Vandalism reports

From Meta, a Wikimedia project coordination wiki
Jump to: navigation, search
Vandalism reports
Before reporting, please take note of the following premises:
Most Wikimedia wikis are able to deal with vandalism on their own. This page is intended only for certain reports
Reporting requirements
  • The username(s) or IP address(es) of the offenders.
  • A description of their vandalism (spamming, adding junk, removing legitimate text, etc), preferably with diffs to examples.
  • The Wikimedia wikis affected.
  • Suggestions for monitoring strategies, blocks etc.

When reporting please use informative headings like:

=== username(s), IP address ===
*{{luxotool|IP address}} <!-- for IP addresses -->
*{{sultool|Username}} <!-- for usernames -->
Description, evidence, diffs, etc. --~~~~
Note on spam
  • If the spamming is cross-wiki, malware sites, repeated or severe, please report it to the spam blacklist.
Related pages
Notice

If the username is clearly offensive, libellous or contains private information do NOT post it here. Email the private OTRS queue for stewards: stewards-at-wikimedia.org - Thank you.

Archives & subpages
Cross-wiki requests
Meta-Wiki requests

Current cross-wiki vandalism[edit]

Please place new reports at the top of this section. Thank you.

Vandal in id.wb[edit]

Spam again and again ---Arifys (talk) 14:38, 21 January 2016 (UTC)

95.84.217.137[edit]

cross-wiki spam --Максим Підліснюк (talk) 12:30, 9 January 2016 (UTC)

Blocked. -- Tegel (Talk) 12:34, 9 January 2016 (UTC)

A9928KK7530[edit]

Cross-wiki spam--Formica rufa (talk) 13:54, 31 December 2015 (UTC)

Blocked by User:Vituzzu--Formica rufa (talk) 13:55, 31 December 2015 (UTC)

77.97.214.147[edit]

Cross-wiki vandalism and spam (see uk:Спеціальна:Вилучений_внесок/77.97.214.147, es:Especial:Contribuciones/77.97.214.147, et:Eri:Kaastöö/77.97.214.147 and other). --Максим Підліснюк (talk) 22:52, 21 December 2015 (UTC)

Գրիգոր Նարեկացի[edit]

cross wiki spam. --Petrov Victor (talk) 10:51, 16 December 2015 (UTC)

79.40.139.19 - Alec Smithson - cross wiki spam[edit]

Cross wiki spam across several major & minor wikis. Some wikis have already blocked the user, some others delete sistematically the automatic translations he is generating.

  • Consider 79.40.139.197 vs Alec_Smithson...
  • Consider the approach of the user right now is to remove the footprints & traceability, specially within wikidata,

Regards,--C.R. (talk) 10:11, 11 December 2015 (UTC)

This may be of interest. Please note that in some cases the automated translations spammed across many wikipedias may also be copyright violations, as they are added without the attribution required by our licence. Please compare, for example, this page on Lumbaart Wikipedia with the source on it.wp, which was not written by Alec Smithson; therre's no attribution, so that is a copyright violation (as well as apparently being at least partly a hoax). Justlettersandnumbers (talk) 15:22, 20 December 2015 (UTC)

Trần hồng minh Việt nam[edit]

Cross-wiki vandalism. [1] --Dandelo (talk) 10:25, 15 November 2015 (UTC)

Account already locked by Taketa. ~ Nahid Talk 14:03, 13 December 2015 (UTC)

31.11.222.49 - cross wiki spam[edit]

Cross wiki spam across several major & minor wikis. Active wikis have already deleted its contributions and/or blocked it locally. Banjo (talk) 20:07, 4 November 2015 (UTC)

Same behaviour for:

Although these three have no global contributions, due to abuse filters hits. See gl wikipedia abuse filter log here. Banjo (talk) 12:43, 6 November 2015 (UTC)

mass creation vandalism in Min Nan Wikipedia appear again[edit]

Moved from Meta:Requests for help from a sysop or bureaucrat.--Syum90 (talk) 10:45, 2 November 2015 (UTC)

mass creation vandalism in Min Nan Wikipedia appear again, now he use the IP 107.92.58.83, and his behavior is like 107.107.188.4 and ‎107.92.61.13 several days before. 107.92.58.83 is blocked now, but I think it's better to delete all his vandalism in that article. In addition, he is a cross-wiki abuse ip, I think all wikipedias needs a filter to prevent ip and new registered accounts from creating "articles about numbers".--122.90.97.123 10:27, 2 November 2015 (UTC)

For now, I have nuked the first two IPs and globally blocked the one that wasn't locally blocked (107.x.x.x). I will keep track of the other IPs (to globally block if they move to other wikis like before). --Pmlineditor (t · c · l) 10:41, 2 November 2015 (UTC)
@Pmlineditor:, add some ip he has used:

please delete all contributions of the ip above in Min Nan Wikipedia (zh-min-nan:). he create thousands of articles in very short time, maybe he is a spam.--122.90.97.123 11:13, 2 November 2015 (UTC)

@122.90.97.123: I could nuke all of them, but I'm wondering whether it would be easier for local admins to handle this since it'll be easier for them to keep track of him. If they want stewards / GSes to handle this, then I'll just delete them myself. Regards, --Pmlineditor (t · c · l) 14:08, 2 November 2015 (UTC)

mass creation vandalism in Min Nan Wikipedia[edit]

Moved from Meta:Requests for help from a sysop or bureaucrat.--Syum90 (talk) 11:01, 2 November 2015 (UTC)

Some IP from America, such as 107.107.188.4 and ‎107.92.61.13 (I'm sure is the same man), creation a lot of integer articles. He has been warned by the administrator Luuva and me, but he ignored, and continue his mass creation vandalism. because is floating IP, the administrator have no method to against his vandalism (see here). please block him, and delete all his vandalism in that article. thanks.--122.90.89.193 15:44, 31 October 2015 (UTC)


77.103.108.40[edit]

This user has been trying to put unconfirmed video game release dates on en:Yakuza 5 article multiple times despite multiple reverts and the last edit it did on the article looked like it was done by a bot. And this user has been making unconstructive edits to other articles as multiple notifications are shown in the user's talk page. - PhilS1990 (talk) 15:52, 25 October 2015 (UTC)

Only edited on the English Wikipedia, so you should report this IP there. Reports on Meta should be related to IP's / users who are vandalizing on many wiki's. --Stryn (talk) 15:56, 25 October 2015 (UTC)

Aboufawwaz[edit]

This user is copying and pasting the same piece of text (in Zulu according to Google Translate) to numerous wikis (25 that I've seen so far, see the history of d:Q21183530). When I marked some of the pages for deletion, they removed the deletion template, see chr:Special:Diff/38653 and chy:Special:Diff/22529. The user has already been blocked on the English Wikipedia as a CheckUser-confirmed sockpuppet (see en:Category:Wikipedia sockpuppets of Charbelfvkc) and en:Charbel Habchi has been deleted 4 times already over the past 6 weeks (and this user's talk page has two speedy deletion notifications for the page, so I assume they keep recreating the page). - Nikki (talk) 13:39, 25 October 2015 (UTC)

Ardahanmarkaköykora[edit]

Cross-wiki spam, at the moment on ku. and en.wiki. Earlier today the same contents came from 85.97.39.191 [SULinfo] – [cross-wiki edits]. Further investigation could be needed, as similar content was inserted by Yazargazeteci [SULinfo] – [cross-wiki edits] on tr.wiki three years ago.--Formica rufa (talk) 19:58, 26 September 2015 (UTC)

The Man in Question[edit]

Hi there,
the User:The Man in Question unfortunately made "corrections" to a biological species name in several wikis. See: his talk page. He changed the correct Mustela eversmanii (see Wikispecies page for scientific references) to Mustela eversmanni (which is a known misspelling). I reverted his edits already in wikispecies, dewiki and enwiki. Please help! Thank you --Murma174 (talk) 15:30, 20 September 2015 (UTC)

Meanwhile I reverted several edits manually in some more WPs and in Commons:Category:Mustela_eversmanii, which caused inconsistencies in other WPs. Ther are a couple of WPs left, where I don't have the user rights (itwiki, eswiki). --Murma174 (talk) 11:36, 24 September 2015 (UTC)

178.235.108.150[edit]

Cross-wiki spammer. --WTM (talk) 21:13, 27 June 2015 (UTC)

178.158.16.216[edit]

178.158.16.216 cross-wiki-contribsIP inforobtexgblockglist Cross-wiki vandalism and cross-wiki spam. --Максим Підліснюк (talk) 17:38, 10 June 2015 (UTC)

Sheikh Ikram Sic[edit]

Sheikh_Ikram_Sic [SULinfo] – [cross-wiki edits] Vandal-only account. Active on bn.wiki, with an incursion on en.wiki earlier today--Formica rufa (talk) 19:21, 14 May 2015 (UTC)

Stale; no need for action anymore. --MF-W 01:20, 6 October 2015 (UTC)

208.48.241.18[edit]

Cross-wiki vandal:[2], [3],[4],[5],[6], [7], [8]. --Petrov Victor (talk) 19:15, 13 May 2015 (UTC)

Потужний львівський танчик[edit]

Cross-wiki vandal page moves. --Thestraycat57 (talk) 02:43, 20 April 2015 (UTC)

Doesn't seem to be a cross-wiki vandal. Only vandalized on shwiki and already blocked locally there. --Stryn (talk) 05:20, 20 April 2015 (UTC)

Sofia Lindberg[edit]

global advertising her website konto-report. See also the files uploaded to commons where she places links and "source information" to the specific website. --Pentachlorphenol (talk) 20:58, 23 March 2015 (UTC)

90.35.234.92[edit]

Vandalising on multiples pages on chwiki. Thanks. Thibaut120094 (talk) 14:27, 19 March 2015 (UTC)

‎69.178.193.150[edit]

Andromède75[edit]

Account created only for voting on Merchandise_giveaways/Nominations, probable sock-puppet. Orignally from the French WP, no other edit for the last 3 years. --Yann (talk) 16:25, 11 May 2015 (UTC)

Yandbcxtci[edit]

Spam on userpage since Dec 26... seems to be no active administrators.... (page) --Atcovi (Talk - Contribs) 00:10, 31 December 2015 (UTC)

Deleted by Matiia, thanks! --Atcovi (Talk - Contribs) 14:24, 31 December 2015 (UTC)


Richard923888[edit]

This user is active recently on Classical Chinese wikipedia, He creates articles in Mandarin which is not allowed in Classical Chinese wikipedia and uses simplified Chinese which is also not permitted according to the basic rules of Classical Chinese wikipedia. He asks what is the meaning of Classical Chinese because he is not able to distinguish Mandarin and Classical Chinese. Since the Classical Chinese wikipedia has only 1 admin and is not active for several years, I am not able to do anything to prevent this user from creating more articles of Mandarin or violating the rules of this wikipedia.

--損齋 (talk) 21:05, 22 January 2016 (UTC)

Iliev[edit]

Steward. --Iliev2 (talk) 12:16, 30 January 2016 (UTC)

Long-term, recurrent vandalism[edit]

2602:30A:C04E:1400:8CBA:C520:6F13:EECB[edit]

Done; it was Decker and handled with blocks. --MF-W 01:19, 6 October 2015 (UTC)

MS Vandal[edit]

The following user name have been used as sock-puppet for vandal activities.

Anonymous[edit]

User:Anonymous 01:48, 05 September 2015 (UTC +1)

Would appreciate if the common IP can be blocked / mail to me to be blocked. Yosri (talk) 17:29, 11 January 2015 (UTC)

They all (the first 6) edited from different (3) IPs. Some (SibukPolitik and below) last edited way back in 2014 March-April, thus can't be tracked anymore.
Another one: 1MalaysiaGolfDidahulukan [SULinfo] – [cross-wiki edits]. Bennylin 15:12, 11 March 2015 (UTC)

Bitafarhadi[edit]

hi dear - (this is a global vandalism user) (and blocked in any wiki) , he is have any vandalism edit in *.wiki and have any user id Wikipedia:Sockenpuppe = user:Piroz12 ,user:Sarafarzad , user:R tehrani , user:Sarafarzad and used this accounts only for vandalism , in fa.wiki and en.wiki Rollback all edit and blocked , check usered in en.wiki. --Florence (talk) 00:49, 24 November 2014 (UTC)

@Elfix: . this user back with username Sardari b [SULinfo] – [cross-wiki edits] , thanks --Florence (talk) 12:56, 24 November 2014 (UTC)
Yes check.svg Done Elfix 13:14, 24 November 2014 (UTC)
Big Like and Thanks dear --Florence (talk) 13:24, 24 November 2014 (UTC)
hi @Elfix:, sorry he is back with name Tina ramzi [SULinfo] – [cross-wiki edits] with Global Contributions --Florence (talk) 19:56, 8 December 2014 (UTC)
Previously locked.  — billinghurst sDrewth 12:45, 4 January 2015 (UTC)


this user is not need stoped vandalism , plz lock user ip, he is cross-wiki vandal (Wikipedia_sockpuppets_of_Bitafarhadi) , (w:fa:رده:سوءاستفاده‌کنندگان از حساب‌های کاربری زاپاس/Bitafarhadi) thanks --Florence (talk) 00:27, 19 March 2015 (UTC)

needs to keep close watch on 180.234.ABC.XYZ cross wiki vandal edits[edit]

On Marathi language wikipedia I found three vandlising attempts to remove all the content from article mr:w:हितेन तेजवानी (article history). These IPs seem to show Bangladesh origin and making cross wiki edits in low key articles at first glance seeming to be constructive but many of them in reality can not be assured to be so. I contacted Bangali language editor on his talk page in his reply he also complained, he says, " We have also noticed in Bengali Wikipedia that IP addressess (180.234.ABC.XYZ) have been vandalising some of the articles here for quite a long time. I can assure you, no edit war is going on in bn wiki. It is plain vandalism. He is changing the info of the article and providing false information by making mutiple small edits. If he is vandalising in mr wiki also, then I think a global block is needed. "

In another Marathi wikipedia article the IPs played with article names in very different scripts namely telgu and tamil, I went on to request tamil language wikipedian to look in to the issue.

As such (to my knowledge) Bangladesh has a very vibrant and constructive wikimedian community. I am bit surprised with vandalism coming from Bangladesh IPs. With given positive background rest of Bangla wikimedian community I did not use any protectionism or edit filters imidiately locally. If this vandalism continues we will need to take the same seriously. I am reporting here for a close watch on this IP range for cross wiki vandalism and apropriate action if necessary.

Mahitgar (He who knows ,wants to know and and loves to keep others informed) (talk) 16:50, 11 March 2015 (UTC)

The 180.234.0.0/16 seems to be a Bangladeshi provider (Augere Wireless Broadband Bangladesh Limited) and as such would seem likely to be one person on a dynamic IP connection. For such a large range, there is no easy ability to monitor externally to the wiki. It would seem that there will need to be abuse filters applied to manage, or minimise the impact of the vandal. If it becomes problematic then it may need anon only blocking.  — billinghurst sDrewth 00:43, 12 March 2015 (UTC)

Agree, For most wikis I suppose local edit filters likely to be more effective. And at mr we are capable enough to handle this if it goes further. Before that as such I always prefer to find some way to communicate and convince vandals, so spill over effect can be minimised and we also get time to study the pattern better. I will keep you informed here if any need arises. Thanks and Regards

Mahitgar (He who knows ,wants to know and and loves to keep others informed) (talk) 02:31, 12 March 2015 (UTC)

Australian Telstra/NSW IP addresses[edit]

For the last couple of months, there's been a series of IP addresses from the same ISP/location which have been creating poor quality Wikipedia stubs (sometimes entirely blank) in numerous different languages, most of which are speedily deleted. When pages are deleted, they often recreate them, often multiple times. If they notice pages being nominated for deletion, they remove the deletion template from the page. There have been a few local and global blocks, but their IP address usually changes every day (sometimes more than once), so blocking specific IP addresses doesn't help at all. Is there anything we can do?

Examples:

  • [9] "Mickey Mouse" on kaawiki, deleted four times already and recreated a fifth time.
  • [10] xmfwiki, three pages created, all blank (which I've marked for deletion, so this probably won't be visible for long).
  • [11] "The Simpsons" on kaawiki, where they removed the deletion template from a page they created.
  • [12] history of "Minnie Mouse" on Wikidata, they linked 30 pages, 22 of which have been deleted again.
  • [13] history of "Mickey Mouse" on Wikidata, they linked 63 pages, 36 of which have been deleted again.

IP addresses I've found so far which seem to be the same person:

June:

July:

August:

- Nikki (talk) 13:57, 27 August 2015 (UTC)

2001:8003:2219:0:44F4:269C:7054:B7CB cross-wiki-contribsIP inforobtexgblockglist 2nd
2001:8003:2219:0:A972:13DC:B1D4:374 cross-wiki-contribsIP inforobtexgblockglist 3rd
- Nikki (talk) 14:01, 10 September 2015 (UTC)
2001:8003:2219:0:C165:9034:E4AB:61EC cross-wiki-contribsIP inforobtexgblockglist 4th-6th
2001:8003:2219:0:4C3C:E80E:D5F3:BCD1 cross-wiki-contribsIP inforobtexgblockglist 7th
- Nikki (talk) 13:24, 7 September 2015 (UTC)
2001:8003:2219:0:FC96:2564:1770:B349 cross-wiki-contribsIP inforobtexgblockglist 8th
2001:8003:2219:0:ED33:24E2:4CA1:FB71 cross-wiki-contribsIP inforobtexgblockglist 9th
2001:8003:2219:0:F1C5:6E52:95CA:5EA3 cross-wiki-contribsIP inforobtexgblockglist 10th
- Nikki (talk) 14:01, 10 September 2015 (UTC)
Maybe we could try several rangeblocks. In any case, many thanks for collecting this. I myself recently started an attempt to analyze this guy (which didn't come very far, but the behaviour is very typical: Creates pages with 0 bytes, then adds stuff in a second edit). --MF-W 01:50, 11 September 2015 (UTC)
MF-W: No problem, I hate this sort of behaviour and all the IP address changes just made me more determined to keep track of them. At least we didn't both spend lots of time hunting down all their IP addresses. :) I think range blocks might work. I've noticed that the first four parts of their IPv6 addresses are often the same, and when I look for edits from IP addresses matching the first four parts using the cross-wiki-contribs page, I never see edits from other anonymous users, so the chance of it affecting other innocent users seems like it would be quite low. - Nikki (talk) 15:58, 29 September 2015 (UTC)

New ones since I last updated the list:

- Nikki (talk) 15:58, 29 September 2015 (UTC)
User:Nikki: I globally blocked the range 2001:8003:2000::/38 (it includes all the IPv6 address mentioned in this section) for one month now. Let's see if it works. --MF-W 01:10, 6 October 2015 (UTC)
Yeah, can someone please un-block my account from editing? I was in the middle of working on another article I intend to nominate for FAC. Freikorp (talk) 11:25, 6 October 2015 (UTC)
I've changed the block to anon-only, as was actually originally my intention. --MF-W 00:07, 7 October 2015 (UTC)
MF-W: Thanks for the block. :) I'll let you know if I see them reappear. - Nikki (talk) 15:08, 7 October 2015 (UTC)
MF-W: Now seeing similar edits which started around the 11th from a different set of IPs (same location, but now the ISP is listed as "NSW Department of Education"):
There seem to be other people editing from those though (although lots of it still seems to be vandalism) :/ - Nikki (talk) 02:39, 19 October 2015 (UTC)
Two more: 153.107.97.164 cross-wiki-contribsIP inforobtexgblockglist, 153.107.97.167 cross-wiki-contribsIP inforobtexgblockglist
I've just noticed that enwiki has blocks for all of these IPs (anonymous only, marked as school blocks, some 2 or 3 years long) because there's so much vandalism from them (not just this person here). 153.107.97.164 is blocked at bowiki for creating blank pages (probably this person again), 153.107.97.167 and 153.107.192.203 are also blocked at enwiktionary and 153.107.192.207 is also blocked at enwikibooks. Would it be reasonable to apply the same blocks globally? Picking out some random edits from this year by these IPs which aren't this person here, it's almost entirely bad edits (e.g. pagwiki, simplewiktionary, viwiki, dewiki, enwikivoyage, mediawiki, plwiki, frwiki, enwikibooks, jawiki, cebwiki...) - Nikki (talk) 09:39, 16 November 2015 (UTC)

78.145.34.234, 78.145.190.106, 78.147.118.19[edit]

78.145.34.234, 78.145.190.106 and 78.147.118.19 is a mad and stupid man that he do cross wiki abuse. He despite the Political status of Taiwan, replace the map of Taiwan with the so-called "Taiwan province of PRC" (this picture) again and again in hundreds of wiki projects. he do this in 2013, now I find it, and it takes me a lot of time to revert his cross wiki abuse. I'm shocken that his abuse was not found in these two years. i think he should be blocked forever, and revert all his edit.--122.90.103.79 14:57, 21 September 2015 (UTC)

Long term cross wiki no meanful number articles mass creation[edit]

Long term cross wiki no meanful number articles mass creation (see also above). please delete all no meanful articles he created. I think it's better to set a title blacklist, ban IP and new users to create articles contain numbers, to prevent his mad behavior. the administrator in Min Nan Wikipedia has set a title blacklist (zh-min-nan:MediaWiki:Titleblacklist), but it seems didn't work. --122.90.81.243 10:20, 20 November 2015 (UTC)

Vandalism at ko.wiktionary[edit]

Please protect ko.wiktionary. It has no admin right now. Above IP has attacked this site continuously. The IP has produced meaningless articles. HappyMidnight (talk) 13:16, 1 December 2015 (UTC)

Semenskabrizgalnica and socks at :slwiki[edit]

I'm an admin at :slwiki and have been a target of a persistent harassment campaign for the past few weeks now. I think it started when I indef-blocked the abovementioned user

for violating username rules (the name means "sperm hose"), but it might be a block earlier. Since then he/she abuses open registration by registering insulting/harrassing usernames, writing insults on their user talk pages (mostly targetting me), blanking my user page etc. It's not a big deal to keep blockng them, technically, but it's rather unpleasant to experience. After a few iterations, I started blocking them for harrassment, without allowing registration of a new username, but this person seems to be switching IP addresses, so he/she appears with a new insult every few days.

To illustrate, a non-exhaustive list of blocked usernames:

The last instance is from an hour and a half ago - my full name (mistyped), which I won't advertise here (you can see it from my block log), showing that this person is on a campaign, collecting data about me purposefuly - I don't hide my real name online, but it's not published prominently on-wiki. As I said, not a problem to deal with, but obnoxious. Is there any way to deal with this person more effectively? Perhaps if a checkuser could find his/her internet provider and file an abuse report? I'm open for ideas. Thank you. — Yerpo Eh? 12:19, 19 January 2016 (UTC)

@Yerpo:. I have mailed you. QuiteUnusual (talk) 15:27, 21 January 2016 (UTC)

Richard923888[edit]

This user is active recently on Classical Chinese wikipedia, He creates articles in Mandarin which is not allowed in Classical Chinese wikipedia and uses simplified Chinese which is also not permitted according to the basic rules of Classical Chinese wikipedia. He asks what is the meaning of Classical Chinese because he is not able to distinguish Mandarin and Classical Chinese. Since the Classical Chinese wikipedia has only 1 admin and is not active for several years, I am not able to do anything to prevent this user from creating more articles of Mandarin or violating the rules of this wikipedia.

--損齋 (talk) 21:05, 22 January 2016 (UTC)

Alex9777777[edit]

Global lock (and global abuse filters?) is highly recommended for accounts from en:Wikipedia:Sockpuppet investigations/Alex9777777/Archive (indefblocked in ru-, en-, appeared in uk- and other wikis, now "working" in be- ). --OneLittleMouse (talk) 17:17, 7 February 2016 (UTC)

Yes check.svg Done MBisanz talk 02:09, 9 February 2016 (UTC)