Vandalism reports

From Meta, a Wikimedia project coordination wiki
Jump to: navigation, search
Vandalism reports Archive index
Before reporting, please take note of the following premises:
Most Wikimedia wikis are able to deal with vandalism on their own. This page is intended only for certain reports.
Reporting requirements
  • The username(s) or IP address(es) of the offenders.
  • A description of their vandalism (spamming, adding junk, removing legitimate text, etc), preferably with diffs to examples.
  • The Wikimedia wikis affected.
  • Suggestions for monitoring strategies, blocks etc.

When reporting please use informative headings like:

=== username(s), IP address ===
*{{luxotool|IP address}} <!-- for IP addresses -->
*{{sultool|Username}} <!-- for usernames -->
Description, evidence, diffs, etc. --~~~~
Note on spam
  • If the spamming is cross-wiki, malware sites, repeated or severe, please report it to the spam blacklist.
Related pages
Notice
If the username is clearly offensive, libellous or contains private information do NOT post it here. Email the private OTRS queue for stewards at stewards-at-wikimedia.org or using our wiki email form.
Cross-wiki requests
Meta-Wiki requests
Filing cabinet icon.svg
SpBot archives all sections tagged with {{Section resolved|1=~~~~}} and sections whose oldest comment is older than 7 days. For the archive overview, see Vandalism reports/Archives. The latest archive is located at 2018-02.

Current cross-wiki vandalism

184.147.30.161

  • 184.147.30.161 cross-wiki-contribsSTIP inforobtexgblockglist
  • Hello. This user is doing cross-wiki vandalism in several Wikimedia projects, mainly on birth dates, like this. The user is already blocked on the English Wikipedia for block evasion. I have canceled all the edits in Wikidata. I am beginning to cancel all the other edits. --NicoScribe (talk) 10:58, 10 February 2018 (UTC)
1 week. —MarcoAurelio (talk) 13:52, 10 February 2018 (UTC)
Thank you @MarcoAurelio: in the meantime, I have finished to cancel all the edits. I have also noticed that the ranges 184.146.204.0/24, 184.146.207.0/24, 184.147.28.0/24 and 184.147.30.0/24 have been blocked on the English Wikipedia by Malcolmxl5 for one month. It seems that the user has vandalized a group of articles only on the English Wikipedia since November 2017, cf. these IP from "BACOM - Bell Canada, CA": 184.146.204.11, 184.146.204.122, 184.146.206.100, 184.146.206.103, 184.146.207.38, 184.146.207.74, 184.147.28.56, 184.147.28.100, 184.147.28.200, 184.147.29.65, 184.147.29.85, 184.147.29.185, 184.147.30.119, 184.147.30.178, 184.147.30.181, 184.147.31.76, 184.147.31.235... --NicoScribe (talk) 17:12, 10 February 2018 (UTC)
@MarcoAurelio: today the user has been doing cross-wiki vandalism again with a new IP: 74.12.122.75 cross-wiki-contribsSTIP inforobtexgblockglist, on the same group of articles (mainly about Filipina actresses). I have checked the English Wikipedia: the range 74.12.122.0/24 has also been blocked on the English Wikipedia by Malcolmxl5 for one month. The histories of some articles show many involved IP from "BACOM - Bell Canada, CA" vandalizing only the English Wikipedia 70.31.124.58, 70.31.124.127, 70.31.125.221, 70.31.127.9, 74.12.120.15, 74.12.120.126, 74.12.122.27, 74.12.122.199, 74.12.122.234, 74.12.123.59, or doing cross-wiki vandalism: 70.31.126.177 cross-wiki-contribsSTIP inforobtexgblockglist. --NicoScribe (talk) 19:40, 11 February 2018 (UTC)
Sorry, I missed this thread. I'll have a look onto those ranges. —MarcoAurelio (talk) 19:56, 11 February 2018 (UTC)
I've issued one-month rangeblocks to 184.147.30.0/24, 184.147.28.0/24, 184.146.207.0/24, 184.146.204.0/24 and 74.12.122.0/24. —MarcoAurelio (talk) 20:01, 11 February 2018 (UTC)
@MarcoAurelio: today the user has been doing cross-wiki vandalism again with a new IP: 184.147.31.55 cross-wiki-contribsSTIP inforobtexgblockglist. I have canceled all the edits. I have also found old cross-wiki vandalism from 184.146.207.98 cross-wiki-contribsSTIP inforobtexgblockglist, so I am beginning to cancel all these edits too. --NicoScribe (talk) 09:15, 12 February 2018 (UTC)
I've blocked the new IP, but the range from which this one comes is too large to issue a safe rangeblock globally for now. Some enwiki edit filter expert maybe could draft one to tag the edits from this guy and get them reviewed more quickly, if that's an option. Regards, —MarcoAurelio (talk) 10:14, 12 February 2018 (UTC)
Hi, yes. This is the Bell Canada vandal with host name beginning with toroon4664w who geolocates to Toronto. There was a brief discussion on en.wiki administrator noticeboard a couple of weeks ago and, yes, the IP addresses are too wide to capture them all in one or even a few range blocks but the /24 ranges are narrower and so far have virtually no collateral damage (on en.wiki) so I am blocking these for one month each time the vandal pops up. The vandal will find it more and more difficult to find a range that they are able to use. I’m keeping a record at en:User:Malcolmxl5/Bell Canada vandal. --Malcolmxl5 (talk) 12:33, 12 February 2018 (UTC)
Thank you @Malcolmxl5: I have checked your record page and the list here. I don't know whether you want to update your record page (and adjust your range blocks), but you could:
You have said "The vandal will find it more and more difficult to find a range that they are able to use" (on the English Wikipedia) but it seems that when the vandal sees that his IP is blocked on the English Wikipedia, he does not step back: he just makes cross-wiki vandalism. --NicoScribe (talk) 17:01, 12 February 2018 (UTC)
I’m afraid I am only able to try to protect en.wiki from this vandal. I have no powers to deal with cross-wiki vandalism. --Malcolmxl5 (talk) 18:09, 12 February 2018 (UTC)
@Malcolmxl5: yes, no problem, you are doing a great job with the record page and the range blocks on en.wiki. I was just saying that this user keeps vandalizing somewhere else. Hence we are here, and MarcoAurelio is doing a great job too, by issuing range blocks protecting all the Wikimedia projects. --NicoScribe (talk) 19:28, 12 February 2018 (UTC)

┌─────────────────────────────────┘
MarcoAurelio, the vandal has popped up at 184.146.206.4 cross-wiki-contribsSTIP inforobtexgblockglist. --Malcolmxl5 (talk) 02:51, 13 February 2018 (UTC)

Yes check.svg Done as well. Thanks for reporting. RadiX 03:04, 13 February 2018 (UTC)
Thank you. --Malcolmxl5 (talk) 14:21, 13 February 2018 (UTC)
@MarcoAurelio and RadiX: cross-wiki vandalism again with a new IP: 74.12.120.57 cross-wiki-contribsSTIP inforobtexgblockglist. I am beginning to cancel all the edits. --NicoScribe (talk) 09:36, 14 February 2018 (UTC)
Hello @MarcoAurelio: I am sorry to insist, but the vandal is quite active today (already 201 edits, all canceled). Do not hesitate to issue the block. --NicoScribe (talk) 15:31, 14 February 2018 (UTC)
Hi. Sorry. I'm at thousands of things today. IP blocked. Thanks for reporting. Regards, —MarcoAurelio (talk) 15:33, 14 February 2018 (UTC)
Today, so far, the vandal has attacked only Wikidata, with 70.31.127.139 cross-wiki-contribsSTIP inforobtexgblockglist. --NicoScribe (talk) 16:32, 16 February 2018 (UTC)
And 74.12.121.213 cross-wiki-contribsSTIP inforobtexgblockglist --Malcolmxl5 (talk) 22:59, 16 February 2018 (UTC)

┌─────────────────────────────────┘
On en.wiki, I have enough data to be able to broaden the /24 rangeblocks I have been using to /22 rangeblocks: 70.31.124.0/22, 74.12.120.0/22, 184.146.204.0/22 and 184.147.28.0/22. These have been in place for three days and appear to be doing the job of protecting en.wiki with minimal collateral damage. They are blocked for a month since the vandal has been disrupting en.wiki since November. --Malcolmxl5 (talk) 23:09, 16 February 2018 (UTC)

@MarcoAurelio and RadiX: cross-wiki vandalism again with a new IP: 70.31.126.117 cross-wiki-contribsSTIP inforobtexgblockglist. 102 edits so far, all canceled. --NicoScribe (talk) 11:00, 18 February 2018 (UTC)
Rangeblocked. Thanks. —MarcoAurelio (talk) 11:10, 18 February 2018 (UTC)

Vandalism on Meta-Wiki

Please use Meta:Requests for help from a sysop or bureaucrat (direct report).

Other