Wikipedia:Long term abuse/Archive 1

From Wikipedia, the free encyclopedia

Archive of Wikipedia:Vandalism in progress/Long term alerts, begun on October 3, 2005:

Contents

[edit] 69.50.160.0/19 at Atrivo Technologies

We've been getting quite a bit of vandalism from someone using various IP addresses at Atrivo Technologies. The primary target has been PL/I but also CGI, PL/SQL and PhpWiki. The vandal has been replacing large sections of these articles with links to porn sites. The ISP's abuse department is at 1-925-550-3947 or abuse@atrivo.com. We need to block this guy. He's making a lot of work for us.

Here are just a few of the instances:

July 20:

July 19:

July 16:

July 7:

July 5

July 4

-- Shoaler 13:50, 20 July 2005 (UTC)

[edit] AOL: 64.12.116.xxx, 64.12.117.xxx

AOL user(s) with addresses in the 64.12.117.xxx range (and occasionally, I think, 64.12.116.xxx). Vandalizes pages, then after someone posts a complaint on the relevant "User talk:" page, acts indignant (to put it mildly), along the lines of "Why are you telling me this?" "Why do you keep sending me this message over and over?" "You're making all the users of this IP range look bad" etc., etc. Often, the user is logged in from a different IP address than the "User talk:" page in question (though still within the same range). This process repeats itself once a week or so (and most recently they went after my own "User:" page).

Comment: The nature of AOL makes each page you visit use a different IP. When a "test" template is left on the usertalk page, usually another user will think that it was left for them. Since users jump from IP to IP without control, it makes it really hard to track down just one person, explaining your problem. MicahMN | Talk 21:03, July 20, 2005 (UTC)
Yes, but the reactions lead me to think that the person complaining is indeed vandalising WP content, and knows that AOL works this way. But now I'm wondering if it is a waste of time to deal with AOL vandals at all, outside of reverting their edits. -- Gyrofrog (talk) 22:19, 20 July 2005 (UTC)

See 64.12.117.5 (talk · contribs · deleted contribs · logs · block user · block log), 64.12.117.8 (talk · contribs · deleted contribs · logs · block user · block log), 64.12.117.10 (talk · contribs · deleted contribs · logs · block user · block log), 64.12.117.12 (talk · contribs · deleted contribs · logs · block user · block log), 64.12.117.13 (talk · contribs · deleted contribs · logs · block user · block log), 64.12.117.14 (talk · contribs · deleted contribs · logs · block user · block log). -- Gyrofrog (talk) 20:16, 16 July 2005 (UTC)

[edit] User:206.213.157.4

Kept vandalizing Hephaestos' user talk page and impersonating some friend of his. I've tried to find out wether it was The truth about hephaestos or not (as seen on his own account). -- Mike Garcia | talk 01:08, 14 Jun 2005 (UTC)

[edit] DNA Vandal

This person registers new accounts as "<<Name of notable person>>'s DNA" and starts vandalizing pages.

  • And most of those notable people seem to be politicians, such as U.S. senators. --Lst27 (talk) 21:34, 18 Jun 2005 (UTC)

Partial list of socks in no real order:

Zzyzx11 (Talk) 05:43, 4 Jun 2005 (UTC)

Added some more that I found in the edit summaries. Thanx 68.39.174.238 15:17, 1 October 2005 (UTC)
  • This vandal has specifically targeted DNA, organelle and chloroplast and their respective talk pages -- all had to be protected. Zzyzx11 (Talk) 06:05, 4 Jun 2005 (UTC)
  • This vandal seems to use multiple IP's to register multiple accounts to coordinate an extensive attack during a specific period of time. Zzyzx11 (Talk) 04:06, 7 Jun 2005 (UTC)
They also hit Mitochondrion once. 68.39.174.238 00:37, 21 November 2005 (UTC)

[edit] 209.122.160.124

Appears to be using articles to message other parties. This IP had OK entries on some comic and computer articles but then periodically vandalizes (most recently various ancient history related articles) with a series of edits within an article. See http://en.wikipedia.org/w/index.php?title=Special:Contributions&target=209.122.160.124 for user contributions. Leonard G. 14:49, 17 May 2005 (UTC)

[edit] 205.188.117.133

Vandalizes Current events every day, gets blocked for 24 hours, waits for the block to expire, comes back and vandalizes Current events again. RickK 08:36, May 14, 2005 (UTC)

[edit] Sneaky link spammer

All edits by this user were attempts to introduce external links to the same bunch of domains which all happen to have virtually identical whois info.

The link spam goes often unnoticed because at first glance, the links seem to be on topic. The user doesn't seem to learn and keeps reintroducing the links, in the case of PHP several times in one day.

Domains include:

  • pspreviewed.com, dsreviewed.com, nesreviews.com
  • gfxvoid.com, flashvoid.com, pocketvoid.com
  • animeluvers.com, pkmncity.com
  • forums100.com, imghst.com
  • phpmini.com

Rl 09:04, 9 May 2005 (UTC)

[edit] 69.140.70.50

69.140.70.50 (talk · contribs · deleted contribs · logs · block user · block log) This user appears to have a static IP, and has repeatedly vandalized both American Civil War and R.E.M. (band) in December 2004 and March 2005. -- BRIAN0918  22:17, 27 Mar 2005 (UTC)

[edit] 137.164.230.61

137.164.230.61 (talk · contribs · deleted contribs · logs · block user · block log) Multiple vandalisms over an extended period. Test3,4 on talk page. -- BRIAN0918  21:41, 23 Mar 2005 (UTC)

[edit] 204.248.16.190

204.248.16.190 (talk · contribs · deleted contribs · logs · block user · block log) Vandalizes only American Civil War. Looks like a static IP. I've done test and test2 on talk page. -- BRIAN0918  16:57, 17 Mar 2005 (UTC)

[edit] 24.69.255.205

24.69.255.205 (talk · contribs · deleted contribs · logs · block user · block log) Vandalized again. As he has done many times in the past. See his talk-page! See the revision of the article "Xenu" 01:56, 19 Feb 2005. IMO, he should be banned, because he was warned enough! --Eleassar777 13:49, 19 Feb 2005 (UTC)

I think this is the IP of many people using dialup in Vancouver (based on Google and many good edits), perhaps the IP should be banned from Xenu only? Ashibaka (tock) 02:35, 11 Mar 2005 (UTC)
SharedIP continuing to vandalise a plenty. -- Solipsist 23:36, 17 Apr 2005 (UTC)

[edit] GNAA

24.73.149.165 (talk · contribs · deleted contribs · logs · block user · block log) The GNAA have written a script called "Wikimolestia" to add minor errors to various articles. So far, it messes up grammar in a fairly obvious manner and changes random numbers. It first ran from 24.73.149.165 - see its contribs for an idea of how the script works. — Dan | Talk 21:06, 5 Feb 2005 (UTC)

81.89.192.140 (talk · contribs · deleted contribs · logs · block user · block log) too. — Dan | Talk 21:13, 5 Feb 2005 (UTC)

[edit] 195.7.3.182

195.7.3.182 (talk · contribs · deleted contribs · logs · block user · block log) Only shows up about once a month, but replaces an entire article with a massive page of spam links. Has no valid edits. RickK 21:59, Jan 30, 2005 (UTC)

[edit] 193.230.222.76

All 14 contributions since December 2004 were vandalism (replacing whole articles with viagra-like drug spam). Everything has been reverted. Candidate for a permanent ban because the IP seems not to be a dial-in. Cacycle 13:21, 22 Jan 2005 (UTC)

[edit] 195.144.131.2

  • Has vandalised about a dozen articles since November and has had repeated warnings. Lumos3 11:35, 7 Dec 2004 (UTC)
  • This IP is used by numerous schools in the UK, more specifically in Essex, and apparently Cambridgeshire as well. Xezbeth 18:33, 15 Dec 2004 (UTC)

[edit] 202.156.2.170

[edit] 217.33.82.4

  • This IP address belongs to a school (which school has never been stated). If we're going to block, make it no more than a half-hour at a time so other students can also get a chance to edit articles in their lunch break, whatever. - Ta bu shi da yu 15:09, 19 Nov 2004 (UTC)
seems to be in Scotland.
If I run an IP search, I get Amsterdam, Netherlands as a result, not Scotland. Mgm|(talk) 22:24, Dec 4, 2004 (UTC)
The IP search in that case only tells you that it falls within a huge set of IPs assigned to Ripe NCC (217.*.*.*) which is based out of Amsterdam. They further assign IPs to other places. If you go to the Ripe site and search for it, it comes up as part of a group assigned to "Western Education and Library Board" in Belfast. DreamGuy 13:57, Dec 11, 2004 (UTC)
Not belfast - it's likely somewhere in Scotland - doing a traceroute from a belfast server, it went out through blfs-t2core-b-pos45.inet.ntl.com (213.105.205.137), then on through the rest of the UK on to mspaccess1-gig0-0-0.edinburgh.fixed.bt.net (62.6.199.8) and 62.172.37.2 before disappearing --PdDemeter 20:32, 11 Jan 2005 (UTC)
  • It is St. Colman's College, Newry. See User Talk:217.33.82.4 some idiot gave a positive ID for it in a recent whole-article bit of vandalism. And they screamed it out on Jan 14 - check this diff page - need I say more? - RHaworth 10:01, 2005 Jan 23 (UTC)
  • 217.33.82.4 still keeps on vandalising articles. Could something be done about it? — JIP | Talk 11:31, 4 Mar 2005 (UTC)

[edit] User:Anonymous6

Uses silly vandalism and writes ridiculous articles. Has had many long term bans.

[edit] Mr. Suffix (Neologisms)

Mr. Suffix edits anonymously, usually from IPs beginning with 69.209, 69.208, and 69.215. Appears to be an Ameritech DSL customer in Wisconsin. He creates neologism articles by taking a word and appending a suffix such as "icle", "polis", or "phobia". See Mikkalai's warning from 13 Feb 2005, titled "69.2xx.xxx.xxx". He's been warned multiple times and continues to create bogus articles. At this point, please block his IP (or post a note here, or let me know) if you catch him in the act. A partial list of his contributions follows (please add new ones to this list). Rhobite 04:29, Feb 20, 2005 (UTC)

  • Choreopolis
  • Phonopolis
  • Retropolis
  • Stereopolis
  • Xeropolis
  • Xylopolis
  • Romantiphobia
  • Phonisicle
  • Fungusicle
  • Polinym
  • Treehouse car
  • Solar panel car (made into a redirect to a normal solar car)
  • Pond muck car
  • French fry car
  • Wario the Quario
  • Contrighway
  • Notumputer

69.209.186.53 blocked for creating Contrighway. Need to check Special:Contributions/69.209.186.53 for additional vandalism when this functionality is restored. Rhobite 23:49, Feb 22, 2005 (UTC)

[edit] 169.229.36.43

has vandalized Hadal's page several times as well as other pages. Puts edit summary "rv vandilisim" or something close to that. Howabout1 17:53, 2 Apr 2005 (UTC)

[edit] User:Arm The Homeless

has vandalized a number of pages, including my user page. I thought this user made a productive contribution in Grahm Junior College, but I think that was just re-adding copyrighted material that had previously been deleted. See Arm The Homeless's contributions. —BenFrantzDale 06:28, Apr 18, 2005 (UTC)

[edit] User:Wikipedia is Communism and socks

see Wikipedia:Long term abuse/Wikipedia is Communism

This chap shows up every now and then. He vandalizes articles and user pages, typically inserting an inlined Image:Hammer_sickle_clean.png captioned with a slogan like "Wikipedia is Communism!". --Tony Sidaway|Talk 16:47, 24 Apr 2005 (UTC)

You'll never catch me, you stupid Tony dork!--Rx Machine 07:05, 31 July 2005 (UTC)

Note: Keep the above message as sock puppet evidence. I do not wish to sign.

Note: I kept that for the repsonse, as there is already a page on him.
Note: There are too many notes for this section.

[edit] Puzzles

All pages relating to puzzles are subject to mass spam and vanity insertions by User:Karlscherer3, who has also used the Ip's User:210.55.230.18 and User:202.37.72.100, and User:210.55.230.20, and User:210.55.230.17, and User:222.152.25.148 (see edits to Turing Machine), and User:219.89.37.58.

--~~~~ 10:55, 23 Jun 2005 (UTC)

[edit] User:NAZISMISNTCOOL

Imposter of legitimate user (User:NazismIsntCool) vandalising Holocaust and User:Natalinasmpf under User:Nazism isn't cool sockpuppet. Geddit? -max rspct 13:51, 6 August 2005 (UTC)

[edit] 161.74.11.24, the Wacko Jacko vandal

161.74.11.24 (talk · contribs · deleted contribs · logs · block user · block log) as repeatedly removed any mention of "Wacko Jacko" from Michael Jackson and has blanked negative commentary on Talk:Michael Jackson for months. A shared IP which belongs to the University of Westminster, London. See User talk:161.74.11.24#"Wacko Jacko" vandal. android79 19:22, August 10, 2005 (UTC)