Vandalism reports/Archives/2018-02

IP address@sl.wikisource

Some user is vandalizing s:sl:Moje življenje (Ivan Cankar. I deleted and protected the page, but he creates it again. How can protected page be even created by an IP user? --Janezdrilc (talk) 16:04, 5 February 2018 (UTC)

192.121.232.253

Dr.Naba

It appears that this user from Japan has vandalized two small Wikipedias by creating inappropriate pages (such as w:din:うんこ, where the title literally translates as feces), or creating pages and templates directly copied from ja.wikipedia. Both tyv.wikipedia and din.wikipedia don't have any admins to delete the pages. I hope a steward can help cleaning up the mess. (Please refer to the account's global contributions)--Hello903hello (talk) 09:50, 22 February 2018 (UTC)

  Done; deleted on tyv and din wikis; left the others to local staff. —MarcoAurelio (talk) 19:29, 24 February 2018 (UTC)
The users エマニュエル・マクロン, Dr.Naba, マオンクラフト, Inusaku, Kita Chosen, フラッパー, かれぇらいすルナ, アミ族, English Yukkuri-ch, Karipotato, Yukkuriwakka, ゆっくりヌオック and たくっち are also the same guy. —MarcoAurelio (talk) 19:34, 24 February 2018 (UTC)
This section was archived on a request by: —MarcoAurelio (talk) 19:29, 24 February 2018 (UTC)

Many IPs on myvwiki

After being globally blocked under the username

it appears (based on behavior alone) that Decker is (probably) back again today at the Erzya Wikipedia creating hundreds of stubs using an ever-changing list of IP addresses. The last few addresses used (as of the time I started to type up this report) are:

I don't know how many others may have been used today (this covers the last 500 RecentChanges). I have notified an admin on that wiki, but since the activity seems to be still happening as I post this, I decided to give stewards a heads-up about it, too. - dcljr (talk) 00:32, 22 February 2018 (UTC)

Now at:

on both myvwiki and cbk_zamwiki (Zamboanga Chavacano Wikipedia). - dcljr (talk) 03:22, 22 February 2018 (UTC)

Contributions listed above have been deleted. - dcljr (talk) 21:33, 23 February 2018 (UTC)
Based on the IP list above, the following (range)blocks could be set if that'd help:
MarcoAurelio (talk) 19:23, 24 February 2018 (UTC)

184.147.30.161

  • 184.147.30.161 xwiki-contribsxwiki-dateSTIP infoWHOISrobtexgblockglistabuselogipchecker
  • Hello. This user is doing cross-wiki vandalism in several Wikimedia projects, mainly on birth dates, like this. The user is already blocked on the English Wikipedia for block evasion. I have canceled all the edits in Wikidata. I am beginning to cancel all the other edits. --NicoScribe (talk) 10:58, 10 February 2018 (UTC)
1 week. —MarcoAurelio (talk) 13:52, 10 February 2018 (UTC)
Thank you @MarcoAurelio: in the meantime, I have finished to cancel all the edits. I have also noticed that the ranges 184.146.204.0/24, 184.146.207.0/24, 184.147.28.0/24 and 184.147.30.0/24 have been blocked on the English Wikipedia by Malcolmxl5 for one month. It seems that the user has vandalized a group of articles only on the English Wikipedia since November 2017, cf. these IP from "BACOM - Bell Canada, CA": 184.146.204.11, 184.146.204.122, 184.146.206.100, 184.146.206.103, 184.146.207.38, 184.146.207.74, 184.147.28.56, 184.147.28.100, 184.147.28.200, 184.147.29.65, 184.147.29.85, 184.147.29.185, 184.147.30.119, 184.147.30.178, 184.147.30.181, 184.147.31.76, 184.147.31.235... --NicoScribe (talk) 17:12, 10 February 2018 (UTC)
@MarcoAurelio: today the user has been doing cross-wiki vandalism again with a new IP: 74.12.122.75 xwiki-contribsxwiki-dateSTIP infoWHOISrobtexgblockglistabuselogipchecker, on the same group of articles (mainly about Filipina actresses). I have checked the English Wikipedia: the range 74.12.122.0/24 has also been blocked on the English Wikipedia by Malcolmxl5 for one month. The histories of some articles show many involved IP from "BACOM - Bell Canada, CA" vandalizing only the English Wikipedia 70.31.124.58, 70.31.124.127, 70.31.125.221, 70.31.127.9, 74.12.120.15, 74.12.120.126, 74.12.122.27, 74.12.122.199, 74.12.122.234, 74.12.123.59, or doing cross-wiki vandalism: 70.31.126.177 xwiki-contribsxwiki-dateSTIP infoWHOISrobtexgblockglistabuselogipchecker. --NicoScribe (talk) 19:40, 11 February 2018 (UTC)
Sorry, I missed this thread. I'll have a look onto those ranges. —MarcoAurelio (talk) 19:56, 11 February 2018 (UTC)
I've issued one-month rangeblocks to 184.147.30.0/24, 184.147.28.0/24, 184.146.207.0/24, 184.146.204.0/24 and 74.12.122.0/24. —MarcoAurelio (talk) 20:01, 11 February 2018 (UTC)
@MarcoAurelio: today the user has been doing cross-wiki vandalism again with a new IP: 184.147.31.55 xwiki-contribsxwiki-dateSTIP infoWHOISrobtexgblockglistabuselogipchecker. I have canceled all the edits. I have also found old cross-wiki vandalism from 184.146.207.98 xwiki-contribsxwiki-dateSTIP infoWHOISrobtexgblockglistabuselogipchecker, so I am beginning to cancel all these edits too. --NicoScribe (talk) 09:15, 12 February 2018 (UTC)
I've blocked the new IP, but the range from which this one comes is too large to issue a safe rangeblock globally for now. Some enwiki edit filter expert maybe could draft one to tag the edits from this guy and get them reviewed more quickly, if that's an option. Regards, —MarcoAurelio (talk) 10:14, 12 February 2018 (UTC)
Hi, yes. This is the Bell Canada vandal with host name beginning with toroon4664w who geolocates to Toronto. There was a brief discussion on en.wiki administrator noticeboard a couple of weeks ago and, yes, the IP addresses are too wide to capture them all in one or even a few range blocks but the /24 ranges are narrower and so far have virtually no collateral damage (on en.wiki) so I am blocking these for one month each time the vandal pops up. The vandal will find it more and more difficult to find a range that they are able to use. I’m keeping a record at en:User:Malcolmxl5/Bell Canada vandal. --Malcolmxl5 (talk) 12:33, 12 February 2018 (UTC)
Thank you @Malcolmxl5: I have checked your record page and the list here. I don't know whether you want to update your record page (and adjust your range blocks), but you could:
You have said "The vandal will find it more and more difficult to find a range that they are able to use" (on the English Wikipedia) but it seems that when the vandal sees that his IP is blocked on the English Wikipedia, he does not step back: he just makes cross-wiki vandalism. --NicoScribe (talk) 17:01, 12 February 2018 (UTC)
I’m afraid I am only able to try to protect en.wiki from this vandal. I have no powers to deal with cross-wiki vandalism. --Malcolmxl5 (talk) 18:09, 12 February 2018 (UTC)
@Malcolmxl5: yes, no problem, you are doing a great job with the record page and the range blocks on en.wiki. I was just saying that this user keeps vandalizing somewhere else. Hence we are here, and MarcoAurelio is doing a great job too, by issuing range blocks protecting all the Wikimedia projects. --NicoScribe (talk) 19:28, 12 February 2018 (UTC)

┌─────────────────────────────────┘
MarcoAurelio, the vandal has popped up at 184.146.206.4 xwiki-contribsxwiki-dateSTIP infoWHOISrobtexgblockglistabuselogipchecker. --Malcolmxl5 (talk) 02:51, 13 February 2018 (UTC)

  Done as well. Thanks for reporting. RadiX 03:04, 13 February 2018 (UTC)
Thank you. --Malcolmxl5 (talk) 14:21, 13 February 2018 (UTC)
@MarcoAurelio and RadiX: cross-wiki vandalism again with a new IP: 74.12.120.57 xwiki-contribsxwiki-dateSTIP infoWHOISrobtexgblockglistabuselogipchecker. I am beginning to cancel all the edits. --NicoScribe (talk) 09:36, 14 February 2018 (UTC)
Hello @MarcoAurelio: I am sorry to insist, but the vandal is quite active today (already 201 edits, all canceled). Do not hesitate to issue the block. --NicoScribe (talk) 15:31, 14 February 2018 (UTC)
Hi. Sorry. I'm at thousands of things today. IP blocked. Thanks for reporting. Regards, —MarcoAurelio (talk) 15:33, 14 February 2018 (UTC)
Today, so far, the vandal has attacked only Wikidata, with 70.31.127.139 xwiki-contribsxwiki-dateSTIP infoWHOISrobtexgblockglistabuselogipchecker. --NicoScribe (talk) 16:32, 16 February 2018 (UTC)
And 74.12.121.213 xwiki-contribsxwiki-dateSTIP infoWHOISrobtexgblockglistabuselogipchecker --Malcolmxl5 (talk) 22:59, 16 February 2018 (UTC)

┌─────────────────────────────────┘
On en.wiki, I have enough data to be able to broaden the /24 rangeblocks I have been using to /22 rangeblocks: 70.31.124.0/22, 74.12.120.0/22, 184.146.204.0/22 and 184.147.28.0/22. These have been in place for three days and appear to be doing the job of protecting en.wiki with minimal collateral damage. They are blocked for a month since the vandal has been disrupting en.wiki since November. --Malcolmxl5 (talk) 23:09, 16 February 2018 (UTC)

@MarcoAurelio and RadiX: cross-wiki vandalism again with a new IP: 70.31.126.117 xwiki-contribsxwiki-dateSTIP infoWHOISrobtexgblockglistabuselogipchecker. 102 edits so far, all canceled. --NicoScribe (talk) 11:00, 18 February 2018 (UTC)
Rangeblocked. Thanks. —MarcoAurelio (talk) 11:10, 18 February 2018 (UTC)
And another 184.146.205.165 xwiki-contribsxwiki-dateSTIP infoWHOISrobtexgblockglistabuselogipchecker. They are persistent! --Malcolmxl5 (talk) 21:17, 20 February 2018 (UTC)
@MarcoAurelio and RadiX: the vandalisms from yesterday have all been canceled (mainly by Montgomery: thanks). But the vandal is still using the same IP 184.146.205.165 xwiki-contribsxwiki-dateSTIP infoWHOISrobtexgblockglistabuselogipchecker today, so I am beginning to cancel all the edits. --NicoScribe (talk) 06:48, 21 February 2018 (UTC)
@MarcoAurelio and RadiX: the vandal has just switched to 184.146.205.203 xwiki-contribsxwiki-dateSTIP infoWHOISrobtexgblockglistabuselogipchecker. I am beginning to cancel all the edits. --NicoScribe (talk) 09:21, 21 February 2018 (UTC)
Rangeblock set. Thanks. —MarcoAurelio (talk) 10:50, 21 February 2018 (UTC)
74.12.121.179 xwiki-contribsxwiki-dateSTIP infoWHOISrobtexgblockglistabuselogipchecker seems to be the same vandal.--侵入者ウィリアム (talk) 12:15, 24 February 2018 (UTC)
Yes, it is. --Malcolmxl5 (talk) 17:59, 24 February 2018 (UTC)
And at 70.31.127.107 xwiki-contribsxwiki-dateSTIP infoWHOISrobtexgblockglistabuselogipchecker --Malcolmxl5 (talk) 15:15, 27 February 2018 (UTC)
@MarcoAurelio and RadiX: sorry, Internet was unavailable for me for several days. I have found that, during this period, the vandal has also used 184.146.206.146 xwiki-contribsxwiki-dateSTIP infoWHOISrobtexgblockglistabuselogipchecker and 184.147.31.21 xwiki-contribsxwiki-dateSTIP infoWHOISrobtexgblockglistabuselogipchecker. I am beginning to cancel all the edits. --NicoScribe (talk) 17:04, 3 March 2018 (UTC)
Both rangeblocked. RadiX 19:18, 4 March 2018 (UTC)
The vandal is quiet, at the moment. So I have prepared a table synthesizing the situation, that we could keep, always updated, at the bottom of this section, if the vandal is still persistent. --NicoScribe (talk) 21:45, 5 March 2018 (UTC)

┌─────────────────────────────────┘
The /22 ranges have been globally blocked until 2018-03-14. —MarcoAurelio (talk) 21:53, 5 March 2018 (UTC)

@MarcoAurelio: thank you very much! I have updated the table. --NicoScribe (talk) 22:09, 5 March 2018 (UTC)
/24 IP range
on Meta-Wiki
/24 Global block /22 IP range
on Meta-Wiki
/22 Global block /22 IP range on
English Wikipedia
Block on
English Wikipedia
70.31.124.0/24 no 70.31.124.0/22 until 14 March 2018 70.31.124.0/22 until 13 March 2018
70.31.125.0/24 no
70.31.126.0/24 no
70.31.127.0/24 no
74.12.120.0/24 no 74.12.120.0/22 until 14 March 2018 74.12.120.0/22 until 13 March 2018
74.12.121.0/24 no
74.12.122.0/24 until 11 March 2018
74.12.123.0/24 no
184.146.204.0/24 until 11 March 2018 184.146.204.0/22 until 14 March 2018 184.146.204.0/22 until 13 March 2018
184.146.205.0/24 until 21 March 2018
184.146.206.0/24 until 4 April 2018
184.146.207.0/24 until 11 March 2018
184.147.28.0/24 until 11 March 2018 184.147.28.0/22 until 14 March 2018 184.147.28.0/22 until 13 March 2018
184.147.29.0/24 no
184.147.30.0/24 until 11 March 2018
184.147.31.0/24 until 4 April 2018