Wikiquote:Vandalism in progress/Archive/2

From Wikiquote
Jump to navigation Jump to search

General / Misc[edit]

Walter Muncaster[edit]

Article being constantly re-created by vandal 0waldo (talk • contribs • global edits • page moves • block user • block log) and by anons in defiance of VfD. So far we have:

Please delete any new instances and add {{deletedpage}} and protect. jni 16:31, 22 January 2006 (UTC)[reply] 

~ added by Jeff Q (talk) 05:03, 27 January 2006 (UTC)[reply]

130.179.29.152 (talk • contribs • global edits • page moves • block user • block log)[edit]

This user vandalised 34 pages, replacing all text with the letter 'e'. I've reverted the changes and blocked him for a week. ~ UDScott 21:19, 31 January 2006 (UTC)[reply]

168.102.16.179 (talk • contribs • global edits • page moves • block user • block log), DrIdiot (talk • contribs • global edits • page moves • block user • block log)[edit]

Repeatedly adding fabricated quotes to Harry J. Anslinger. Rhobite 02:55, 22 March 2006 (UTC)[reply]

  • This is not a clear case of vandalism, but appears to be a content dispute. No editors involved in this article's edits have yet provided sources or attempted to discuss the issue at Talk:Harry J. Anslinger. I've added one potentially useful source link and posted a request for these editors to discuss the issues on the talk page, rather than participate in add-and-revert cycles. ~ Jeff Q (talk) 09:47, 22 March 2006 (UTC)[reply]

68.101.66.175[edit]

68.101.66.175 (talk • contribs • global edits • page moves • block user • block log) created two pages (Andy conner and Aubrey way) which initially had content along the lines of "i'm gay" for both pages. I tagged both for speedy deletion, and in short time, the tags were removed by the same user, who also posted to Talk:Aubrey way "don't delete it aubrey is really gay" and then made another edit to make it seem as though someone agreed. —LrdChaos 03:25, 6 April 2006 (UTC)[reply]

I've blocked the vandal for 2 days and deleted the attack pages. -- Robert 03:32, 6 April 2006 (UTC)[reply]

Comcast user(s) vandalizing my talk page[edit]

For the past 24 hours, my talk page has been repeatedly vandalized by one or more Comcast users. (I suspect a single dial-up user who is calling different numbers.) The pattern is the same each time: they delete my ARCHIVE INDEX and "Concrete Hippo" sections of my page and replace at least one with the text "Thery ntresting...see more / [links:all]". (The last incident just deleted the archive index, probably because I just archived the "Concrete Hippo" section. This leads me to believe it has something to do with the deleted "Concrete Hippo" article, which was edited by 62.49.16.137 (talk · contributions), UpTheBracket (talk · contributions) (probably the same person as 62.49), and 84.65.155.3 (talk · contributions).) Here are the current offending IP addresses:

I've blocked the most recent one (76.148) for a week as a pattern vandal, but feel uncomfortable doing so, as it's my talk page. The network spread is too large to do a limited net block. I'm not sure what to do about this. ~ Jeff Q (talk) 00:50, 14 April 2006 (UTC)[reply]

Well, here's another day or so of them:

As I've said, I don't feel comfortable blocking people vandalizing my pages, or even warning them unless I believe we will back up the warnings with action, so I'm asking my fellow sysops to help out here. (Thanks to everyone who's been reverting them, and to UDScott for one of the 2 blocks.) ~ Jeff Q (talk) 04:37, 16 April 2006 (UTC)[reply]

I guess I was a bit frazzled and not thinking too clearly in my original post here. Of course these aren't dial-ups; Comcast is a broadband cable connection. I'm not too familiar with it, but I suspect this is an attack through open proxies, with the culprit simply scanning for unsecured and unsuspecting PC users in the Comcast network. Do we have proxy blocking enabled? Should we? Meanwhile, I'm surpressing my scruples and have started blocking these IP addresses for 1 week when they pop up. I'd appreciate some help in developing a better response to this problem. ~ Jeff Q (talk) 05:04, 17 April 2006 (UTC)[reply]

CrestvilIe (talk • contribs • global edits • page moves • block user • block log)[edit]

Just a heads up from over the fence. He has created an account - User:CrestvilIe - with a name similar to mine (in lowercase it is indistinguishable but in upper case you can see I am CRESTVILLE while he is CRESTVILIE). He has then proceeded to vandelise pages on wikiquote and the 'pedia.

Despite the obvious silly trick I then proceeded to recieve messages on wikipedia from a new user called w:User:Wazzawazzawaz - who had not even taken the time to create a convincing userpage - accusing me of the vandelism, despite the fact that if they had followed the link on the history page it would have taken them to the imposters page. This continued with my imposter vandelising something, then a few minites later wazzer would reappear and chastise me for it. It seems clear to me that wazzawazzawaz or whatever is a sockpuppet for my impersonater and this is just some silly joke. I must say, however, it is flattering to have both an imposter and a stalker. I must be a mini-wiki celeb.--Crestville 00:24, 8 July 2006 (UTC)[reply]

Approximately two hours ago I placed a three-month block on the vandal impersonating your name based on what this person was doing in tandem with repeat vandal 216.164.203.90. As for Wazzawazzawaz, this person has been permanently blocked on Wikiquote (as a WoW-related vandal) since the middle of June. - InvisibleSun 00:46, 8 July 2006 (UTC)[reply]
Crestville (good guy) was referring to WP's Wazzawazzawaz, not WQ's, so I've fixed the link above. Our Wazzawazzawaz did something similar (except for the user impersonation), which is how that account was blocked. I have made the block on CrestvilIe (bad guy) permanent based on WQ:BP, user impersonation clause. ~ Jeff Q (talk) 01:19, 8 July 2006 (UTC)[reply]

UPDATE: CrestvilIe has been identified by w:User:Essjay (using Checkuser) as one of many aliases of w:User:216.164.203.90, who is also connected to our Wazzawazzawaz AND the Hotpussy/Coldcat incident below, as well as many other similar sockpuppet vandalisms at Wikipedia. ~ Jeff Q (talk) 01:17, 10 July 2006 (UTC)[reply]

Coldcat (talk • contribs • global edits • page moves • block user • block log)[edit]

Here's a situation that concerns me, as it may be a double-backup disruption attempt. Coldcat (a name that doesn't yet exist on WP) created the sockpuppet Paul_August (talk • contribs • global edits • page moves • block user • block log) immediately after creating his own username, apparently to impersonate w:User:Paul August, then proceeded to vandalize using the latter username. Kalki quickly blocked the actual vandalizing user, but as Coldcat created the vandalizing sockpuppet, I blocked him for 3 days and left a warning. HOWEVER, there may be yet another username involved. Just before Coldcat was created, Hotpussy (talk · contributions) was also created. (Note the parallel structure of the names.) This is another username not currently on WP, so there is nothing to be deduced from the name, although its provocative English meaning is suspicious. (It's like those of quite a few vandals, but there are some legitimate editors who like to tweak the sensibilities of other wikians, too.) Because it's at least possible that a vandal, watching the new-user log, saw the creation of Hotpussy and decided to start his 2-level disruption by choosing a parallel name from a brand-new legitimate user (yeah, right), I've posted a "caution" to Hotpussy that their username may have been used as a basis for some disruption, along with apologies if this is not the case. (I didn't think a block was prudent or even permissable under the circumstances, given the lack of evidence.) But I feel we need to keep an eye on that ID as well, just in case. ~ Jeff Q (talk) 14:42, 9 July 2006 (UTC)[reply]

I see that we have several sysops involved in this matter already, and that all three accounts (and the IP address beneath them) have been blocked. This is a very complicated situation. Hotpussy, Coldcat, and impersonator Paul August were all created within 3 minutes of each other, August directly by Coldcat. Now the Hotpussy block resulted in a complaint from 216.164.203.90 (talk · contributions), who has already been connected to a similar 2-user disruption scheme (see User talk:Wazzawazzawaz#Investigating user complaint). Furthermore, 216.164.203.90 has shown a mysterious ability to evade IP blocks. We need to find out how this is happening. ~ Jeff Q (talk) 15:41, 9 July 2006 (UTC)[reply]

UPDATE: I checked out 216.164.203.90 on Wikipedia and found much more interesting stuff there, namely that this IP is claimed by w:User:Nookdog, who is a past vandal but professes to be reformed. Apparently, he is trying to establish a good relationship through work on Wikinews, and has managed to get unblocked on Wikipedia. Or rather, had. As our own Essjay, veteran vandal vanquisher, had unblocked the "reformed" vandal on WP two days ago, I thought he might be interested in this Wikiquote activity. He replied:

… I went back and checked into the IP, and there is no question about it: A massive amount of vandalism is coming in off that IP, dozens of accounts created, and Nookdog is right in the middle of it. If we had a checkuser on Wikiquote, I suspect a very similar result would appear.
I'll leave the decision about what to do with him on Wikiquote to those of you who are a bit more active, but as for here, I'm blocking the IP and reporting the whole mess on ANI for a decision on what to do with Nookdog. Essjay (Talk • Connect) 16:35, 9 July 2006 (UTC)[reply]

He also suggested the IP unblocking may have occurred because, if I understand him correctly, other accounts created by 216.164.203.90 had non-permanent blocks that expired, removing the block on the IP (as MediaWiki doesn't distinguish between autoblocks and explicit blocks). ~ Jeff Q (talk) 17:02, 9 July 2006 (UTC)[reply]

P.S. Essay's and my discussion is at w:User talk:Essjay#Problems with 216.164.203.90/Nookdog, and Essjay's report to the Incidents noticeboard is at w:WP:ANI#216.164.203.90 & Nookdog. ~ Jeff Q (talk) 00:38, 10 July 2006 (UTC)[reply]

Just for the sake of clarity, let me offer a little explanation of what I think happened with the blocks:
  • Someone blocked 216.164.203.90 for a certain period, say 48 hours.
  • Next, one of the sockpuppet accounts tried to edit with that IP, but couldn't because the account was blocked.
  • As a result, the MediaWiki software set an autoblock on the IP for 24 hours. As is the case with autoblocks, it wasn't recorded in the IP's blocklog, and showed up on Special:Ipblocklist as "#XXXXX" (I have no idea what the actual number code was, it's not something you're able to figure out, for security reasons, i.e., so you can't know what IP a given user is using).
  • When the autoblock expired after 24 hours, it cleared the block on 216.164.203.90 as well; to the software, there is no difference between a block set directly on 216.164.203.90, and an autoblock set on that IP but masked as "#XXXXX". The software automatically clears all blocks on a given IP when the first block expires, in this case, the autoblock.
Hopefully my explanation is clear; if it isn't, let me know and I'll try again. Also, for those not familiar with the inner-workings of autoblocks, there is a good essay on Wikipedia about them at w:Wikipedia:Autoblock. Essjay (Talk • Connect) 00:26, 11 July 2006 (UTC)[reply]

One more note: I noticed at w:User talk:216.164.203.90#No_block that this IP got another WP sysop to unblock his address at 22:21, 7 July 2006 (UTC), for which he thanked the sysop at 23:02, 7 July 2006 (UTC). 19 minutes later, we got the CrestvilIe storm described above. These accounts were all blocked, but I notice that users Deviant 93 and Blankname were also created after the unblocking, 1 minute before 216's thank-you posting to his WP talk page, and 20 minutes before the CrestvilIe incident. Consider the following:[reply]

  • Blankname is very similar to "MyName", which is 216/w:User:Nookdog's registered name on WikiNews. "Deviant" is a common provocative name for vandals.
  • The pattern of multiple-user creation has been repeated twice here by this IP, and apparently many other times on WP.
  • On 7 July, WQ gained 33 new usernames, an average of 1 every 24 minutes. Shortly after 21:00, we had 5 new usernames registered: 1 confirmed vandal, 2 suspicious usernames, and 2 others (Raze, Metrosenior) that occurred during a 3-minute gap in CrestvilIe's edit history. (That's 1/6th of our new users registered in 1/100th of the day, not unusual for busy days, but very unusual for this day.)

This doesn't rise above the level of a general suspicion, but given this vandal's well-established predilection for registering multiple sockpuppets in a session, we may want to keep an eye on these accounts, especially when the block on 216 is lifted. ~ Jeff Q (talk) 01:37, 10 July 2006 (UTC)[reply]

63.23.5.5 (talk • contribs • global edits • page moves • block user • block log)[edit]

As you can see by looking at this IP user's contribution page, he or she has been vandalizing all day today (8/17/2006):

http://en.wikiquote.org/w/index.php?title=Special:Contributions&target=63.23.5.5

  • Thank you for the report. A point of correction: this spate of vandalism only occurred over a period of 6 minutes, and the IP has already been blocked for 1 week by Kalki. This appears to be one or more people from the 63.23.x.x network who are engaging in vandalism against specific users and in copycatting a particular pattern vandalism. We are actively monitoring this situation. ~ Jeff Q (talk) 23:28, 17 August 2006 (UTC)[reply]


User:Ghettogirl (talk • contribs • global edits • page moves • block user • block log)[edit]

I have suspicion the user:Cute 1 4 u is user:Ghettogirl. User:Ghettogirl was blocked indef on Wikipedia for being a sockpuppet of a user that is also a sockpuppet of Cute 1 4 u, who is blocked indef on Wikipedia and other Wiki projects. Please keep an eye on these users. FWN 22:59, 15 November 2006 (UTC)[reply]

Thanks for the note. We are aware of the problems on Wikipedia with these two usernames. Thus far, neither Cute 1 4 u (talk · contributions) nor Ghettogirl has engaged in any disruptive behavior here. We try to give users the benefit of the doubt and generally don't take action on a cross-project "problem" user unless they misbehave on our project. ~ Jeff Q (talk) 06:21, 16 November 2006 (UTC)[reply]

Johnny the Vandal[edit]

Johnny_the_Vandal (talk • contribs • global edits • page moves • block user • block log) - page move vandal attacking several user pages. Archer7 12:46, 23 November 2006 (UTC)[reply]

Thanks for the notice. We've blocked and reverted the edits of both this username and its alter-ego Johnny_the_American_Guy (talk • contribs • global edits • page moves • block user • block log). ~ Jeff Q (talk) 13:19, 23 November 2006 (UTC)[reply]

164.92.250.8 (talk • contribs • global edits • page moves • block user • block log)[edit]

I believe IP 164.92.250.8 has vandalised the "Irish Proverbs" wikiquote page. I am sorry if this post is incorrect or in the wrong format, but I am also pretty sure that there are no Irish proverbs that translate to "no blacks in my crib byotch" or "one time i cummed all over a zebra". Once again, this is my first attempt at any post, so please forgive any mistakes I may have made. —The preceding unsigned comment was added by 63.167.255.231 (talk • contribs) 19:58, 14 December 2006 (UTC)

Thanks for reporting this. I have reverted the edits and posted a warning on the user's Talk page. ~ UDScott 20:01, 14 December 2006 (UTC)[reply]

Spammers[edit]

71.131.187.253 (talk • contribs • global edits • page moves • block user • block log)[edit]

This user spammed Talk:Abortion with an ad for pharmaceuticals. Catamorphism 20:31, 24 January 2006 (UTC)[reply]

24.232.170.151 (talk • contribs • global edits • page moves • block user • block log)[edit]

Spammed Talk:Abortion. Catamorphism 19:17, 27 January 2006 (UTC)[reply]

Retrieved from "https://en.wikiquote.org/w/index.php?title=Wikiquote:Vandalism_in_progress/Archive/2&oldid=477362"