Vandalism reports

From Meta, a Wikimedia project coordination wiki
Jump to: navigation, search
Vandalism reports
Before reporting, please take note of the following premises:
Most Wikimedia wikis are able to deal with vandalism on their own. This page is intended only for certain reports
Reporting requirements
  • The username(s) or IP address(es) of the offenders.
  • A description of their vandalism (spamming, adding junk, removing legitimate text, etc), preferably with diffs to examples.
  • The Wikimedia wikis affected.
  • Suggestions for monitoring strategies, blocks etc.

When reporting please use informative headings like:

=== username(s), IP address ===
*{{luxotool|IP address}} <!-- for IP addresses -->
*{{sultool|Username}} <!-- for usernames -->
Description, evidence, diffs, etc. --~~~~
Note on spam
  • If the spamming is cross-wiki, malware sites, repeated or severe, please report it to the spam blacklist.
Related pages
Notice
If the username is clearly offensive, libellous or contains private information do NOT post it here. Email the private OTRS queue for stewards: stewards-at-wikimedia.org - Thank you.
Archives & subpages
Vandalism reports Vandalism reports/Archive 1 Vandalism reports/Archive 2
Vandalism reports/Archive 3 Vandalism reports/Archive 4 Vandalism reports/Archive 5
Vandalism reports/Archive 6 Vandalism reports/Archive 7 Vandalism reports/Beleiutz
Vandalism reports/Beleiutz/Accounts Vandalism reports/Beleiutz/Articles Vandalism reports/BogaertB
Vandalism reports/Unknown
Cross-wiki requests
Meta-Wiki requests

Current cross-wiki vandalism[edit]

Please place new reports at the top of this section. Thank you.

Gmaildamn[edit]

Vandal at Cantonese Wikipedia. Because Gmaildamn have published a vandalism redirect title like Fuckfuckfuckfuckfuckfuckfuck and have created 2 empty pages in his user and talk page in Cantonese Wikipedia. And also he is an imappopriate user name.--WKDx417 (talk) 01:58, 27 August 2015 (UTC)

Cantonese Wikipedia have active local admins who have already deleted this page.--Syum90 (talk) 12:15, 27 August 2015 (UTC)
That's the second time for user Gmaildamn made vandalism article again (zh-yue:唔畀人身攻擊). Gmaildamn have copy-and-pasted the window frame word (likely some nonsence words) in wikipedia at today. I have seen his user name. "damn" is a dirty word in English. I think "Gmail" was making spams in his name.--WKDx417 (talk) 03:53, 29 August 2015 (UTC)

Jozsibacsi19[edit]

Vandal un huwikibooks. He and his sockpuppets have been blocked on huwiki by local admins and by Stryn on huwikibooks for an indefinite time. However he revealed the IRL names of some of the huwiki editors and admins. Can someone please hide these pages at his/her first convenience? This and this. Thx. Csigabi (talk) 08:54, 22 July 2015 (UTC)

Hi, there are some active local admins there on hu.wb, please request it to them. Regards.--Syum90 (talk) 09:26, 22 July 2015 (UTC)

I already did. Apparently they are not available right now. Thanks anyway. Csigabi (talk) 09:39, 22 July 2015 (UTC)

Symbol wait.svg Doing... @Csigabi: I've contacted with Billinghurst, and he's managing this case.--Syum90 (talk) 09:52, 22 July 2015 (UTC)

@Syum90: Thanks, I am followong the progress. Normally we could wait for the local admins' actions but IRL data are too sensitive so they should be removed as soon as possible. Csigabi (talk) 09:56, 22 July 2015 (UTC)

@Billinghurst: Thanks for your quick actions. I really appreciate them. Csigabi (talk) 10:02, 22 July 2015 (UTC)

Yes check.svg Done by Billinghurst.--Syum90 (talk) 10:21, 22 July 2015 (UTC)

Ternohovha[edit]

See Special:CentralAuth/Ternohovha. --Максим Підліснюк (talk) 18:05, 13 July 2015 (UTC)

Yes check.svg Done, thanks for reporting. --Stryn (talk) 18:11, 13 July 2015 (UTC)

159.224.160.157[edit]

I've deleted many of its creations and blocked it on several wikis; I've also requested its global block.--Syum90 (talk) 13:44, 7 July 2015 (UTC)
Yes check.svg Done Globally blocked by QuiteUnusual.--Syum90 (talk) 08:24, 8 July 2015 (UTC)

Shenzibanzaied[edit]

The vast majority of these edits are on ladwiki, though there are some elsewhere. It's a little hard to describe completely, because it seems to be mostly mischief-making. For example, on ladwiki, a number of words have "u" converted to "v", as if this were Latin, rather than Ladino. Others show small spelling changes, frequently similar to ones common in the language, but just not quite right.
This becomes a little clearer to see in the other two wikis where there are multiple edits: scowiki and eswiki.

  • In scowiki, on the page sco:Plant and sco:Cake, this is pretty easy to see.
  • On the page es:Gallactorrea, s/he adds a fact that is correct (it can happen to males). But s/he adds it in a grammatically shaky fashion—and removes a perfectly good reference in the process.

Even though this vandalism isn't really "in your face", I'm pretty convinced that none of this user's edits are valid at all. --StevenJ81 (talk) 20:27, 6 July 2015 (UTC)

Blocked for two weeks on ladwiki. Reverted all vandalism cross-wiki. StevenJ81 (talk) 16:02, 13 July 2015 (UTC)

Robertrodrigo[edit]

Cross-wiki spammer. Thanks in advance. --TheStrayCat (talk) 21:12, 30 June 2015 (UTC)

Yes check.svg DoneDerHexer (Talk) 21:23, 30 June 2015 (UTC)

178.235.108.150[edit]

Cross-wiki spammer. --WTM (talk) 21:13, 27 June 2015 (UTC)

178.158.16.216[edit]

178.158.16.216 cross-wiki-contribsIP inforobtexgblockglist Cross-wiki vandalism and cross-wiki spam. --Максим Підліснюк (talk) 17:38, 10 June 2015 (UTC)

Sheikh Ikram Sic[edit]

Sheikh_Ikram_Sic [SULinfo] – [cross-wiki edits] Vandal-only account. Active on bn.wiki, with an incursion on en.wiki earlier today--Formica rufa (talk) 19:21, 14 May 2015 (UTC)

208.48.241.18[edit]

Cross-wiki vandal:[1], [2],[3],[4],[5], [6], [7]. --Petrov Victor (talk) 19:15, 13 May 2015 (UTC)

Потужний львівський танчик[edit]

Cross-wiki vandal page moves. --Thestraycat57 (talk) 02:43, 20 April 2015 (UTC)

Doesn't seem to be a cross-wiki vandal. Only vandalized on shwiki and already blocked locally there. --Stryn (talk) 05:20, 20 April 2015 (UTC)

Sofia Lindberg[edit]

global advertising her website konto-report. See also the files uploaded to commons where she places links and "source information" to the specific website. --Pentachlorphenol (talk) 20:58, 23 March 2015 (UTC)

90.35.234.92[edit]

Vandalising on multiples pages on chwiki. Thanks. Thibaut120094 (talk) 14:27, 19 March 2015 (UTC)

‎69.178.193.150[edit]

Andromède75[edit]

Account created only for voting on Merchandise_giveaways/Nominations, probable sock-puppet. Orignally from the French WP, no other edit for the last 3 years. --Yann (talk) 16:25, 11 May 2015 (UTC)

Long-term, recurrent vandalism[edit]

2602:30A:C04E:1400:8CBA:C520:6F13:EECB[edit]

96.228.244.95[edit]

Still active in various wikipedia versions. Also known as 63.92.225.57 cross-wiki-contribsIP inforobtexgblockglist, the same vandalism from both IPs. --mfb (talk) 09:36, 28 October 2014 (UTC)
..and with IP 66.194.104.5 cross-wiki-contribsIP inforobtexgblockglist. I have been reverting those edits for many days now.... --Hemuska (talk) 12:04, 29 October 2014 (UTC)
The section got archived but he is still active with his main IP, always the same type of vandalism. --mfb (talk) 09:47, 23 January 2015 (UTC)
I globally blocked it now for 6 months. --MF-W 15:35, 23 January 2015 (UTC)

MS Vandal[edit]

The following user name have been used as sock-puppet for vandal activities.

Would appreciate if the common IP can be blocked / mail to me to be blocked. Yosri (talk) 17:29, 11 January 2015 (UTC)

They all (the first 6) edited from different (3) IPs. Some (SibukPolitik and below) last edited way back in 2014 March-April, thus can't be tracked anymore.
Another one: 1MalaysiaGolfDidahulukan [SULinfo] – [cross-wiki edits]. Bennylin 15:12, 11 March 2015 (UTC)

Beleiutz[edit]

See Vandalism reports/Beleiutz for current or recent claimed activity --Abd (talk) 14:45, 16 September 2014 (UTC)

Bitafarhadi[edit]

hi dear - (this is a global vandalism user) (and blocked in any wiki) , he is have any vandalism edit in *.wiki and have any user id Wikipedia:Sockenpuppe = user:Piroz12 ,user:Sarafarzad , user:R tehrani , user:Sarafarzad and used this accounts only for vandalism , in fa.wiki and en.wiki Rollback all edit and blocked , check usered in en.wiki. --Florence (talk) 00:49, 24 November 2014 (UTC)

@Elfix: . this user back with username Sardari b [SULinfo] – [cross-wiki edits] , thanks --Florence (talk) 12:56, 24 November 2014 (UTC)
Yes check.svg Done Elfix 13:14, 24 November 2014 (UTC)
Big Like and Thanks dear --Florence (talk) 13:24, 24 November 2014 (UTC)
hi @Elfix:, sorry he is back with name Tina ramzi [SULinfo] – [cross-wiki edits] with Global Contributions --Florence (talk) 19:56, 8 December 2014 (UTC)
Previously locked.  — billinghurst sDrewth 12:45, 4 January 2015 (UTC)


this user is not need stoped vandalism , plz lock user ip, he is cross-wiki vandal (Wikipedia_sockpuppets_of_Bitafarhadi) , (w:fa:رده:سوءاستفاده‌کنندگان از حساب‌های کاربری زاپاس/Bitafarhadi) thanks --Florence (talk) 00:27, 19 March 2015 (UTC)

The recent wave of Wikimedia spam[edit]

How and why it's done and how it can be stopped.

The recent wave of linkspam on Wikimedia projects follows a very common pattern:

  • a new account is created
  • a new page is created
  • the page is filled with a good amount of text (typically 6 to 8 lines) with a URL at the end or in the middle

The objective of these spammers is to trick Google's anti-linkspam algorithms in counting these links as valid links, thus elevating the target page in search results.

Why is this done on Wikimedia projects.

  • Wikimedia pages score high in search results themselves, which makes Google algorithms attach a high add value to each target page
  • New Wikimedia page are indexed by Google almost instantly (try it!), which means that even if the linkspam page itself is deleted within a few hours, the positive Google algorithm effect has already happened and will remain valid for the target site for 1 tot 2 weeks.

How can these spammers create so many new accounts and post so many of these linkspam pages and continue to do it without stopping?

  • The actual spammers are relatively innocent people, lured by email and other spam offering "work from home" (usually indicated as "data entry") jobs with attractive payment promises
  • Once sign up, they get clear instructions on which sites to target, how to create those accounts, and how to post these messages
  • It's not just Wikimedia; comment sections of popular news sites, blogs and forums are targeted as well
  • The sad thing is that the actual spammers typically never earn any money; to earn money they need to send a link to the linkspam pages that they created to the hiring company and one of the conditions for payment is that the page still needs to be up and available after 6 weeks. Obviously this hardly ever is the case.
  • By the time the sucker wakes up to reality and quits his "job", the damage is already done and countless new suckers have been lured in. (A part of the linkspam they post actually points to sites which offer these very "data entry / work from home" jobs.)

What can Wikimedia do about this? It would actually be very simple for Wikimedia to put an end to this once and for all.

  • Today every new article in the main namespace is indexed nearly instantly by Google.
  • If the Wikimedia software were changed to automatically add a <No-Index> tag to every new page, that was automatically removed after (let's say) 3 days, the value of those pages for the spammers drops to zero, and they will soon move on to new grounds.

W\|/haledad (zegt u het maar) 7 feb 2015 19:45 (CET)

I think you're giving the spammers a bit too much credit. They're not that smart... - dcljr (talk) 23:19, 10 March 2015 (UTC)

needs to keep close watch on 180.234.ABC.XYZ cross wiki vandal edits[edit]

On Marathi language wikipedia I found three vandlising attempts to remove all the content from article mr:w:हितेन तेजवानी (article history). These IPs seem to show Bangladesh origin and making cross wiki edits in low key articles at first glance seeming to be constructive but many of them in reality can not be assured to be so. I contacted Bangali language editor on his talk page in his reply he also complained, he says, " We have also noticed in Bengali Wikipedia that IP addressess (180.234.ABC.XYZ) have been vandalising some of the articles here for quite a long time. I can assure you, no edit war is going on in bn wiki. It is plain vandalism. He is changing the info of the article and providing false information by making mutiple small edits. If he is vandalising in mr wiki also, then I think a global block is needed. "

In another Marathi wikipedia article the IPs played with article names in very different scripts namely telgu and tamil, I went on to request tamil language wikipedian to look in to the issue.

As such (to my knowledge) Bangladesh has a very vibrant and constructive wikimedian community. I am bit surprised with vandalism coming from Bangladesh IPs. With given positive background rest of Bangla wikimedian community I did not use any protectionism or edit filters imidiately locally. If this vandalism continues we will need to take the same seriously. I am reporting here for a close watch on this IP range for cross wiki vandalism and apropriate action if necessary.

Mahitgar (He who knows ,wants to know and and loves to keep others informed) (talk) 16:50, 11 March 2015 (UTC)

The 180.234.0.0/16 seems to be a Bangladeshi provider (Augere Wireless Broadband Bangladesh Limited) and as such would seem likely to be one person on a dynamic IP connection. For such a large range, there is no easy ability to monitor externally to the wiki. It would seem that there will need to be abuse filters applied to manage, or minimise the impact of the vandal. If it becomes problematic then it may need anon only blocking.  — billinghurst sDrewth 00:43, 12 March 2015 (UTC)

Agree, For most wikis I suppose local edit filters likely to be more effective. And at mr we are capable enough to handle this if it goes further. Before that as such I always prefer to find some way to communicate and convince vandals, so spill over effect can be minimised and we also get time to study the pattern better. I will keep you informed here if any need arises. Thanks and Regards

Mahitgar (He who knows ,wants to know and and loves to keep others informed) (talk) 02:31, 12 March 2015 (UTC)

Spam[edit]

please check these users global edits:

Thanks. ARASH PT  talk  20:07, 27 March 2015 (UTC)

Yes I saw these user (probably socks) spamming on Indonesian sister projects (Javanese Wikipedia), I haven't blocked it since the report is here maybe locking it is better than locally blocking it on many wikis.--AldNonymousBicara? 20:13, 27 March 2015 (UTC)
I have locked Mosros - it is clearly an SPA dedicated to crosswiki spam. The others are less obvious. QuiteUnusual (talk) 12:55, 10 April 2015 (UTC)

User is using Multiple accounts[edit]

Status:    Not done

On Pashto Wikipedia, I think the ps:user:Khangul is using multiple accounts as sock-puppets to Irritate other users , Remember that the Khangul is also administrator on Pashto Wikipedia but he does not let us work on Wikipedia and always discourage other users, So please Investigate him that Is Khangul using multiple accounts or not? If he is using then I request to block his IP and account Globally--UsmanKhann (talk) 23:18, 9 April 2015 (UTC)

No evidence has been presented to justify a CheckUser. "I think" is not evidence. Future requests should be made at Steward requests/Checkuser and not here. QuiteUnusual (talk) 13:08, 10 April 2015 (UTC)

Cyyycyyy[edit]

Status:    Done

User:Cyyycyyy in classical Chinese Wikipedia, creat personal attacks user pages again and again, or replace other user's talk pages with personal attack sentences written in classical Chinese. see also here.--122.90.105.197 14:11, 15 July 2015 (UTC)

Blocked by Billinghurst for two weeks.--Syum90 (talk) 14:29, 15 July 2015 (UTC)


ATU1972[edit]

Apologies if this is the wrong place to bring this case, but there is an ongoing issue with a COI/SPA sock/meat puppet farm pushing content related to en:Daniel Múgica on both en and es.wikipedia. I was coordinating the response between es and en but I would appreciate some cross-wiki support, it seems like there has to be a better way to do this.

There was a sockpuppet investigation here en:Wikipedia:Sockpuppet investigations/Debora Mugica, the outcome of which was the blocking of DMDHA1967 (talk · contribs) and temporary protection of en:Daniel Múgica and en:Generation X

This same investigation was used in es.wikipedia here as a basis to protect the same articles in Spanish and block:

After these events a new account:

Yesterday a new IP appeared on es.wikipedia: 81.39.202.52 cross-wiki-contribsIP inforobtexgblockglist Inserting the same content in the Spanish article Movida Madrileña here that ATU1972 (talk · contribs) had previously inserted into en.wikipedia here. Same thing has happened in the Ausiàs March article in es.wikipedia here and en.wikipedia here; again content related to Daniel Múgica.

They don't seem to be getting the message. These most recent edits are problematic because even though they have started adding sources in some cases, the sources don't actually mention Daniel Múgica or are things like youtube. Basically more promotion. I could try to fix it but this is getting tiresome and I don't know up to what point one must entertain the promotional aspirations of puppets. I was in contact with Daniel Múgica himself here and have left templates and explanations (as have other users) on other sock/meat pages but so far Mr. Múgica is the only one who has responded, and he said it would not continue, but here we are. Perhaps he doesn't control this most recent activity, I don't know, but look at the similarity in account names....it's quacking. Can someone please look into this? Cheers, Vrac (disc.) 21:07, 4 ago 2015 (CEST)

Thanks Vrac, perfect place for your report. Wondering whether some checkusers at esWP @Bernard, Edmenb, Montgomery: and enWP @AGK, DoRD, NativeForeigner, PhilKnight: can contribute, and look to build a xwiki page to record data. I will look to see what we have on the other wikis, and if we do have that rubbish, we can consider some global filters for the small/medium wikis.  — billinghurst sDrewth 00:35, 5 August 2015 (UTC)
and @Syum90: who may be able to report if they have seen anything from their recent views.  — billinghurst sDrewth 00:37, 5 August 2015 (UTC)
I have added a nascent global tagging filter Special:AbuseFilter/84 though that will not help for either esWP or enWP.  — billinghurst sDrewth 00:47, 5 August 2015 (UTC)
I will be careful! Syum90 (talk) 07:43, 5 August 2015 (UTC)
I've not seen nothing related to this at any small wiki, I ping @Matiia:.--Syum90 (talk) 07:21, 13 August 2015 (UTC)
@Syum90: At this point I am just using this space to document what is happening because luxtool and sultool are very useful for tracking the activity cross-wiki. But since this case has been here for 9 days and no one has done anything with it, I have gone back to dealing with the problems in the individual wikis. There is another SPI opened in enwiki here, as soon as it is dealt with I will take the results to eswiki for them to take care of the accounts in es like I did the first time around here. I'm curious to know why no action was taken in meta, I thought this was for cross-wiki abuse, did I do something wrong with the case? Vrac (talk) 12:53, 13 August 2015 (UTC)

Well, as I can see the case does not seem to affect other wikis out of these 2 wikis for the moment, so I've pinged Matiia for if he has seen something. You're doing good reporting here, but while the problem is located only in these two wikis I do not think any steward perform any action in these large wikis because they only act in large wikis in cases of emergency or cases where there are many wikis involved.--Syum90 (talk) 14:26, 13 August 2015 (UTC)

Ok, I misunderstood. So far this has been limited to enwiki and eswiki, I wouldn't really expect it to go beyond that to other wikis. I could move it to my user space if you want, otherwise I'll keep updating it, like I said the luxtool and sultool have been really helpful. Vrac (talk) 15:38, 13 August 2015 (UTC)

Australian Telstra/NSW IP addresses[edit]

For the last couple of months, there's been a series of IP addresses from the same ISP/location which have been creating poor quality Wikipedia stubs (sometimes entirely blank) in numerous different languages, most of which are speedily deleted. When pages are deleted, they often recreate them, often multiple times. If they notice pages being nominated for deletion, they remove the deletion template from the page. There have been a few local and global blocks, but their IP address usually changes every day (sometimes more than once), so blocking specific IP addresses doesn't help at all. Is there anything we can do?

Examples:

  • [8] "Mickey Mouse" on kaawiki, deleted four times already and recreated a fifth time.
  • [9] xmfwiki, three pages created, all blank (which I've marked for deletion, so this probably won't be visible for long).
  • [10] "The Simpsons" on kaawiki, where they removed the deletion template from a page they created.
  • [11] history of "Minnie Mouse" on Wikidata, they linked 30 pages, 22 of which have been deleted again.
  • [12] history of "Mickey Mouse" on Wikidata, they linked 63 pages, 36 of which have been deleted again.

IP addresses I've found so far which seem to be the same person:

June:

July:

August:

- Nikki (talk) 13:57, 27 August 2015 (UTC)

azb:user:Koroğlu[edit]

azb:user:Koroğlu insulted and attacked me in here and here (Calling me as dictator). He has abused the powers of his administrator here. He also outside of AzbWikipedia has insulted me here. And because of his contempt for others in Wikipedia Farsi block is unlimited here. He also calls sheep one of Wikipedia users here.He remembered his contempt has received several warnings. here here here. According to information, the right to administrator and continue their activity is decided.--Ebrahimi-amir (talk) 05:54, 24 August 2015 (UTC)

Again he has called me and the people of the city of Ardabil a donkey here And other insults that is in this edit.--Ebrahimi-amir (talk) 06:05, 24 August 2015 (UTC)

The problem was solved.--Ebrahimi-amir (talk) 02:51, 27 August 2015 (UTC)