Jump to content

Wikinews:Requests for CheckUser/Archive 5

Add links
From Wikinews, the free news source you can write!

Spam bot?

[edit]

I'm wondering if this seeming user-page-spam bot is technically related to others of our recent plague of such.

Unrelated - No evidence of any other users created on the IP addresses (or ranges thereof) used by above user. --Skenmy talk 23:15, 26 December 2012 (UTC)[reply]
Confirmed - Laurencz47 (talk • contribs • deleted contribs • logs • block user • block log • checkuser) found with 1 edit (deleted). Matches username pattern, edit looked spammy - pre-emptively blocked. --Skenmy talk 17:49, 27 December 2012 (UTC)[reply]

Random username spambot

[edit]

I just squashed a bunch of linkspam, with accounts that look in the pattern of these 'sleep then spam' ones. Here's the blocked users:

And, suspect new usernames in RC:

I'm probably wrong on some of the above, but I've not kept on-top of the patterns used in 'farming' accounts for spamming. I assume the issue is still being kept tabs on via checkuser-l. --Brian McNeil / talk 12:53, 15 January 2013 (UTC)[reply]

Generically speaking, much of MW spambottage is managed via AbuseFilter, though I see en.WN is a bit behind on filter development. - Amgine | t 16:07, 15 January 2013 (UTC)[reply]
The abuse filter is little noticed on Wikinews, except for ire directed its way from time to time. I've still not forgotten when I discovered it wouldn't let me make large additions to any article involving Liverpool, due to matching "poo". --Pi zero (talk) 16:28, 15 January 2013 (UTC)[reply]
<gg!> Nice... I hope you fixed that one? - Amgine | t 17:22, 15 January 2013 (UTC)[reply]
Iirc, I disabled it (once I figured out how). --Pi zero (talk) 18:18, 15 January 2013 (UTC)[reply]

Another just blocked, like to know if related:

Results

  • Adeline80 shares an IP with LamontCham, but have different almost definitely spoofed useragents.
  • Phanthuydung2021 = Dungngheo with Vietnam ips
  • NumbersHo = JordanMar =RubenNola
  • Bxthnmag01, Xtaiokrtr, Akhileshonly123 are not using a Chinese ip, but rather ones from other Asian countries.
  • Bxthnmag01 is a likely hacked pc.
  • Hilda144, Sayed119, NumbersHo share a (non-Asian) country.
  • No other direct matches, but other than those noted above all are using random Chinese ips--Cspurrier (talk) 19:47, 16 January 2013 (UTC)[reply]

Yet more spambots

[edit]
Done Bxthnmag01=Seiprty34=Mavosef88=Shlakesha16=Mavosef35=Binc142cqs, Onlinepk16=Louiszro31, Outle9683=Buycwi112=Shoppingtr09. Very high chance that they all match each other and our past spammers as well. Still using a wide range of Chinese and Japanese ips
Confirmed--Cspurrier (talk) 03:20, 26 January 2013 (UTC)[reply]
Confirmed--Cspurrier (talk) 22:07, 29 January 2013 (UTC)[reply]
Confirmed--Cspurrier (talk) 03:11, 30 January 2013 (UTC)[reply]
Confirmed--Cspurrier (talk) 00:15, 31 January 2013 (UTC)[reply]
Confirmed It is very Whac-A-Mole, unfortunately it appears they have access to a massive collection of Chinese ips. In the ones I have CUed there is very little direct ip overlap and only occasional subnet matches. The only thing I can see that will really block them is by blocking nearly all of China (which of course is unacceptable). We may want to play with abusefilter a bit for blocking this username pattern, but that might just result in less predictable usernames to block.--Cspurrier (talk) 18:40, 31 January 2013 (UTC)[reply]


Judging by the username pattern and their spam, the following might be related as well:

By the way, I've recently filed this CU request on Meta for similar spambots on Outreach, so there might be more information available. Mathonius (talk) 06:57, 4 February 2013 (UTC)[reply]

Confirmed all above. Still no blockable ranges, just lots of China Telecom ips --Cspurrier (talk) 20:00, 4 February 2013 (UTC)[reply]

Confirmed--Cspurrier (talk) 21:10, 5 February 2013 (UTC)[reply]

Confirmed CHINANET ones this time.--Cspurrier (talk) 01:00, 19 February 2013 (UTC)[reply]

Confirmed Dbjosef46 matches the earlier spam from Japan. The rest are the same Chinese spammers. --Cspurrier (talk) 08:43, 22 February 2013 (UTC)[reply]

  1. Confirmed
  2. Exposed and found other Confirmed accounts.
  3. Did a rangeblock on the Confirmed multiple accounts and redirected them to the sockmaster userpage.
  4. Tagged socks to the sockmaster userpage.

Cheers, -- Cirt (talk) 02:46, 24 February 2013 (UTC)[reply]

Confirmed --Cspurrier (talk) 20:59, 24 February 2013 (UTC)[reply]

Confirmed Nbjosef46 matches the spammer from Japan. The others are the same Chinese spammers.--Cspurrier (talk) 00:16, 28 February 2013 (UTC)[reply]

Confirmed--Cspurrier (talk) 15:57, 28 February 2013 (UTC)[reply]

Confirmed--Cspurrier (talk) 19:18, 28 February 2013 (UTC)[reply]

Confirmed Kljosef46 and Ydrugll35 match Japan spammer, the others are match to the Chinese spam. --Cspurrier (talk) 21:26, 4 March 2013 (UTC)[reply]

Confirmed, had 2 other socks, blocked all 3 of those. -- Cirt (talk) 19:08, 5 March 2013 (UTC)[reply]
Unlikely Different region, but probably open proxies. --Cspurrier (talk) 08:31, 17 May 2013 (UTC)[reply]
Confirmed China spammer--Cspurrier (talk) 06:22, 18 May 2013 (UTC)[reply]
Arbitrary section break
[edit]
Confirmed, -- Cirt (talk) 05:15, 17 June 2013 (UTC)[reply]
Confirmed, blocked, further investigation continued, blocked some rangeblocks. -- Cirt (talk) 16:55, 30 July 2013 (UTC)[reply]

Vandal self-identifying as Diego Grez

[edit]

Related to Diego's account? (Or... there was another one claiming to be Diego a few weeks(?) back, I think?)

Done Region match and iirc isp match--Cspurrier (talk) 15:47, 8 January 2013 (UTC)[reply]

Username t0rll

[edit]
Plus, the IP for the user creation shared on checkuer-l to establish which user is doing the cross-wiki trolling. --Brian McNeil / talk 12:50, 8 January 2013 (UTC)[reply]
Done no match to anything. Does not appear to be an open proxy. --Cspurrier (talk) 15:41, 8 January 2013 (UTC)[reply]

Possible block evasion

[edit]

An article created by currently blocked user Starship9000 has just been recreated by 74.131.177.233. This quacks very like block evasion. Is there technical evidence to support that hypothesis? --Pi zero (talk) 19:55, 6 March 2013 (UTC)[reply]

Confirmed that Starship9000 (talk · contribs) was carrying out block evasion, and one underlying IP was blocked. -- Cirt (talk) 22:03, 6 March 2013 (UTC)[reply]
Just as a FYI, Starship9000 was locked globally, so that account will no longer be editing. --Rschen7754 03:18, 23 March 2013 (UTC)[reply]
I indeffed the IP address yesterday as it edited to request user page deletion. (Did honour the deletion request.) --LauraHale (talk) 20:26, 24 March 2013 (UTC)[reply]
Reduced the IP block from indef to one year. -- Cirt (talk) 15:16, 30 March 2013 (UTC)[reply]

Computron

[edit]

I would like a checkuser for Computron to confirm they are not User:Thepoliticalmaster, User:Onewhohelps and User:Surasaman. If this is confirmed, the existence of the Computron account would be in violation of the global ban from all Wikimedia Foundation projects.

At this point in time, there are a number of people on project who openly believe that Computron is Onewhohelps. This is damaging for project morale because, if true, it implies preferential treatment is being given to a known sockpuppet by knowingly let them edit without first discussing whether the global block restriction should be lifted locally.

Computron has admitted on IRC to knowing Onewhohelps, whom Computron said was a nice girl he knows from high school. (This is pretty impossible, given Surasaman started editing in 2006.) Computron is also exhibiting behaviors similar to Onewhohelps, such as creating petty little conflicts, whining about the lack of attention being paid to him, exhibiting the traits of a newbie while demonstrating expert knowledge and an inability to learn no matter how much guidance is being provided. This sort of picking little squabbles has gone on since a few weeks after they arrived on the project, with my first notice of it shortly after the query regarding the relationship with Onewhohelps was made. There were then veiled nasty comments directed at them. Onewhohelps also has a history of using IRC to pick fights. Computron is continuing in this vein. While Pi zero believes Computron just needs time to learn policy and is bending over backwards to assist this user, Computron's behavior is exactly the sort documented on English Wikipedia where a user similar to Pi Zero bent over backwards to assist the sock to no avail.

This issue really needs to be cleared up given that Computron has repeatedly contacted people to request for permission to upload non-free images to Wikinews locally (without asking for free licenses first, or encouraging the person to upload to Commons) which means they could not be republished elsewhere. --LauraHale (talk) 03:04, 23 March 2013 (UTC)[reply]

I agree that the suspicion is out there, and is detrimental to everyone including Computron. So for everyone's sake it ought to be resolved if possible.
(I'm not bending over backwards, thankyou, any more than I do with anyone else — said the person with the permanent posture problem. :-) --Pi zero (talk) 03:25, 23 March 2013 (UTC)[reply]
Inconclusive They share a country, but beyond that the data is all over the place. Both have used a number of ISPs and different systems with no overlap, but this result is not surprising given the gap between datasets. --Cspurrier (talk) 03:41, 23 March 2013 (UTC)[reply]

Flaming cats

[edit]

Latest batch.

Confirmed as socks of w:User:Dantherocker1. Please create or update AbuseFilter to help alleviate this. -- Cirt (talk) 20:02, 4 May 2013 (UTC)[reply]

Giovanni Pergolesi

[edit]

Quacks like socking. User claims on xyr user page to be a ten-year-old. Did a bunch of vandalism in a short time, one of those being addition to User talk:Matthewedwards of tag {{sockpuppet|WickyLicky|blocked}}.

Nothing else showing up, unless you can give more evidence of what other accounts it may be linked to. -- Cirt (talk) 05:21, 3 May 2013 (UTC)[reply]

Kitties new IPs

[edit]

I've no prior experience with blocking re the new IPs. What's the best way to approach them? We've had two of them (so far) in the past few days doing vandalism featuring 'kittiesonfire'. --Pi zero (talk) 22:52, 4 July 2013 (UTC)[reply]

Dan/kitties

[edit]

Following User:MasturbatingZebra yesterday, today we've

Confirmed, -- Cirt (talk) 15:39, 27 July 2013 (UTC)[reply]

A new set; please check for sleepers and block underlying IPs:

Presumably all related:

—Mikemoral♪♫ 01:22, 30 October 2013 (UTC)[reply]

Tenacious spammer

[edit]

Not content with putting spam on xyr own user page, this one Keeps going back to the same user page. Anything underlying one could block?

--Pi zero (talk) 11:14, 15 September 2013 (UTC)[reply]

Agroupaccount

[edit]

Obviously inappropriate username "A group account", admits account is controlled by a "group" in violation of m:Role account.

Please check for other underlying sockpuppets, there is a possible cross-wiki sockfarm going on here...

Thank you,

-- Cirt (talk) 07:55, 16 December 2013 (UTC)[reply]

Done, no other accounts. --Cspurrier (talk) 00:12, 6 January 2014 (UTC)[reply]

Seemingly matched set

[edit]

Four accounts today all created user pages that don't remotely match the user names, and have the collective feel of someone messing around. I'd like to know if they're related, and of course if anything can be done about the underlying IP(s).

Retrieved from "https://en.wikinews.org/w/index.php?title=Wikinews:Requests_for_CheckUser/Archive_5&oldid=2405420"