Jump to content

Vandalism reports/Archives/Archive 1

Add links
From Meta, a Wikimedia project coordination wiki

User:66.240.221.36[edit]

Inter-wiki digit spammer: [1] [2]

Blocked in en.wikiversity; warned in zh-classical:wikipedia --Hillgentleman 00:47, 27 November 2006 (UTC)[reply]

Open proxy – Mike.lifeguard | @en.wb 03:27, 2 December 2007 (UTC)[reply]

Imagen en portada[edit]

  • No se si ha sido con intencion o no, el caso es que no permite el normal desarrollo del proyecto.
  • Cuando hablo de proyecto me refiero a la intercomunicacion entre diferentes plataformas.
  • En consecuencia lo tomo como un vandalismo.
  • ¿Que significa imagen en portada?, (Una fotografia que oculta todas las wikis).
  • No tengo ningun problema por ello, solo tengo que dar un pequeño rodeo. Pero no deberia ser necesario.--212.51.52.7 17:32, 31 December 2006 (UTC)[reply]


Help in http://es.wikiquote.org[edit]

  • The user 190.225.9.20 have more act vandal.
    • My name is garber, and don't speak Englis.

— The preceding unsigned comment was added by 85.57.204.82 (talk) [3] (UTC)

Muchas gracias. El vándalo ya está bloqueado por Drini, saludos, --birdy geimfyglið (:> )=| 19:15, 1 December 2007 (UTC)[reply]

User:71.72.227.21[edit]

See tool. Vandalism across multiple wikis. User is suspected sock puppet on en.wikipedia. Mønobi 01:49, 3 December 2007 (UTC)[reply]

77.64.77.40[edit]

ml.wiki is being heavily vandalized by IP 77.64.77.40 and none of the active admins are online. Please take necessary steps. Also, it looks like there is lot of open proxy vandalism. Please refer w:ml:Special:Logs/block and help us with preventive measures from the IP ranges. You may reply here or on my meta page. Thanks! --Jacob 21:03, 28 December 2007 (UTC)[reply]

Please rollback edits too..Thanks! --Jacob 21:04, 28 December 2007 (UTC)[reply]
Thanks to Thongo, anaconda, DerHexer, Drini, MF_Warburg... for responding quickly to this! --Jacob 22:56, 28 December 2007 (UTC)[reply]

English person spamming crosswiki about a Spanish fraudster[edit]

  • Description: Crosswikivandal based in the UK puts on various pages cross wiki about Spanish coastal towns/villages warning texts about a fraudulent woman. Perhaps has been duped out of money during holiday and now misuses Wikipedia to warn against a Carmen Sxxxxxxxx a "property fraudster". Once logged in via his/her work IP addie at Dixons in the UK and furthermore has varying dynamic IP-addies from his/her provider Opal telecom that automatically change by each log in so day blocks suffice.
  • Used IP-addresses:
  • Pages to monitor cross-wiki: Aigües, Alicante, Alicante, Alicante Bouschet, Busot, Crevillent, El Campello, Jijona/Xixona, Kingdom of Valencia, Mutxamel, San Vicente del Raspeig, Turrón, Valencia (regio), Valencia.
  • Periode: 16 oct 2007 - 22 nov 2007
  • Where: Wiki-fr, nl, en, es and more

Feel free to keep in touch on this one via my Dutch talk page MoiraMoira 19:50, 22 November 2007 (UTC)[reply]

Hello, I only randomly clicked some links and I wanted to ask why You don't semiprotect [4] and [5] for a while, since I saw that these pagee were his main target, best regards, --birdy geimfyglið (:> )=| 16:43, 28 November 2007 (UTC)[reply]
Hi Spacebirdy, once you begin semi-protecting (I did two pages on wiki-nl) the vandal moves to the next page of a village in the whole Spanish coastal region unfortunately. At wiki-nl we now have range blocks for 78.145.0.0/16 and 78.150.0.0/16 since those dynamic IP's of Opal ISP have no other edits at all with us. I think maybe this is no suitable solution for wiki-en but might be feasible for other language wikipedia's. If wiki-en wants to block them they'd better check for legitimate edits from those main ranges first. Today he hit again cross-wiki. Best wishes, MoiraMoira 20:26, 29 November 2007 (UTC)[reply]
Thanks for the information, sorry to hear that :( Thanks for reporting this! Best wishes, --birdy geimfyglið (:> )=| 21:51, 29 November 2007 (UTC)[reply]
Please see also Talk:Spam_blacklist#Carmen_Starzonek, best regards, --birdy geimfyglið (:> )=| 10:37, 30 November 2007 (UTC)[reply]

Long term vandals[edit]

BogaertB[edit]

BogbaertB is a cross wiki vandal, mainly on fr. and nl. (aka Mario Scolas on french Wikipedia)

"Unknown" vandal[edit]

International wiki-vandal, blocked indefinitely on several wiki's[edit]

Hi! I'm a moderator on the Dutch Wikipedia and I wanted to draw your attention to this user. Please have a look and act as you see fit. We blocked him/her indefinitely... Greetings, MigGroningen 18:24, 30 October 2006 (UTC)[reply]

Primetime[edit]

Primetime is an extremely misguided user who seems to think it's in Wikimedia's best interest to have him dump articles and images from current editions of the EB, OED, Merriam-Webster, etc and claim that he wrote them (plagiarism). When people see through his dissimulation, he will attempt to justify his blatant copyright flouting by claiming he's "Robin Hood". Once his main account is blocked he'll make a zillion sockpuppets to try and defend his "reputation" by making personal attacks, removing sockpuppet and block notices from his userpage, whining and trying to gain favor of uninvolved users, making legal threats and/or uploading more violations. Block any incarnation on sight and indefinitely; he has already been banned on English Wikipedia by Jimbo Wales himself. If your wiki has CheckUsers, have one of them find out the IPs he's been using; they're almost always open proxies and should be banned indefinately. See w:Wikipedia:Long term abuse/Primetime for more info and the masterlist of his sockpuppets on all wikis.

Vandal and username thief "Linuxbeak"[edit]

There is a widespread impersonator and vandal at work on Wikimedia and other wikis who creats accounts impersonating English Wikipedia user "en:User:Linuxbeak". He is been on en:Memory Alpha (Evidence), Abkhaz wp (ab:User:Linuxbeak), Afrikaans wp (af:Gebruikerbespreking:Linuxbeak), and has been reported at sr: and cs: (en:User:Linuxbeak#Someone took your username on sr:). The ab: account has yet to be blocked. According to the user being impersonated, this is the long-term vandal en:User:JarlaxleArtemis (en:Wikipedia:Long term abuse/JarlaxleArtemis), (Evidence).

影武者 (Kagemusha etc)[edit]

Popular vandal on East Asian language projects, including Chinese, Japanese, Korean, and Vietnamese, using mainly hinet.net, Taiwan based ISP. He was active on the project listed on the above, but found on other projects, including English Wikipedia and Commons.

His last known vandalism happened in July 2007.

Remarkable points:

  • Impersonification of admins of those wikis, jawiki and zhwiki in particular, both in their usernames and in their real names (if known).
  • Offensive usernames including other names, eitherh in usernames or real names.
    • In both cases on the above, userpages tend to contain offensive content.
    • In both cases, the accounts may contain non latin characters.
  • Offensive usernames including the Japanese monarchs or historical figures.

There are some useful pages about him including:

Recurrent vandalism[edit]

Multi-user, multi-pattern, cross-project vandal "tester"[edit]

en:Wikiquote has been experiencing concerted, rapid-fire, multiple-user attacks for two consecutive days, follwing a pattern that has happened at least twice before in the past few months. The most recent one also included a simultaneous attack on en:Wikinews. The person or people behind this create a bunch of usernames in rapid succession, frequently but not always following several patterns, including *ook, animals, "new user" words, cross-project sysop impersonation, offensive names, and others. Some of these names are leftover from earlier attacks — usernames that made no edits during the previous attack, but are "activated" for the new one. The attack begins with either unassuming usernames starting an innocuous trolling of joke posts to user talk pages or with the scatalogical usernames plastering insults and offensive terms over articles, user, pages, and talk pages (especially from Recent Changes and targeting anti-vandal sysops). Then another set of usernames starts posting local or cross-project vandalism warnings to the sysops, possibly impersonating a sysop from another project (not immediately distinguishable from an actual sysop belatedly registering a username to help in cross-project vandalism fighting). When the real sysops start blocking accounts and/or refusing to take the joke-posting bait, yet another set of usernames or IP addresses post complaints to sysop talk pages and Administrators' Noticeboard. Eventually these are all tied together by a careful consideration of timing, writing style, knowledge demonstrated by multiple users, and, most compelling, outright statement by the multiple users that they are the same person.

Supposedly these complex attacks are a product of someone testing anti-vandalism reactions (see q:Wikiquote:Administrators' noticeboard#Coming Clean and the surrounding topics for Wikiquote's recent problem), but this has happened before to Wikipedia (see w:User talk:216.164.203.90#Coming Clean), suggesting the true goal is the vandalism and the confusion it creates. One pernicious aspect of this attack is that the user participates in arguments between sysops of different projects after they've gotten annoyed with each other for blocking impersonators. (Or it may just be that the angry folks are all the impersonating user. It's hard to take time to consider the possibilities when you are manually fighting changes driven by an automated system, apparently leaving the vandal time to have fun pissing off the sysops with complaints against each other. See n:User talk:Jeffq and n:User talk:DragonFire1024#You got one too. (and subsequent topics) for an example.)

This is only a partial list of vandals and their sockpuppets (just on Wikiquote) involved in the past two days's attacks:

Some of these names (or variations) are also new users on Wikinews. Some vandalize on one project but not the other. Even though the contemporaneous creations during this rapid-fire, multi-user vandal attack should implicate one username if the other is used to vandalize another project, sysops are reluctant to block the account on the project where it isn't vandalizing. This leaves the untainted account available for future vandalism — see q:User:Mi nombre es Heraldo and its mention in q:WQ:AN for a concrete example.

The resulting confusion while trying to discuss so many new users doing so many different things across multiple projects in a short time makes it virtually impossible for small-project sysops to coordinate.

en:Wikiquote has only a handful of sysops, and has periods where none are watching. We cannot keep spending hours each day blocking such complex attacks, even if we bend or break our own policies to head off likely vandal accounts (which this vandal seems to be trying to encourage). I would like some advice on how we can do a better job of stopping these attacks, given our extremely limited resources. ~ Jeff Q (talk) 02:03, 30 October 2006 (UTC)[reply]

Also note, that although my username does NOT appear on the list, I was accused of being the same user as MyName on Wikinews-en. I have requested a checkuser on my own behalf which has turned up NOTHING on Wikiquote, but apparently shows that there are IP addresses trying to be me and setting me up on Wikinews-en. The apparent imposter on Wikinews-en was InvisibleSUn who made several accusations and threats to me. The user was blocked indefiantely afeter MyName on Wikinews-en admitted on the Admin Alert page to being the user behind the attacks. I have requested that an investigation into the IP's attempting to be me on Wikinews be launched as to further prove my innicence after being accused of being MyName, an imposter, troll and a vandal. Any new information on this incident, regarding me, should be placed on my Meta Talk page or my wikinews talk page. DragonFire1024 02:13, 30 October 2006 (UTC)[reply]
To expand on DragonFire1024's point, this vandal appears to have been trying to provoke hostility between sysops n:User:DragonFire1024 on en:Wikinews and q:User:InvisibleSun and myself (q:User:Jeffq) on en:Wikiquote by registering and using those usernames that weren't already registered across these projects and Meta. I may be the only one of the three that had registered usernames months/years ago on all three, but anyone investigating shouldn't take my word for it (that is, Meta's User:Jeffq). I've not been able to investigate all the implications and details of this most recent attack yet, as the thing already screwed my day up considerably, but I'm hoping we can straighten out any problems that were created in the next day or two. ~ Jeff Q (talk) 05:49, 30 October 2006 (UTC)[reply]
Please note that this vandalism has continued every day, at varying intervals between 20:00 and 02:00, right up through 2-3 November, both on Wikiquote and to a lesser extent on Wikinews. I don't know why no one is responding to this report. I must assume that I am either not filing it in the correct place, everyone here is too busy to respond, or they are not interested in working on this issue. I am not a frequent editor on Meta, so please forgive me if I am making some kind of mistake, but it would help if someone could clarify the reason for the silence. Thank you. ~ Jeff Q (talk) 10:34, 3 November 2006 (UTC)[reply]
Because this page isn't usually used for, to use an analogy, what w:WP:AIV is for, rather it's a semistatic, sedate listing of wanted posters, EG. w:WP:LTA. 68.39.174.238 01:25, 13 February 2007 (UTC)[reply]

The Swahili Football Vandal[edit]

Seeking advice on how to block a repeated vandal on the sw:wikipedia . Someone keeps vandalizing the sw page for soccer, http://sw.wikipedia.org/wiki/Mpira_wa_miguu . We revert, it gets vandalized again from a different IP. We are a small wikipedia with only a few active participants, and the administrators don't know all the ins and outs of protecting a page from this sort of attack. Can you offer clues? Thanks, Malangali 03:16, 12 December 2006 (UTC) 03:15, 12 December 2006 (UTC)[reply]

Tit vandal[edit]

Some bot is vandalizing from multiple IP addresses that related to the word "Tit". For example: http://en.wikipedia.org/w/index.php?title=Tit_for_tat&action=history

Some IP's have already been blocked, but the vandalism keeps coming from other IP addresses.

Wikipedia is Communism[edit]

actually a long term vandal, but a vandal with the same modus operandi has vandalised almost the entire database of the Zeelandic Wikipedia (zea: - zea:User:WIC). Steinbach (formerly Caesarion) 20:47, 19 February 2007 (UTC)[reply]

New post-"&" partial article erasing bot[edit]

I'm not sure that this is the appropriate place to mention this... I've just recently began seeing a new vandal bot at two of my MediaWiki sites, beginning on April 10th, 2007. The bot seems to remove large portions of articles after encountering an "&" character. Since this isn't spam, I'm unable to blacklist such edits. All I can do is revert the edit and then block the IP address. I would prefer not to have to close the sites to anonymous edits but that's about the only real solution that I can think of. I have a log of these edits available for review here http://www.seattleeva.org/wiki/User:Rjf/Spam#Odd_Random_Changes should anyone care to look into it. I'm not sure if we are seeing any similar vandalism at the core wikimedia sites? --D0li0 11:18, 12 April 2007 (UTC)[reply]

Solution[edit]

All of this vandalism appears to be coming from a new User-Agent which didn't exist until these began and only appears to identify this particular bot, so I've blocked it from accessing the site altogether by including in the apache configuration file: 

SetEnvIf User-Agent "Mozilla/4.0 \(compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 2.0.50727\)" vandal_agents

Next add this Deny line to applicable virtual hosts directory sections: 

<Directory />
 Deny from env=vandal_agents
</Directory>

This should work until the bot wises up and changes it's agent identification... --D0li0 04:08, 14 April 2007 (UTC)[reply]

Note that this User-Agent is just the one of IE 6.0 on Windows 2003 Server (Windows NT 5.2), SV1 = on a Security Version platform with a .NET client version of 2.0.50727. So you're also blocking that IE on machines with that same configuration, as well as that bot using the wininet library. Platonides 11:05, 11 June 2008 (UTC)[reply]

Mumfum vandal[edit]

Got a feeling it may be worth starting this one here. For sometime Wikibooks has enjoyed the company of one (or more) Mumfum vandal(s). It looks to me as tho they hit a number of wikis in succession on the 10th (Requests_for_CheckUser_information#Meta). The IP address for the meta one was the same as the books one so I'm wondering if others out there were affected? Equally whether some rather more co-ordinated action on IP addresses might be worthwhile. Hopefully stating the obvious I'll happily help wherever I can (& feel free to ask if anyone wants more info). The page move aspect of this vandal may point to an "on wheels" connection. If anyone is sure feel free to move this to that section - regards --Herby talk thyme 12:40, 12 April 2007 (UTC)[reply]

Pisskern Alien vandal[edit]

We have had a recurrent problem on the Norfuk Wikipedia with an individual registering a parachute account, and moving articles, usually pih:Norfuk Ailen and pih:Pitkern Ailen to crude variants. See our move log for illustration.

I whack the account as soon as I see it, and move the pages back, but it's getting tiresome. I add the pages into pih:Wikipedia:Protected titles before I nuke them, but the vandal then just uses some Unicode tricks to create titles that look the same, but are made from different characters.

I would like to make it so that users cannot move pages for a week after registering, but I'm not sure how this is done. Other than that, I'm stuck for ideas on how to combat this vandal. Does anyone have any ideas? Pallmall 08:39, 29 May 2007 (UTC)[reply]

You (an admin?) can "protect" the page using "block unregistered users" (just on "move" if you want). This prevents very new accounts (2/3 days I think) from moving the page. I would also suggest that you request Check user information on the accounts to see if there is an underlying IP behind some or all the accounts. --Herby talk thyme 08:51, 29 May 2007 (UTC)[reply]

Current cross wiki vandalism[edit]

Personal attack[edit]

A vandal (i think a student) created user pages about an academic person. Theese pages hr nl ja zh pl be cs pt deinclude personal attacks and swearwords. Theese accounts should block and pages delete because of google search.--Mach 09:55, 18 April 2008 (UTC)[reply]

czech wiki - indef block and page deleted --Chmee2 12:37, 18 April 2008 (UTC)[reply]
done on croatian wiki (hr) --Dalibor Bosits 13:26, 18 April 2008 (UTC)[reply]
done (be) --MaximLitvin 16:05, 18 April 2008 (UTC)[reply]
done (nl) MoiraMoira 16:44, 18 April 2008 (UTC)[reply]
done (de) by de:User:Syrcro, --birdy geimfyglið (:> )=| ∇ 16:52, 18 April 2008 (UTC)[reply]
done (pl) (pt) by locals, --birdy geimfyglið (:> )=| ∇ 09:24, 19 April 2008 (UTC)[reply]
done (ja) --Kanjy 09:47, 19 April 2008 (UTC)[reply]
done (zh) by zh:User:Cloudcolors, --birdy geimfyglið (:> )=| ∇ 14:42, 19 April 2008 (UTC)[reply]

Thanks for helping.--Mach 14:02, 19 April 2008 (UTC)[reply]

massive vandalism from 66.41.109.159[edit]

Massive vandalism in jbo-wiki: User 66.41.109.159 xwiki-contribs • xwiki-date (alt) • ST • IP info • WHOIS • robtex • gblock • glist • abuselog • bullseye jbo:Special:Contributions/66.41.109.159. Luxotool shows also vandalism in en.wiki. Other wikis yet not shown, there might be others, probably visible in some days.

Best regards, --birdy geimfyglið (:> )=| ∇ 01:59, 16 April 2008 (UTC)[reply]

dz.wikipedia vandal[edit]

User: Donuttowanoon xwiki-contribs • xwiki-date (alt) • ST • IP info • WHOIS • robtex • gblock • glist • abuselog • bullseye Donuttowanoon2 xwiki-contribs • xwiki-date (alt) • ST • IP info • WHOIS • robtex • gblock • glist • abuselog • bullseye and [6] creating pages in Dzongkha Wikipedia with Thai texts copied from Thai Wikipedia. He also blanked dz:Wikipedia:Autoconfirmed users. He claimed here that he is a 10 yrs old boy living in Thailand. According to his edit history in th:, this kid may vandal lo: and km: soon. Best regards, ---- 2T 07:46, 9 April 2008 (UTC)[reply]

Thanks for the report, he is now blocked on dz. Please keep us informed if You detect further problems. Many thanks, best regards, --birdy geimfyglið (:> )=| ∇ 12:06, 9 April 2008 (UTC)[reply]

Cross wiki spammer: in Islam-related articles[edit]

User/example diff: 77.31.112.228 xwiki-contribs • xwiki-date (alt) • ST • IP info • WHOIS • robtex • gblock difflink • glist • abuselog • bullseye, adding spamlinks in the middle of the entry, sometimes even in the middle of existing links. He went through all articles "Islam" crosswiki it seems.

Best regards, --birdy geimfyglið (:> )=| ∇ 19:33, 1 April 2008 (UTC)[reply]

Cross wiki spammer: John titor[edit]

User: 83.190.116.58 xwiki-contribs • xwiki-date (alt) • ST • IP info • WHOIS • robtex • gblock • glist • abuselog • bullseye creating empty pages with English links only, examples: az:John titor, vo:John titor, cy:John titor

Best regards, --birdy geimfyglið (:> )=| ∇ 13:49, 1 April 2008 (UTC)[reply]

Cross wiki vandal bots?[edit]

I'm going for the fact that we have some cross wiki vandal bot activity recently that seems to follow a pattern. I've currently spotted two IP involved 190.42.51.225 & 190.42.50.39. May be worth keeping an eye on - cheers --Herby talk thyme 14:43, 22 March 2008 (UTC)[reply]

Lisa Gerrard - vandal[edit]

User 71.192.59.22 xwiki-contribs • xwiki-date (alt) • ST • IP info • WHOIS • robtex • gblock • glist • abuselog • bullseye, Glitter1959 xwiki-contribs • xwiki-date (alt) • ST • IP info • WHOIS • robtex • gblock • glist • abuselog • bullseye and Dancinfool610 xwiki-contribs • xwiki-date (alt) • ST • IP info • WHOIS • robtex • gblock • glist • abuselog • bullseye are creating empty or English articles about Lisa Gerrard cross-wiki and uploading images of her locally with a link to a flickr-account, licencing under Cc-by-sa-2.0, while it seems obvious that these are not his. I tried to reach him several times like on vo, pih, ang. After the last he came to Meta, I explained to him again, to stop and he seemed to have read it because he answered but right after that he uploaded the image even here and then even continued on mediawiki-wiki.

I recommend to delete his images everywhere. Best regards, --birdy geimfyglið (:> )=| ∇ 15:01, 21 March 2008 (UTC)[reply]

I later learned he also edited on commons as ThePhantom28 xwiki-contribs • xwiki-date (alt) • ST • IP info • WHOIS • robtex • gblock • glist • abuselog • bullseye [7], where he also uploaded a copyrighted image. Also he seems to have more than one flickr account, found so far: dancinfool610 and thephantom28, with overlapping images.
Best regards, --birdy geimfyglið (:> )=| ∇ 01:43, 22 March 2008 (UTC)[reply]
Just found another account from where he claims to hold the rights: Glitter1959. Images are overlapping with the other two.
Best regards, --birdy geimfyglið (:> )=| ∇ 12:23, 24 March 2008 (UTC)[reply]
Other suspected flickr account: Sonya_the_photograph er, --birdy geimfyglið (:> )=| ∇

New IP: 76.118.195.114 xwiki-contribs • xwiki-date (alt) • ST • IP info • WHOIS • robtex • gblock • glist • abuselog • bullseye, blocked from huwiki for violation of the previous block. Acts on enwiki, Commons and some other wikis with the same profile, from the same ISP. Bináris 06:57, 13 April 2008 (UTC)[reply]

Vandal from 71.107.136.165[edit]

Attacked af, as, en, ka, ku, lv, lb wikipedia so far, inserting nonsense in Europa or America articles.

Best regards, --birdy geimfyglið (:> )=| ∇ 18:32, 13 March 2008 (UTC)[reply]

Vandal from 208.27.234.156[edit]

Attacking wo, av, jbo, chr, dz, got.wikipedia, en.wikipedia, page blanking or inserting nonsense. 208.27.234.156 seems to be known for such in the past, please compare [8]

Best regards, --birdy geimfyglið (:> )=| ∇ 16:26, 21 February 2008 (UTC)[reply]

Vandal from 69.94.191.109[edit]

The vandal replaced the picture of Ronald Raegan with some cat in the EN, FR and BG Wikipedia (didn't search others). The IP address seems to be of some school in Texas. --Петър Петров 15:53, 31 January 2008 (UTC)[reply]

Same editor, same trick on gawiki[9] and on enwiki[10] - now blocked - Alison ❤ 19:23, 31 January 2008 (UTC)[reply]
As announced on #wikimedia-adminconnect he ran through all or nearly all Ronald Reagan articles there are, best regards, --birdy geimfyglið (:> )=| ∇ 19:26, 31 January 2008 (UTC)[reply]
Do we know if there's any connection to the Rosa Parks vandalbot listed below? – Mike.lifeguard | @en.wb 21:26, 1 March 2008 (UTC)[reply]

Vandalbots on gdwikti[edit]

Just over the last few days. Constantly hitting the Talk:dame page. So far, all IPs have been open proxies. I portscanned them myself to verify:

  • 80.231.198.77 (no longer open)
  • 77.72.71.4
  • 63.238.76.250
  • 200.251.69.131

- I'm currently the only sysop on there - Alison ❤ 15:44, 29 January 2008 (UTC)[reply]

Rosa Parks vandalbot[edit]

Since yarrow is down, I can't link to luxo's, but 64.38.10.111 has been vandalizing across many wikipedias' Rosa Parks article. It is an open proxy.  – Mike.lifeguard | @en.wb 21:14, 27 January 2008 (UTC)[reply]

Vandalism is like [11].  – Mike.lifeguard | @en.wb 21:15, 27 January 2008 (UTC)[reply]

NO NOOKS vandal[edit]

Has used the following usernames for pagemove vandalism etc. on the no nooks theme (highly incomplete list, as these are only from 2 wikis): Blob12, Blob9, Blob10, Blobconk, Pluto 239, Rushlimbaugh.

The underlying IP 69.227.151.150 has hit:

  • commons (blocked)
  • en.wikibooks (blocked)
  • en.wikinews (blocked)
  • en.wikiquote (blocked)
  • en.wikisource
  • en.wikiversity (blocked)
  • en.wikipedia (blocked)
  • en.wiktionary (blocked)
  • fr.wikipedia
  • it.wikipedia
  • mediawiki
  • meta (blocked)
  • pl.wikipedia
  • pt.wikipedia
  • simple.wikibooks (blocked)
  • simple.wikiquote (blocked)
  • simple.wikipedia (blocked)
  • species
  • sv.wikipedia

– Mike.lifeguard | @en.wb 18:58, 8 December 2007 (UTC)[reply]

This is not an OP (so far as I can determine). – Mike.lifeguard | @en.wb 18:59, 8 December 2007 (UTC)[reply]

Vandal 125.24.52.147[edit]

km.wiki is being heavily vandalized by IP 125.24.52.147 and none of the active admins are online. Also, it looks like he is unrepentant. Please take the necessary steps to block him. Thanks! --Jose77 02:48, 27 January 2008 (UTC)[reply]

Seems to have stopped now, I'll keep a look out for more. Nakon 03:26, 27 January 2008 (UTC)[reply]
Also 125.24.181.89 and Superbot have picked up where they left off. Woodym555 13:30, 27 January 2008 (UTC)[reply]
Khmer now has a temp sysop, vandals blocked, vandalism cleaned up for now. Woodym555 00:50, 28 January 2008 (UTC)[reply]

http://es.wikiquote.org/[edit]

Helow, I am GArber in Spanish Wikiquote. The 190.84.63.207 es the spam bot, please block this IP., Thanks--85.57.215.38 20:33, 1 March 2008 (UTC)[reply]

http://es.wikiquote.org/[edit]

Helow, I am GArber in Spanish Wikiquote. The es.wikiquote.org is being heavily vandalized by IP 69.79.240.190, please block this IP. Thanks--85.57.215.38 20:33, 1 March 2008 (UTC)[reply]

Gracias, --birdy geimfyglið (:> )=| ∇ 13:21, 25 March 2008 (UTC)[reply]

Vandalism from Famke[edit]

User:Famke Famke xwiki-contribs • xwiki-date (alt) • ST • IP info • WHOIS • robtex • gblock • glist • abuselog • bullseye cross wiki spam --Sionnach 07:36, 29 May 2009 (UTC)[reply]

I looks like there is no SUL account. The edits on fr.wikipedia are correct. I am going to leave the user a message on fr.wikipedia to see if he owns the other accounts. Nakor 13:33, 29 May 2009 (UTC)[reply]
Thanks a lot, I have added his spamlink to the spam blacklist [12], You may put further requests for blacklisting also on Talk:spam_blacklist, best regards, --birdy geimfyglið (:> )=| 19:45, 29 May 2009 (UTC)[reply]

Vandalism from 76.124.107.192[edit]

User with IP 76.124.107.192 xwiki-contribs • xwiki-date (alt) • ST • IP info • WHOIS • robtex • gblock • glist • abuselog • bullseye seems to vandalize one wiki, and when blocked, switches to another. Cross wiki edits Also show active blocks on commons, en.wikipedia, en.wwikibooks, etc. It's all the same user, since the vandalism pattern is identical (addition of {{delete|This is a bad page}} or death threats.) Recommendation for 3 week global block, as his wiki hopping is bypassing the blocks. --Sigma 7 20:31, 8 April 2009 (UTC)[reply]

Hello, since this is a shared IP and not ongoing we won't block the IP globally, it is blacklisted for smaller projects and the bigger ones can handle it locally, thanks for Your report, best regards, --birdy geimfyglið (:> )=| 17:38, 9 April 2009 (UTC)[reply]

vandal bot[edit]

The chosen phrase seems to be "Good post, admin." Can this be blacklisted through mediawiki:$wgSpamRegex Extension:SpamRegex, or will it just force the bot to create blank pages?

Or is there a way to block edits from IPs in the mediaWiki talk name space for a while? The bot seems to create pages in that name space (but not only there), and they are all crap that will have to be removed. See for instance: http://ang.wikipedia.org/w/index.php?title=Syndrig:RecentChanges&hideliu=1

The bot is posting all over the net. --Jorunn 12:36, 21 March 2009 (UTC)[reply]

This might be of interest. --Kanonkas 12:39, 21 March 2009 (UTC)[reply]
This is a known malbot, probably xrumer. You can report individual IPs to SRG.  — Mike.lifeguard | @en.wb 22:27, 21 March 2009 (UTC)[reply]

Portuguese-Spanish mors vandal[edit]

124.157.250.132 and 114.128.61.231 are vandalising cross-wiki their nonsense. It does include a link, so we may be able to blacklist that. See User:COIBot/XWiki/[email protected] and User:COIBot/XWiki/[email protected] for details in addition to the domain:

johnib.wordpress.com

(LinkSearch: meta | en | es | de | fr | ru | zh | simple | c | d | Wikipedias: top 25 · 50 · major wikis · sc · gs)(Search: Google | en (G) | fr (G) | de (G) | meta (G) | backlinks | → links ←)johnib.wordpress.com
(Reports: Report ← track | XWiki | Local | en | find entry)(DomainTools: whois | AboutUs | Malware?)

 — Mike.lifeguard | @en.wb 20:06, 9 March 2009 (UTC)[reply]

93.187.86.36[edit]

Vandal from no:, went cross-wiki with puberal vandalism after being blocked there. I now gave him a one day cross-wiki block, but I fear that he will be back after that. - Andre Engels 08:07, 24 February 2009 (UTC)[reply]

Vandenbloot vandal cross multiple wikis[edit]

Vandenbloot (talk · contribs) is only the most recent incarnation, includes many many different socks. Vandalism affects multiple wikis, and vandalism pattern is identical in each. Suggest some sort of checkuser investigation on all these projects to contain this somehow. For examples of past accounts and vandalism activity, see Wikimedia Meta-Wiki, Wikipedia, Wikiquote, Wikisource, Wikinews, Commons - perhaps other wikis are affected as well. Cirt (talk) 08:37, 18 February 2009 (UTC)[reply]

Perhaps a global block on the IP-range(s) used by this vandal might be appropriate. Cirt (talk) 08:53, 18 February 2009 (UTC)[reply]
Hello Cirt, that would affect too much users, besides only open proxies are used, thanks for the report, best regards, --birdy geimfyglið (:> )=| 16:14, 18 February 2009 (UTC)[reply]
Ah, I was unaware only open proxies are used. Still - this affects many different wikis - is there some way for cross-project coordination to make the vandalism work easier on admins on the various projects? Cirt (talk) 17:11, 18 February 2009 (UTC)[reply]
The cu ml should and is used for such cases, best regards, --birdy geimfyglið (:> )=| 17:24, 18 February 2009 (UTC)[reply]
Ah okay great, thanks. Cirt (talk) 17:43, 18 February 2009 (UTC)[reply]

Same pattern of vandalism with new account more recently at en.wikiquote and en.wiktionary. Cirt (talk) 07:20, 1 March 2009 (UTC)[reply]

That account operated from 147.202.121.194, a probable web proxy hosted by LogicWeb. I globally blocked 147.202.104.0/21 and 147.202.112.0/20 for one day; it may be a good idea to block these long term, but we should make sure there are no legitimate users on this range. —Pathoschild 07:23:52, 01 March 2009 (UTC)
Thank you Pathoschild (talk · contribs). :) Cirt (talk) 13:07, 2 March 2009 (UTC)[reply]

See also Report at Wikisource admin board and Categories at Wikisource. Cirt (talk) 19:57, 10 March 2009 (UTC)[reply]

Jordan Galland cross wiki promotion[edit]

Stubs about Jordan Galland are being created cross wiki. This seems to be related to the banned en user and sock farmer Tweety21.


User:Eastvillagegroupie

(commons: userpage | talk (←links) || Edits: +/- | logs ← Eastvillagegroupie ← logs || search)(Reports: COIBot)
(Tools: GUC | stalktoy | CA) (Search: Google | → links ←User talk )
(enwiki: userpage | talk (←links) || Edits: +/- | logs ← Eastvillagegroupie ← logs || search)

User:65.119.181.165(IP tools: Google | WHOIS | domaintools | RBL | tools)
(spamhaus | projecthoneypot | malwareurl)

(commons: talk (←links) || Edits: +/- || search)
(enwiki: talk (←links) || Edits: +/- || search)(Tools: GUC | gblock | log | → links ←User talk) | (Reports: COIBot)

User:173.33.21.101(IP tools: Google | WHOIS | domaintools | RBL | tools)
(spamhaus | projecthoneypot | malwareurl)

(commons: talk (←links) || Edits: +/- || search)
(enwiki: talk (←links) || Edits: +/- || search)(Tools: GUC | gblock | log | → links ←User talk) | (Reports: COIBot)


Articles created the last days:

Only one of the Wikipedia articles about Jordan Galland, de:Jordan Galland, seems to have been created by an established user on the wiki. The topic of the articles is notable, but the editor(s) seems to have conflict of interest here, and there are some external links being spread in a dubious way too.


dopoyume.com

(LinkSearch: meta | en | es | de | fr | ru | zh | simple | c | d | Wikipedias: top 25 · 50 · major wikis · sc · gs)(Search: Google | en (G) | fr (G) | de (G) | meta (G) | backlinks | → links ←)dopoyume.com
(Reports: Report ← track | XWiki | Local | en | find entry)(DomainTools: whois | AboutUs | Malware?)

myspace.com/galland

(LinkSearch: meta | en | es | de | fr | ru | zh | simple | c | d | Wikipedias: top 25 · 50 · major wikis · sc · gs)(Search: Google | en (G) | fr (G) | de (G) | meta (G) | backlinks | → links ←)myspace.com/galland
(Reports: Report ← track | XWiki | Local | en | find entry)(DomainTools: whois | AboutUs | Malware?)

spectacle.seanlennon.letrasdemusicas.com.br

(LinkSearch: meta | en | es | de | fr | ru | zh | simple | c | d | Wikipedias: top 25 · 50 · major wikis · sc · gs)(Search: Google | en (G) | fr (G) | de (G) | meta (G) | backlinks | → links ←)spectacle.seanlennon.letrasdemusicas.com.br
(Reports: Report ← track | XWiki | Local | en | find entry)(DomainTools: whois | AboutUs | Malware?)

blog.spout.com/2009/01/07/rosencrantz-guildenstern-are-undead-park-city-preview

(LinkSearch: meta | en | es | de | fr | ru | zh | simple | c | d | Wikipedias: top 25 · 50 · major wikis · sc · gs)(Search: Google | en (G) | fr (G) | de (G) | meta (G) | backlinks | → links ←)blog.spout.com/2009/01/07/rosencrantz-guildenstern-are-undead-park-city-preview
(Reports: Report ← track | XWiki | Local | en | find entry)(DomainTools: whois | AboutUs | Malware?)

groups.myspace.com/DopoYumeaddicts

(LinkSearch: meta | en | es | de | fr | ru | zh | simple | c | d | Wikipedias: top 25 · 50 · major wikis · sc · gs)(Search: Google | en (G) | fr (G) | de (G) | meta (G) | backlinks | → links ←)groups.myspace.com/DopoYumeaddicts
(Reports: Report ← track | XWiki | Local | en | find entry)(DomainTools: whois | AboutUs | Malware?)

extracine.com/tag/jordan-galland

(LinkSearch: meta | en | es | de | fr | ru | zh | simple | c | d | Wikipedias: top 25 · 50 · major wikis · sc · gs)(Search: Google | en (G) | fr (G) | de (G) | meta (G) | backlinks | → links ←)extracine.com/tag/jordan-galland
(Reports: Report ← track | XWiki | Local | en | find entry)(DomainTools: whois | AboutUs | Malware?)

--Jorunn 23:35, 2 February 2009 (UTC)[reply]



Thorn93[edit]


Vandalbots[edit]

Version 1[edit]

We have what looks to be a new vandalbots in testing, with two characteristic patterns, and seems to be a new version of the xrumer bot:

  1. The first is a characteristic edit summary - string of random characters, lots of consonants: ZeeYlBklvRULd, afhgGjZmPrLufIiS, XZbFWIqxc or EeDFAdlUfQXQFQDizQR for example.
  2. The other one is using section editing, which is clever (makes things harder to track)

The content of the edits is classic xrumer stuff:

IPs so far

If you see IPs matching these patterns, please blacklist the IP in cvn-sw, and/or let someone from SWMT know. Sometimes page creation, more often editing a random existing page. The IPs appear to be open proxies. The bot generally makes only a few edits from a particular proxy before jumping to a new one.

 — Mike.lifeguard | @en.wb 02:37, 3 December 2008 (UTC)[reply]

They will often edit the same page a few times from different IPs. See [13] and [14] for example.  — Mike.lifeguard | @en.wb 02:45, 3 December 2008 (UTC)[reply]

Version 2[edit]

Now using a characteristic edit summary: FIELD_OTHER, again from open proxies.

IPs so far
Just to note, this vandalbot continues, though at a lower level than before. Some of the global blocks remain in place, but most have expired, so I've removed |gblocked=yes from all the above IPs.  — Mike.lifeguard | @en.wb 05:32, 25 December 2008 (UTC)[reply]

Nonsense text insertion in Spanish language wikis[edit]

Please check AntiBaiji (unacceptable username anyway) --Javierm 15:51, 27 January 2009 (UTC)[reply]

q:es:user:190.158.28.127 and AntiCensuraWQ have been repeatedly inserting text and images unrelated to the pages in es.wikiquote , but are already blocked. I see Spacebirdy is acting in es.wikinews. Thanks. --Javierm 15:57, 27 January 2009 (UTC)[reply]

Thanks for the report, I blocked him and reverted, the deletions I leave to the locals (they are not hard to find, I marked one and added a link to his contributions) also the contributions of the IP 190.146.180.141 Best regards, --birdy geimfyglið (:> )=| 16:14, 27 January 2009 (UTC)[reply]

User:User1395[edit]

User1395 xwiki-contribs • xwiki-date (alt) • ST • IP info • WHOIS • robtex • gblock • glist • abuselog • bullseye Vandalism on zh wiktionary, zh wikipedia,af wikipedia.--Shizhao 03:09, 2 December 2008 (UTC)[reply]


76.190.220.7[edit]

76.190.220.7 on wikiquotes especially - vandalising frwikiquote for example: 

# 2008-11-28T21:08:27 ( hist  ) ( diff  ) Papa John's (477 Bytes) (Nouvelle page : Papa John's is like crap on a shingle. Well let me re-phrase, it's like nothing on cardboard. There are no toppings on it and what sauce is on it is too sweet. I'd sooner eat a froze...)
# 2008-11-28T21:05:59 ( hist ) ( diff ) Edmonton (544 Bytes) (Nouvelle page : I only saw this movie because my friends dragged me to it at midnight. I did not want to go and I protested. However, I went since Beverly was there and I did not want to drink alo...)

 — Mike.lifeguard | @en.wb 01:21, 29 November 2008 (UTC)[reply]

Globally blocked - 11h; thanks Elisabeth.  — Mike.lifeguard | @en.wb 01:23, 29 November 2008 (UTC)[reply]

User:Leader171[edit]

He has SUL but vandalises wikis (el, nl, ro, tr). You can't see any contribition because he only changes usernames.--Mach 20:40, 28 November 2008 (UTC)[reply]

Leader171 (talk • contribs • block • xwiki-contribs • xwiki-date (alt) • CA • ST • lwcheckuser)
Hello, this seems to be a reincarnation of a known vandal, I have locked his account due to crosswiki-vandalism like [15], thanks for the report, best regards, --birdy geimfyglið (:> )=| 20:46, 28 November 2008 (UTC)[reply]

User:Schwarz2, also known as User:Atsushi[edit]

User:Atsushi (sulutil | luxo's), User:Atsushi2 (sulutil | luxo's), and User:Atsushi3 (sulutil | luxo's) were cross-wiki abuse accounts of a Japanese speaker (reported here, see archive). He seems to be back as User:Schwarz2 (sulutil | luxo's). He often writes some nonsense text (crunk poems or some such) in Japanese to his userpage and subpages, and edits them many many times flooding RecentChanges. He wants to read his deleted works again, so he requested undeletion at German Wikipedia, and requested Adminship at Japanese Wikipedia. At the Japanese RfA page, he also begged Adminship of En:, De:, Es:, and Pt:. He is not a real vandal, but an abuser (or a free-rider) on Wikimedia resource of the donated fund. --Kanjy 11:38, 20 November 2008 (UTC)[reply]

Ethiopia vandal[edit]

IP 213.100.68.170 is blocked on en.wikipedia for "Continuing to add unreferenced information despite being asked for references, SPA trying to remove Ethiopia from LDC list." and on sv.wikipedia for repeated vandalism of same type. Has now gone cross wiki, and is also using user names Michaelwendwessen and 930618wemi.


User:213.100.68.170(IP tools: Google | WHOIS | domaintools | RBL | tools)
(spamhaus | projecthoneypot | malwareurl)

(commons: talk (←links) || Edits: +/- || search)
(enwiki: talk (←links) || Edits: +/- || search)(Tools: GUC | gblock | log | → links ←User talk) | (Reports: COIBot)

User:930618wemi

(commons: userpage | talk (←links) || Edits: +/- | logs ← 930618wemi ← logs || search)(Reports: COIBot)
(Tools: GUC | stalktoy | CA) (Search: Google | → links ←User talk )
(enwiki: userpage | talk (←links) || Edits: +/- | logs ← 930618wemi ← logs || search)

User:Michaelwendwessen

(commons: userpage | talk (←links) || Edits: +/- | logs ← Michaelwendwessen ← logs || search)(Reports: COIBot)
(Tools: GUC | stalktoy | CA) (Search: Google | → links ←User talk )
(enwiki: userpage | talk (←links) || Edits: +/- | logs ← Michaelwendwessen ← logs || search)

--Jorunn 21:14, 8 November 2008 (UTC)[reply]

Thanks; I have added these to the blacklist in IRC, and they are popping up regularly. I'm simply reverting their edits where I see them. I'm not sure whether we need to consider locking the accounts.  — Mike.lifeguard | @en.wb 18:27, 11 November 2008 (UTC)[reply]
OK, they now continue (low-level) with IPs. Added to watched pages.  — Mike.lifeguard | @en.wb 03:28, 3 December 2008 (UTC)[reply]

French vandal[edit]

I'm copying a report from EN:WP Admin noticeboard Incidents (Tazmaniacs 12:00, 8 October 2008 (UTC)): See [talk:195.221.155.2] for full report. Same IP adress (Utilisateur:195.221.155.2) was blocked on French Wiki.[reply]

This (French) user, engaged in childish vandalism since years ([16], [17], [18], [19], [20] ([21], has a troubling pattern related to a user of the French Wiki, who appears to make constructive edits.

Thus, on April 4, 2008,fr:Rafael Sánchez Mazas was created by Vincent D. Rousseau, and, just a few hours before, a link was added to the French article by our user here (195.221.155.2) to the English Mazas article (see dif).

Same for Latin Kings created on French Wiki by Vincent Rousseau, born in 1990.

Same also for Music of Ancient Rome, modified on the same day that Vincent Rousseau modified the French version of the article.

Tazmaniacs (talk) 14:31, 5 October 2008 (UTC)[reply]

OK, so I have checked the user's global contribs—it's a real mess. The latest edits were just last month on frwiki. However, there were several projects affected. The WHOIS report indicates that it might be in a semi-static IP range, so that's a good thing. There's some pretty childish stuff, but hopefully it's obvious enough. I've reverted all of the edits that were rollbackable, but there's probably several conflicting revisions too. I'd suggest going either on Cross-wiki Vandalism reports or requesting for a Global block, although it would seem more reasonable to do the former as this user hasn't edit within a few months on enwiki. If the same guy edits anonymously from another IP, report again as needed. ~ Troy (talk) 23:40, 5 October 2008 (UTC)[reply]

Thailand vandal[edit]

Cross wiki-vandal, places long diatribes agains crimes and persons on various pages in English, works from Thai IP-aresses. Calls himself Erik Young. Page Thailand often used. MoiraMoira 15:14, 15 October 2008 (UTC)[reply]

Do we have more up-to-date information on their IPs? Are they continuing?  — Mike.lifeguard | @en.wb 18:28, 11 November 2008 (UTC)[reply]
He uses IPs from various ISPs in Thailand, so a range-block or similar is not possible, as it would effectively block many Thai users. This obviously mentally sick person spams the web with his rants for quite some time already, and does it on Wikipedia for maybe a year now. His "home base" with the collection of all his rants seems to be (doot) ladonia (dot) net/new_herald/?p=151 here, and the forums of the Thai newspaper "The Nation" is also a favourite target of him. I have the usual pages in the English WP hit by this vandal in my watchlist, and block the IP right away when I notice yet another vandalism run. Only way to do this faster would be added "Erik J Young" or some other unique phrases used by him to the catch phrases for a anti vandal bot. Ahoerstemeier 11:19, 19 November 2008 (UTC)[reply]
Seems like vandal patrol is not working well with this vandal - he was able to post his nonsense for nearly one hour earlier, and some of his changes survided even longer. [22] Ahoerstemeier 11:58, 21 November 2008 (UTC)[reply]
I have recently blocked the ranges 61.7.178.0/24, 61.7.179.0/24, 61.7.182.0/24, and 61.7.183.0/24 for a month on enwiki for the second time. These anon-only, account-creation-enabled blocks are fairly effective, though not without collateral. The vandal sometimes uses other IPs if his favourite ranges are blocked, but these don't seem very blockable. zzuuzz (talk) 15:33, 22 November 2008 (UTC)[reply]
Just to update, I don't know about other wikis, but we're still getting this on a daily basis on enwiki. We now have a Long term abuse section for this vandal, and any sysops should get in touch with me if you want some effective abuse filter settings. zzuuzz (talk) 19:20, 24 May 2009 (UTC)[reply]

Vandalism on eu.wikipedia[edit]

I don't speak Euskara so I wish to report this IP: 88.2.211.164. Blanking, Vandalizing.... Last warning given. Thank you: Dferg (talk) 10:53, 2 October 2008 (UTC)[reply]

Hello, thanks, but it is not cross-wiki, and eu.wiki has sysops, they are very active and it seems not to be ongoing/an emergency, best regards, --birdy geimfyglið (:> )=| 10:55, 2 October 2008 (UTC)[reply]

Vandalism on es:Wikiquote[edit]

This is IP [23] has been vandalizing in spanish wikiquote with empties and undue messages --Efegé 18:15, 1 October 2008 (UTC)[reply]

Junk insertion at Spanish language projects[edit]

http://es.wikinews.org/wiki/Especial:Contributions/190.159.11.176 Already blocked in es.wikiquote, currently atacking es.wikisource. --Javierm 15:43, 17 September 2008 (UTC)[reply]

Cross-wiki spammer[edit]

Please see [24]. (Blocked at Commons) Cirt (talk) 09:49, 5 September 2008 (UTC)[reply]

Thanks, seems to be not ongoing, please consider the spam-blacklist for cross-wikispam, thanks, --birdy geimfyglið (:> )=| 10:58, 2 October 2008 (UTC)[reply]

Crosswiki vandal OfSecretsWeAre[edit]

Global contribs, vandalises templates that are embedded in the Recent changes over several wikis so far. →Spiritia 08:08, 28 August 2008 (UTC)[reply]

Thanks! Locked on 28 by DerHexer, best regards, --birdy geimfyglið (:> )=| 13:12, 4 September 2008 (UTC)[reply]

Franchise spammer[edit]

85.121.14.131 xwiki-contribs • xwiki-date (alt) • ST • IP info • WHOIS • robtex • gblock • glist • abuselog • bullseye adds Romanian links to all the franchise-articles. Bináris tell me 19:02, 8 August 2008 (UTC)[reply]

I have reverted in hu, es, en, and in some other projects were his contribs already reverted. Bináris tell me 20:25, 8 August 2008 (UTC)[reply]
Thanks, please consider bringing cross-wiki spam to Talk:spam blacklist also, thank You, best regards, --birdy geimfyglið (:> )=| 13:13, 4 September 2008 (UTC)[reply]

SERSERİ77[edit]

Creating a single page on very many wikis (wikipedia, wikiquote, wiktionary, others all affected) with a text claiming he has 'hacked' the site. Using various ip addresses. Not just active on Wikimedia, see [25]. Ip address seems real but dynamic. - Andre Engels 10:54, 16 July 2008 (UTC)[reply]

Known addresses include:

  • 74.86.209.130 (15 July) (open proxy)
  • 78.186.202.53 (20 July)
  • 88.245.1.218 (11 July)
  • 88.245.205.74 (11 July)
  • 88.245.206.193 (18 July)
  • 88.245.207.133 (11 July)

I have sent a complaint report to TurkTelekom, their apparent ISP. - Andre Engels 18:17, 20 July 2008 (UTC)[reply]

Vandalism from 74.192.219.178[edit]

74.192.219.178 xwiki-contribs • xwiki-date (alt) • ST • IP info • WHOIS • robtex • gblock • glist • abuselog • bullseye Vandalism observed in gd.wiki, always on gd:user:Alison. Found some more in other projects, that has not been taken care of. Greetings --Sionnach 06:02, 13 July 2008 (UTC)[reply]

Vandalism from 80.193.66.130[edit]

80.193.66.130 xwiki-contribs • xwiki-date (alt) • ST • IP info • WHOIS • robtex • gblock • glist • abuselog • bullseye Vandalism observed in eu.wiki, then I had a closer look and found he is doing this across projects. Found some old vandalized paged that had not yet been reverted in some projects... Best regards, --birdy geimfyglið (:> )=| ∇ 11:37, 7 July 2008 (UTC)[reply]

Page creation vandal: 82.46.8.90[edit]

Bad page creations with a "{{SITENAME}} rapes babies" meme. 82.46.8.90 xwiki-contribs • xwiki-date (alt) • ST • IP info • WHOIS • robtex • gblock • glist • abuselog • bullseye  — Mike.lifeguard | @en.wb 01:31, 5 July 2008 (UTC)[reply]

Retrieved from "https://meta.wikimedia.org/w/index.php?title=Vandalism_reports/Archives/Archive_1&oldid=27101087"