Jump to content
Wikimedia Meta-Wiki

Vandalism reports

From Meta, a Wikimedia project coordination wiki
This is an archived version of this page, as edited by Psychonaut (talk | contribs) at 15:34, 15 September 2014 (→‎Long-term, recurrent vandalism: moving report on Beleiutz from archive; still very much active and has been for years...). It may differ significantly from the current version .
Vandalism reports
Before reporting, please take note of the following premises:
Most Wikimedia wikis are able to deal with vandalism on their own. This page is intended only for certain reports
Reporting requirements
  • The username(s) or IP address(es) of the offenders.
  • A description of their vandalism (spamming, adding junk, removing legitimate text, etc), preferably with diffs to examples.
  • The Wikimedia wikis affected.
  • Suggestions for monitoring strategies, blocks etc.

When reporting please use informative headings like: 

=== username(s), IP address ===
*{{luxotool|IP address}} <!-- for IP addresses -->
*{{sultool|Username}} <!-- for usernames -->
Description, evidence, diffs, etc. --~~~~
Note on spam
  • If the spamming is cross-wiki, malware sites, repeated or severe, please report it to the spam blacklist.
Related pages
Notice

If the username is clearly offensive, libellous or contains private information do NOT post it here. Email the private OTRS queue for stewards: stewards@wikimedia.org - Thank you.

Archives & subpages
Cross-wiki requests
Meta-Wiki requests

Current cross-wiki vandalism

Please place new reports at the top of this section. Thank you.

Fahmi muhyiddin

Completely broke the front page of the IEG Grants page and any other page by adding nonsense to the "Light Grey" color template here on Meta with these edits: [1] [2]. I wasn't able to find another venue on meta to report obvious disruption like this, but I apologize if this belongs in a more appropriate venue. --I JethroBT (talk) 06:31, 7 September 2014 (UTC) [reply ]
Not exactly vandalism. Looks like a confused user in the wrong wiki. Anyway, RFH is the local venue for reporting meta-related stuff but this page also works since many meta admins have this page on their watchlist. --Glaisher (talk) 11:04, 7 September 2014 (UTC) [reply ]

Yul07vazqu

SPAM-account or SPAM-BOT. Same change to different projects and languages. --178.4.178.152 09:57, 6 September 2014 (UTC) [reply ]
Done. Account locked. -- Tegel (Talk) 10:16, 6 September 2014 (UTC) [reply ]

81.229.81.120

Done. Thanks for reporting. -- Tegel (Talk) 21:25, 27 August 2014 (UTC) [reply ]

120.56.215.156

Done. Thanks for the report. -- Tegel (Talk) 17:34, 27 August 2014 (UTC) [reply ]

promo pushing Brandon Richardson

Acounts:

IPv4 address:

IPv6 addresses, all from 2602:30a:2e55:c520::/64 range:

These accounts and IP addresses have been used (most of them solely) to promote the actor Brandon Richardson cross-wiki since March this year, flagging it as a featured article on pt:wiki ([3]), and referring to the non-existant English article as the source for translation (e.g. [4]). Some of the accounts have been blocked on one or two wikis already, because of being a "Brandon Richardson vandal" ([5]), for block evasion and/or referring to en:User:Danny.ESQ ([6], [7]; Danny.ESQ was blocked in 2012 for the same reasons), or generally using multiple accounts already ([8], [9] **, [10], [11], [12], [13], [14], [15], [16], [17], [18]). One of the accounts was blocked just yesterday (**) but I wasn't sure of any follow-up. With kind regards — Mar(c). 07:47, 31 July 2014 (U T C )

Since 2012 actually: w:Wikipedia:Sockpuppet investigations/Danny.ESQ/Archive. --Glaisher (talk) 08:15, 31 July 2014 (UTC) [reply ]
Yes, I mentioned that link too. The accounts and IPs listed all edited/created the current articles (cross-wiki) and the wikidata entry d:Q15980114, but there's the obvious duck connection indeed. With kind regards — Mar(c). 09:42, 1 August 2014 (U T C )

Significant issue, all aligned accounts from my investigation, with links being added to programs/movies/etc. Should all be deleted IMNSHO and I have started some of that notification. I also see these accounts that are aligned

— billinghurst sDrewth 01:03, 24 August 2014 (UTC) [reply ]

Articles at WPs 

 Akan
 Ænglisc
 Deutsch
 Español
 Français
 Kongo
 Português
 Svenska
 Wikidata

Previously deleted at WPs 

 English
 Simple
 Japanese
 Dutch
 Bm
 Tet

— billinghurst sDrewth 01:23, 24 August 2014 (UTC) [reply ]

Also suspected editing accounts

which participated in deletion conversations at w:en:Wikipedia:Articles_for_deletion/Log/2014_August_2#Prince Richardson

The article was also deleted in May following a AfD on frwiki (fr:Discussion:Brandon Richardson/Suppression). Litlok (talk) 10:31, 24 August 2014 (UTC) [reply ]
Articles have continued to be recreated, in same name or now with a slight variation. New account Don718. IP addresses blocked, title blacklist to be put in place, and watchers for small wikis. — billinghurst sDrewth 09:10, 30 August 2014 (UTC) [reply ]
@Bsadowski1: --Rs chen 7754 16:37, 30 August 2014 (UTC) [reply ]

Current vandalism. Self-promotional pages + 3RR. No active local admins on es.wikisource. I request an provisional Steward/GS action. --Alan (talk) 12:14, 8 September 2014 (UTC) [reply ]

Now it's x-wiki (ie: tswiki). Alan (talk) 12:17, 8 September 2014 (UTC) [reply ]
(Edit conflict.) Blocked for 2 hours on es.ws. Vogone (talk) 12:18, 8 September 2014 (UTC) [reply ]

Long-term, recurrent vandalism

Beleiutz

For the past few years a user has been using multiple accounts to add promotional language and copyright-violating images to Wikipedia articles on Romanian celebrities. He is active on a large number of Wikimedia projects: most prominently on English Wikipedia, Romanian Wikipedia, and Wikimedia Commons, but also on several other Wikipedias (German, French, Spanish, etc.). He has become particularly persistent over the past six months. Cross-wiki coordination of efforts to curb the disturbance would be useful.

The oldest account we're aware of is en:User:Beleiutz. On the English and Romanian Wikipedias he has repeatedly stated that his name is Vlad Mateescu and that he represents the Walt Disney company, Pinewood Shepperton, the Romanian Copyright Office, and other private and public organizations [19] [20] [21] [22] [23] [24]. Despite this he has refused to provide any evidence that he holds the copyright to the images he uploads (many of which appear to be found on the web or are television stills which Disney or Pinewood Shepperton wouldn't own the rights to anyway). Web searches for this name turn up profiles, interviews, and blog posts where he claims to be a company director, supervisor, or other official representative of many other organizations, including Warner Bros., Pixar, Paramount Pictures, Universal Studios, and even the Wikimedia Foundation! The attempts to impersonate WMF officials offsite were reported to the WMF, and it looks like the sites have now been taken down, though I wouldn't be surprised if they reappear in the future.

Here's a listing of the known accounts:

He also edits from a wide range of IPv4 and IPv6 addresses, though lately it's usually been IPv6.

A possibly incomplete list of past noticeboard reports and administrators'/bureaucrats' discussions:

The following characteristics can be used to spot the sockpuppets:

  • They are concerned exclusively with articles on Romanian celebrities and the films and TV shows the appear in.
  • New articles, and textual additions to existing articles, tend to be strongly promotional in tone.
  • They make repeated attempts to upload and link copyright-infringing images, often giving falsified source and licensing information. Sometimes they create Flickr-washing accounts to evade detection of the copyright infrinement.
  • Their edit summaries are usually strings of nonsense characters, or (if in English) brief, vague, and grammatically incorrect (e.g., "improve Delia article").
  • They make extensive use of RefLinks, particularly with the IPv6 accounts.
  • They have the annoying habit of wikilinking common words which shouldn't be wikilinked.
  • Lately the accounts do not communicate. As soon as one sock is discovered, it is abandoned and a new one is created.

—Psychonaut (talk) 15:34, 15 September 2014 (UTC) [reply ]

AltStyle によって変換されたページ (->オリジナル) /