Open main menu
Warning! Please do not post any new comments on this page. This is a discussion archive first created in February 2013, although the comments contained were likely posted before and after this date. See current discussion.

Contents

Requests

Noag070yne@outreach

Status:    Done

as well as

Please consider checking if these are related and if the underlying IP addresses/open proxies can be blocked. Mathonius (talk) 14:55, 1 February 2013 (UTC)

Yes, they're spambots. I can't find any blockable range. They all come from different ranges; although it's confirmed that they're spambots via other technical evidence. Locking all. -- MarcoAurelio (talk) 16:22, 1 February 2013 (UTC)
I'd recommend setting some restriction on user creation over there. Most of the local user creations there are spambots. -- MarcoAurelio (talk) 16:30, 1 February 2013 (UTC)
Create a blacklist? Kevin Rutherford (talk) 21:45, 2 February 2013 (UTC)

Collingwood@en.wikiversity

Poetlister is   Stale. --Shizhao (talk) 06:54, 24 January 2013 (UTC)
Did Poetlister have other accounts? Some of them may be still active. Ruslik (talk) 12:44, 24 January 2013 (UTC)
Yep, he does: link #1 & #2. Keeping this open for now pending an official reply. Trijnsteltalk 23:07, 24 January 2013 (UTC)

  Done. Positive. Account globally locked as per Requests for comment/Global ban for Poetlister. --Millosh (talk) 22:41, 1 February 2013 (UTC)

Thanks for your help. Is someone able to explain a little more how this was confirmed, given that the Poetlister IP was stale? -- Jtneill - Talk 11:07, 4 February 2013 (UTC)
Presently, I am not able to disclose the details. But, I think that the details will be presented in the next couple of weeks. --Millosh (talk) 16:29, 16 February 2013 (UTC)

EmileFran@en.wikiversity

Status:    Done

All of these spambots belong to this group and haven't been locked yet. Please consider investigating and locking them. Thanks, Mathonius (talk) 21:10, 4 February 2013 (UTC)

Related in some cases, but can't think of a range, but they are locked. — T. 06:27, 5 February 2013 (UTC)

two accounts@ko.wikinews

Status:    Done

Completely same spam pattern(Third account is just for reference). Please consider investigating and locking. Thank you, Sotiale (talk) 04:19, 10 February 2013 (UTC)

The following account are   Confirmed and locked:
EugeniaVi
OlauBinkl
MaribelBr
WilsonZar
MarlaVale
WillardCo
SonjaCaste
Ruslik (talk) 15:24, 10 February 2013 (UTC)

大纱布@zhwiki

    • I think both accounts are sockpuppets of the long-term vandal zh:WP:BoldIP, you may ask sysops to block them first. And sleeper check would be helpful. --Makecat 11:05, 10 February 2013 (UTC)
      • 妈陪搞 and 田伟博 appear to be same, while 大纱布 - not. Pundit (talk) 07:20, 11 February 2013 (UTC)

Footwiks@ko.wikipedia

Footwiks and Wikiholicman are   Confirmed.
Kyumma is   Inconclusive, rest are   Stale. --Bencmq (talk) 13:43, 13 February 2013 (UTC)

Herzbrennen@zh.wikinews

  Confirmed--Vituzzu (talk) 14:51, 14 February 2013 (UTC)

而我不知道啥皮九是誰@zh.wikipedia (2)

copy/pasted from section 而我不知道啥皮九是誰@zh.wikipedia above

Status:    Done
Some more:
Impersonation and vandalism. --Makecat 05:01, 24 January 2013 (UTC)
Add:

--Shizhao (talk) 06:19, 24 January 2013 (UTC)

New ones:
--Makecat 07:26, 25 January 2013 (UTC)
  Done you have all the accounts. I am not sure what a CU especially proves, beyond it looks like a couple of different users abusing the system from several ranges of IP addresses. — billinghurst sDrewth 11:58, 18 February 2013 (UTC)

Hitshelps@zh.wikipedia

Status:    Done

Hitshelps was blocked for 3 months, because he repeatedly added incorrect information, created hoax articles and replacing images with unrelated ones. After his block, several very similar accounts appeared. According to w:Wikipedia:Sockpuppet investigations/Hitshelps on English Wikipedia, it's possible that Hitshelps used the account 王明毅. This user may also related to #而我不知道啥皮九是誰@zh.wikipedia (2) above. --Makecat 05:07, 1 February 2013 (UTC)

  • Withdrawn. User has admitted that he has used sockpuppets to evade block. --Makecat 06:27, 3 February 2013 (UTC)
    •   Not done - Withdrawn. -- Avi (talk) 07:14, 3 February 2013 (UTC)
      • Reapply for CU because vandalism continues, and a suspected sockpuppet 李鸿升 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser) (similar vandalism acts) of him created a long-term abuse case for him. --Makecat 08:10, 5 February 2013 (UTC)
        • The list looks conclusive, though missing the account PxdJulia, it pops up far too regularly in the range checks, and in this case it looks directly associated.
        • 封你九天 and Zhumingstyle are related to each other, though it is uncertain whether they are related to the other set.
        otherwise there is nothing that stimulating, just confirmatory to the expectations. — billinghurst sDrewth 12:07, 18 February 2013 (UTC)

POTTER6278@zh.wikipedia

Yes, they look directly related. — billinghurst sDrewth 12:11, 18 February 2013 (UTC)

Katharina

Status:    Done

There's a non-sul account/spambot named "Katharina". So far, it has spammed at nl.wikibooks and en.wikiversity. I'd like to know if the other recently created accounts with this username are related. Mathonius (talk) 23:14, 15 February 2013 (UTC)

  Done at enwikiversity and nlwikibooks. I sent the results on the checkuser mailing list. However, I'm not comfortable with blocking/checking the other ones right now, because we lack data and proofs. Regards, -- Quentinv57 (talk) 08:41, 16 February 2013 (UTC)

Fexinshenfd@... & Dexinshenfc@en.wikiversity

Status:    Done

These spambots from the English Wikiversity are obviously related, judging by their usernames and the way they've tried to spam. Are there any open proxies or IP addresses here that can be blocked? Mathonius (talk) 13:26, 17 February 2013 (UTC)

  Confirmed and   Locked. Ruslik (talk) 19:35, 17 February 2013 (UTC)

愛莎@zh.wikipedia

文學主子 and Unfairking are   Stale. Other account that are   Confirmed include:
Fuhp2009
春卷柯南
北極企鵝觀賞團
陳麗珍告狀英國威廉
Kiddy 19822003
SoHome
Horaceho
Flowers kingdom
Jackac
奇俐
義茜
傑樂
友鼠
愛莎
獵奔
TYC
YWong
Kayat941183
陳麗珍皇后法國亨利王帝
Izumiakazawa
陳麗珍王后英國帥王安德魯
Makivan1234567890
陳麗珍東皇后
陳麗珍帥后湯魯告斯帥王
陳麗珍瑞典皇后
陳麗珍西王后
Brucewong
Phatomof
宇宙滾豆
Wilsonyung
稀兔
魯塔利
諾卜
舒特
酷爪虎
Apple v
SunnyHUANGXiaolin
法蘭克斯洛斯
鄧子謙
Marvel Avengers Alliance
Ruslik (talk) 14:58, 19 February 2013 (UTC)
Seriously? Well, 春卷柯南 and 北極企鵝觀賞團 should not be the same person. Maybe they are sharing the same mobile public IP or whatever.--Yhz1221 (talk) 19:45, 19 February 2013 (UTC)
And TYC, Jackac, SoHome etc.--Shizhao (talk) 02:57, 20 February 2013 (UTC)
All accounts mentioned by you share exactly the same IP address (apparently a Wi-Fi hotspot in Hong Kong). Their UAs heavily overlap. So, from the CU point of view they are virtually indistinguishable. Ruslik (talk) 10:09, 20 February 2013 (UTC)
see en:Wikipedia:Sockpuppet investigations/Marxistfounder,Kayat941183 here--Shizhao (talk) 02:45, 20 February 2013 (UTC)

Copyangry7fcvc@zh.wikipedia

The following accounts are   Confirmed:
Djruwqqqs
Copyangry7fcvc
Ikaridon
Clerkwheeltrie
Quickbest5t6
Todaythink231499
Keysagain148
Plusspacere
Ruslik (talk) 11:30, 20 February 2013 (UTC)

Kstrjtcols@species

Status:    Done

Are these spambots related? Are there any open proxies that can be blocked? Mathonius (talk) 22:56, 20 February 2013 (UTC)

They are related, but it's not clear whether any of the IPs are open proxies. -- Mentifisto 16:04, 21 February 2013 (UTC)

Impersonator on zh.wikipedia

Everyone except Makehoax is confirmed as the same person. Makehoax is a sockpuppet of someone already blocked locally. --Bsadowski1 (talk) 04:12, 25 February 2013 (UTC)

Dikirbaratpahang@ms.wikipedia

The list of   Likely socks:
Dikirbaratpahang
Musimelection001
Pancungdayung
Aku cunla
Anakjebat
Kukukakiku
Coklatbasi
Jeritsenyap
Ameba parasit
Adakah aku UMNO
Panasaran di hari mengundi
Selangorkinimaju is   Possible. Ruslik (talk) 19:14, 25 February 2013 (UTC)
Thanks. ...Aurora... (talk) 06:44, 26 February 2013 (UTC)

M79i10pw76p@mediawiki.org

Status:    Done

Are these pattern spambots related? Are there any open proxies to be blocked here? Mathonius (talk) 12:00, 26 February 2013 (UTC)

Also found some matching this pattern at Commons and Wikisource:
I've filed a local CU request at Commons, see commons:Commons:Requests for checkuser/Case/Pp91gs82e7. Mathonius (talk) 12:10, 26 February 2013 (UTC)
And also at the English Wikipedia, see en:Wikipedia:Sockpuppet investigations/K8wdfg1y2u. Mathonius (talk) 12:15, 26 February 2013 (UTC)
  Confirmed and   Locked.
Just a classic wave of Chinese spambots.
FYI, here are other related matches : Y8mytt0fj, Wanjq1ha, Bcko106zef -- Quentinv57 (talk) 12:59, 26 February 2013 (UTC)