC)



Global spamer , This user only Add Your weblink in Global wiki Project all days --Florence (talk) 17:58, 25 December 2014 (UTC)
also [SULinfo] – [cross-wiki edits] --Florence (talk) 01:55, 27 December 2014 (UTC)
this user is now active in global project in whatsapp articles with hoaxes --Florence (talk) 22:52, 27 December 2014 (UTC)
this user blocked in 8 local project - not need maked global blocked?? --Florence (talk) 18:10, 30 December 2014 (UTC)
this user back with name Sushilmishra bot [SULinfo] – [cross-wiki edits] --Florence (talk) 00:47, 4 January 2015 (UTC)

Blacklisted; and having the report at User:COIBot/XWiki/ regenerated. Please check it for any links (it won't be ready for an hour or two). It is my understanding that the accounts have been locked.

@فلورانس: It would helpful with reports if the domain being abused is clearly identified. We can run reports on domains with COIBot and generate data, including the names of the offending accounts. Being more explicit about the underlying problem than the name of the vandal can bring about a better result.  — billinghurst sDrewth 12:56, 4 January 2015 (UTC)

Thanks dear @Billinghurst: this user used 2 link site: User:COIBot/XWiki/ <this page created with COIBot or with user? --Florence (talk) 13:26, 4 January 2015 (UTC)
back with new user name :) Davidtamsot ( local | logs | global )

--Florence (talk) 17:31, 4 January 2015 (UTC)

Long-term, recurrent vandalism[edit][edit]

Still active in various wikipedia versions. Also known as cross-wiki-contribsIP inforobtexgblockglist, the same vandalism from both IPs. --mfb (talk) 09:36, 28 October 2014 (UTC)
..and with IP cross-wiki-contribsIP inforobtexgblockglist. I have been reverting those edits for many days now.... --Hemuska (talk) 12:04, 29 October 2014 (UTC)
The section got archived but he is still active with his main IP, always the same type of vandalism. --mfb (talk) 09:47, 23 January 2015 (UTC)
I globally blocked it now for 6 months. --MF-W 15:35, 23 January 2015 (UTC)

MS Vandal[edit]

The following user name have been used as sock-puppet for vandal activities.

Would appreciate if the common IP can be blocked / mail to me to be blocked. Yosri (talk) 17:29, 11 January 2015 (UTC)

They all (the first 6) edited from different (3) IPs. Some (SibukPolitik and below) last edited way back in 2014 March-April, thus can't be tracked anymore.
Another one: 1MalaysiaGolfDidahulukan [SULinfo] – [cross-wiki edits]. Bennylin 15:12, 11 March 2015 (UTC)


See Vandalism reports/Beleiutz for current or recent claimed activity --Abd (talk) 14:45, 16 September 2014 (UTC)


hi dear - (this is a global vandalism user) (and blocked in any wiki) , he is have any vandalism edit in *.wiki and have any user id Wikipedia:Sockenpuppe = user:Piroz12 ,user:Sarafarzad , user:R tehrani , user:Sarafarzad and used this accounts only for vandalism , in and Rollback all edit and blocked , check usered in --Florence (talk) 00:49, 24 November 2014 (UTC)

@Elfix: . this user back with username Sardari b [SULinfo] – [cross-wiki edits] , thanks --Florence (talk) 12:56, 24 November 2014 (UTC)
Yes check.svg Done Elfix 13:14, 24 November 2014 (UTC)
Big Like and Thanks dear --Florence (talk) 13:24, 24 November 2014 (UTC)
hi @Elfix:, sorry he is back with name Tina ramzi [SULinfo] – [cross-wiki edits] with Global Contributions --Florence (talk) 19:56, 8 December 2014 (UTC)
Previously locked.  — billinghurst sDrewth 12:45, 4 January 2015 (UTC)

this user is not need stoped vandalism , plz lock user ip, he is cross-wiki vandal (Wikipedia_sockpuppets_of_Bitafarhadi) , (w:fa:رده:سوءاستفاده‌کنندگان از حساب‌های کاربری زاپاس/Bitafarhadi) thanks --Florence (talk) 00:27, 19 March 2015 (UTC)

The recent wave of Wikimedia spam[edit]

How and why it's done and how it can be stopped.

The recent wave of linkspam on Wikimedia projects follows a very common pattern:

  • a new account is created
  • a new page is created
  • the page is filled with a good amount of text (typically 6 to 8 lines) with a URL at the end or in the middle

The objective of these spammers is to trick Google's anti-linkspam algorithms in counting these links as valid links, thus elevating the target page in search results.

Why is this done on Wikimedia projects.

  • Wikimedia pages score high in search results themselves, which makes Google algorithms attach a high add value to each target page
  • New Wikimedia page are indexed by Google almost instantly (try it!), which means that even if the linkspam page itself is deleted within a few hours, the positive Google algorithm effect has already happened and will remain valid for the target site for 1 tot 2 weeks.

How can these spammers create so many new accounts and post so many of these linkspam pages and continue to do it without stopping?

  • The actual spammers are relatively innocent people, lured by email and other spam offering "work from home" (usually indicated as "data entry") jobs with attractive payment promises
  • Once sign up, they get clear instructions on which sites to target, how to create those accounts, and how to post these messages
  • It's not just Wikimedia; comment sections of popular news sites, blogs and forums are targeted as well
  • The sad thing is that the actual spammers typically never earn any money; to earn money they need to send a link to the linkspam pages that they created to the hiring company and one of the conditions for payment is that the page still needs to be up and available after 6 weeks. Obviously this hardly ever is the case.
  • By the time the sucker wakes up to reality and quits his "job", the damage is already done and countless new suckers have been lured in. (A part of the linkspam they post actually points to sites which offer these very "data entry / work from home" jobs.)

What can Wikimedia do about this? It would actually be very simple for Wikimedia to put an end to this once and for all.

  • Today every new article in the main namespace is indexed nearly instantly by Google.
  • If the Wikimedia software were changed to automatically add a <No-Index> tag to every new page, that was automatically removed after (let's say) 3 days, the value of those pages for the spammers drops to zero, and they will soon move on to new grounds.

W\|/haledad (zegt u het maar) 7 feb 2015 19:45 (CET)

I think you're giving the spammers a bit too much credit. They're not that smart... - dcljr (talk) 23:19, 10 March 2015 (UTC)

needs to keep close watch on 180.234.ABC.XYZ cross wiki vandal edits[edit]

On Marathi language wikipedia I found three vandlising attempts to remove all the content from article mr:w:हितेन तेजवानी (article history). These IPs seem to show Bangladesh origin and making cross wiki edits in low key articles at first glance seeming to be constructive but many of them in reality can not be assured to be so. I contacted Bangali language editor on his talk page in his reply he also complained, he says, " We have also noticed in Bengali Wikipedia that IP addressess (180.234.ABC.XYZ) have been vandalising some of the articles here for quite a long time. I can assure you, no edit war is going on in bn wiki. It is plain vandalism. He is changing the info of the article and providing false information by making mutiple small edits. If he is vandalising in mr wiki also, then I think a global block is needed. "

In another Marathi wikipedia article the IPs played with article names in very different scripts namely telgu and tamil, I went on to request tamil language wikipedian to look in to the issue.

As such (to my knowledge) Bangladesh has a very vibrant and constructive wikimedian community. I am bit surprised with vandalism coming from Bangladesh IPs. With given positive background rest of Bangla wikimedian community I did not use any protectionism or edit filters imidiately locally. If this vandalism continues we will need to take the same seriously. I am reporting here for a close watch on this IP range for cross wiki vandalism and apropriate action if necessary.

Mahitgar (He who knows ,wants to know and and loves to keep others informed) (talk) 16:50, 11 March 2015 (UTC)

The seems to be a Bangladeshi provider (Augere Wireless Broadband Bangladesh Limited) and as such would seem likely to be one person on a dynamic IP connection. For such a large range, there is no easy ability to monitor externally to the wiki. It would seem that there will need to be abuse filters applied to manage, or minimise the impact of the vandal. If it becomes problematic then it may need anon only blocking.  — billinghurst sDrewth 00:43, 12 March 2015 (UTC)

Agree, For most wikis I suppose local edit filters likely to be more effective. And at mr we are capable enough to handle this if it goes further. Before that as such I always prefer to find some way to communicate and convince vandals, so spill over effect can be minimised and we also get time to study the pattern better. I will keep you informed here if any need arises. Thanks and Regards

Mahitgar (He who knows ,wants to know and and loves to keep others informed) (talk) 02:31, 12 March 2015 (UTC)


please check these users global edits:

Thanks. ARASH PT  talk  20:07, 27 March 2015 (UTC)

Yes I saw these user (probably socks) spamming on Indonesian sister projects (Javanese Wikipedia), I haven't blocked it since the report is here maybe locking it is better than locally blocking it on many wikis.--AldNonymousBicara? 20:13, 27 March 2015 (UTC)