Wikinews:Requests for CheckUser/Archive 5

Spam bot?
I'm wondering if this seeming user-page-spam bot is technically related to others of our recent plague of such.
 * --Pi zero (talk) 19:38, 26 December 2012 (UTC)
 * ❌ - No evidence of any other users created on the IP addresses (or ranges thereof) used by above user. -- Sken   my talk 23:15, 26 December 2012 (UTC)


 * --Pi zero (talk) 17:07, 27 December 2012 (UTC)
 * ✅ - found with 1 edit (deleted). Matches username pattern, edit looked spammy - pre-emptively blocked. --  Sken   my talk 17:49, 27 December 2012 (UTC)

Random username spambot
I just squashed a bunch of linkspam, with accounts that look in the pattern of these 'sleep then spam' ones. Here's the blocked users:
 * (created by the prior account listed here.)
 * (created by the prior account listed here.)
 * (created by the prior account listed here.)

And, suspect new usernames in RC:

I'm probably wrong on some of the above, but I've not kept on-top of the patterns used in 'farming' accounts for spamming. I assume the issue is still being kept tabs on via checkuser-l. --Brian McNeil / talk 12:53, 15 January 2013 (UTC)


 * Generically speaking, much of MW spambottage is managed via AbuseFilter, though I see en.WN is a bit behind on filter development. -  Amgine | t 16:07, 15 January 2013 (UTC)


 * The abuse filter is little noticed on Wikinews, except for ire directed its way from time to time. I've still not forgotten when I discovered it wouldn't let me make large additions to any article involving Liverpool, due to matching "poo".  --Pi zero (talk) 16:28, 15 January 2013 (UTC)
 * &lt;gg!&gt; Nice... I hope you fixed that one? -  Amgine | t 17:22, 15 January 2013 (UTC)
 * Iirc, I disabled it (once I figured out how). --Pi zero (talk) 18:18, 15 January 2013 (UTC)

Another just blocked, like to know if related: Results
 * --Pi zero (talk) 02:34, 16 January 2013 (UTC)
 * and another. --Pi zero (talk) 12:40, 16 January 2013 (UTC)
 * Adeline80 shares an IP with LamontCham, but have different almost definitely spoofed useragents.
 * Phanthuydung2021 = Dungngheo with Vietnam ips
 * NumbersHo = JordanMar =RubenNola
 * Bxthnmag01, Xtaiokrtr, Akhileshonly123 are not using a Chinese ip, but rather ones from other Asian countries.
 * Bxthnmag01 is a likely hacked pc.
 * Hilda144, Sayed119, NumbersHo share a (non-Asian) country.
 * No other direct matches, but other than those noted above all are using random Chinese ips--Cspurrier (talk) 19:47, 16 January 2013 (UTC)

Yet more spambots

 * --Pi zero (talk) 13:43, 17 January 2013 (UTC)
 * --Pi zero (talk) 02:41, 19 January 2013 (UTC)
 * --Pi zero (talk) 22:46, 19 January 2013 (UTC)
 * --Pi zero (talk) 16:54, 21 January 2013 (UTC)
 * --Pi zero (talk) 03:00, 24 January 2013 (UTC)
 * --Pi zero (talk) 19:36, 24 January 2013 (UTC)
 * ✅ Bxthnmag01=Seiprty34=Mavosef88=Shlakesha16=Mavosef35=Binc142cqs, Onlinepk16=Louiszro31, Outle9683=Buycwi112=Shoppingtr09. Very high chance that they all match each other and our past spammers as well. Still using a wide range of Chinese and Japanese ips


 * --Pi zero (talk) 02:51, 26 January 2013 (UTC)
 * --Pi zero (talk) 02:53, 26 January 2013 (UTC)
 * ✅--Cspurrier (talk) 03:20, 26 January 2013 (UTC)


 * I think there were a couple of other accounts with similarly spambot-ish names created at about the same time. --Pi zero (talk) 21:09, 29 January 2013 (UTC)
 * Probably this was what I was thinking of. --Pi zero (talk) 21:35, 29 January 2013 (UTC)
 * ✅--Cspurrier (talk) 22:07, 29 January 2013 (UTC)


 * --Pi zero (talk) 00:22, 30 January 2013 (UTC)
 * ✅--Cspurrier (talk) 03:11, 30 January 2013 (UTC)
 * --Pi zero (talk) 00:22, 30 January 2013 (UTC)
 * ✅--Cspurrier (talk) 03:11, 30 January 2013 (UTC)


 * --Pi zero (talk) 23:47, 30 January 2013 (UTC)
 * ✅--Cspurrier (talk) 00:15, 31 January 2013 (UTC)


 * This is very . --Pi zero (talk) 00:20, 31 January 2013 (UTC)
 * --Pi zero (talk) 03:33, 31 January 2013 (UTC)
 * --Pi zero (talk) 13:51, 31 January 2013 (UTC)
 * --Pi zero (talk) 17:58, 31 January 2013 (UTC)
 * ✅ It is very Whac-A-Mole, unfortunately it appears they have access to a massive collection of Chinese ips. In the ones I have CUed there is very little direct ip overlap and only occasional subnet matches. The only thing I can see that will really block them is by blocking nearly all of China (which of course is unacceptable). We may want to play with abusefilter a bit for blocking this username pattern, but that might just result in less predictable usernames to block.--Cspurrier (talk) 18:40, 31 January 2013 (UTC)


 * --Pi zero (talk) 18:22, 3 February 2013 (UTC)
 * --Pi zero (talk) 19:19, 3 February 2013 (UTC)
 * --Pi zero (talk) 20:38, 3 February 2013 (UTC)
 * --Pi zero (talk) 20:54, 3 February 2013 (UTC)
 * --Pi zero (talk) 22:53, 3 February 2013 (UTC)
 * --Pi zero (talk) 00:43, 4 February 2013 (UTC)
 * --Pi zero (talk) 01:52, 4 February 2013 (UTC)
 * --Pi zero (talk) 01:52, 4 February 2013 (UTC)

Judging by the username pattern and their spam, the following might be related as well: By the way, I've recently filed this CU request on Meta for similar spambots on Outreach, so there might be more information available. Mathonius (talk) 06:57, 4 February 2013 (UTC)

✅ all above. Still no blockable ranges, just lots of China Telecom ips --Cspurrier (talk) 20:00, 4 February 2013 (UTC)
 * --Pi zero (talk) 12:07, 4 February 2013 (UTC)
 * --Pi zero (talk) 12:07, 4 February 2013 (UTC)
 * --Pi zero (talk) 12:07, 4 February 2013 (UTC)
 * --Pi zero (talk) 12:07, 4 February 2013 (UTC)

✅--Cspurrier (talk) 21:10, 5 February 2013 (UTC)
 * --Pi zero (talk) 11:59, 5 February 2013 (UTC)

✅ CHINANET ones this time.--Cspurrier (talk) 01:00, 19 February 2013 (UTC)
 * --Pi zero (talk) 14:52, 18 February 2013 (UTC)
 * --Pi zero (talk) 17:38, 18 February 2013 (UTC)

✅ Dbjosef46 matches the earlier spam from Japan. The rest are the same Chinese spammers. --Cspurrier (talk) 08:43, 22 February 2013 (UTC)
 * --Pi zero (talk) 13:16, 20 February 2013 (UTC)
 * --Pi zero (talk) 17:51, 21 February 2013 (UTC)
 * --Pi zero (talk) 19:03, 21 February 2013 (UTC)
 * --Pi zero (talk) 20:10, 21 February 2013 (UTC)

Cheers, -- Cirt (talk) 02:46, 24 February 2013 (UTC)
 * --Pi zero (talk) 15:17, 22 February 2013 (UTC)
 * --Pi zero (talk) 04:51, 23 February 2013 (UTC)
 * 1) Exposed and found other ✅ accounts.
 * 2) Did a rangeblock on the ✅ multiple accounts and redirected them to the sockmaster userpage.
 * 3) Tagged socks to the sockmaster userpage.
 * 1) Tagged socks to the sockmaster userpage.

✅ --Cspurrier (talk) 20:59, 24 February 2013 (UTC)
 * Different, yet same. --Pi zero (talk) 19:46, 24 February 2013 (UTC)

✅ Nbjosef46 matches the spammer from Japan. The others are the same Chinese spammers.--Cspurrier (talk) 00:16, 28 February 2013 (UTC)
 * --Pi zero (talk) 12:05, 27 February 2013 (UTC)
 * --Pi zero (talk) 22:18, 27 February 2013 (UTC)
 * --Pi zero (talk) 22:18, 27 February 2013 (UTC)

✅--Cspurrier (talk) 15:57, 28 February 2013 (UTC)
 * --Pi zero (talk) 11:51, 28 February 2013 (UTC)
 * --Pi zero (talk) 15:20, 28 February 2013 (UTC)
 * --Pi zero (talk) 15:20, 28 February 2013 (UTC)

✅--Cspurrier (talk) 19:18, 28 February 2013 (UTC)
 * --Pi zero (talk) 17:06, 28 February 2013 (UTC)

✅ Kljosef46 and Ydrugll35 match Japan spammer, the others are match to the Chinese spam. --Cspurrier (talk) 21:26, 4 March 2013 (UTC)
 * --Pi zero (talk) 21:08, 28 February 2013 (UTC)
 * --Pi zero (talk) 13:15, 1 March 2013 (UTC)
 * --Pi zero (talk) 13:52, 3 March 2013 (UTC)
 * --Pi zero (talk) 12:31, 4 March 2013 (UTC)
 * --Pi zero (talk) 12:31, 4 March 2013 (UTC)


 * --Pi zero (talk) 12:07, 5 March 2013 (UTC)
 * ✅, had 2 other socks, blocked all 3 of those. -- Cirt (talk) 19:08, 5 March 2013 (UTC)


 * --Pi zero (talk) 11:43, 6 March 2013 (UTC)}}
 * ✅, -- Cirt (talk) 15:22, 6 March 2013 (UTC)


 * --Pi zero (talk) 13:04, 8 March 2013 (UTC)
 * ✅. And for the record, the China-spammer is the same as the Japan-spammer. -- Cirt (talk) 18:38, 8 March 2013 (UTC)
 * ✅. And for the record, the China-spammer is the same as the Japan-spammer. -- Cirt (talk) 18:38, 8 March 2013 (UTC)


 * --Pi zero (talk) 12:49, 11 March 2013 (UTC)
 * ✅--Cspurrier (talk) 19:49, 11 March 2013 (UTC)
 * ✅--Cspurrier (talk) 19:49, 11 March 2013 (UTC)


 * --Pi zero (talk) 04:12, 14 March 2013 (UTC)
 * ✅--Cspurrier (talk) 18:59, 14 March 2013 (UTC)


 * --Pi zero (talk) 12:24, 15 March 2013 (UTC)
 * ✅--Cspurrier (talk) 18:21, 15 March 2013 (UTC)


 * --Pi zero (talk) 16:53, 24 March 2013 (UTC)
 * ✅--Cspurrier (talk) 17:48, 24 March 2013 (UTC)


 * --Pi zero (talk) 16:16, 25 March 2013 (UTC)
 * --Pi zero (talk) 11:15, 26 March 2013 (UTC)
 * ✅--Cspurrier (talk) 18:07, 26 March 2013 (UTC)


 * ❌--Cspurrier (talk) 02:34, 28 March 2013 (UTC)
 * --Pi zero (talk) 13:09, 27 March 2013 (UTC)
 * ✅--Cspurrier (talk) 02:34, 28 March 2013 (UTC)
 * ✅--Cspurrier (talk) 02:34, 28 March 2013 (UTC)


 * --Pi zero (talk) 19:00, 29 March 2013 (UTC)
 * ✅--Cspurrier (talk) 20:38, 29 March 2013 (UTC)
 * --LauraHale (talk) 22:40, 29 March 2013 (UTC)
 * ✅--Cspurrier (talk) 22:52, 29 March 2013 (UTC)
 * --Pi zero (talk) 19:00, 29 March 2013 (UTC)
 * ✅--Cspurrier (talk) 20:38, 29 March 2013 (UTC)
 * --LauraHale (talk) 22:40, 29 March 2013 (UTC)
 * ✅--Cspurrier (talk) 22:52, 29 March 2013 (UTC)
 * --LauraHale (talk) 22:40, 29 March 2013 (UTC)
 * ✅--Cspurrier (talk) 22:52, 29 March 2013 (UTC)


 * --Pi zero (talk) 23:49, 29 March 2013 (UTC)
 * ✅--Cspurrier (talk) 23:57, 29 March 2013 (UTC)


 * --Pi zero (talk) 00:54, 30 March 2013 (UTC)
 * ✅--Cspurrier (talk) 15:26, 30 March 2013 (UTC)


 * --Pi zero (talk) 17:22, 31 March 2013 (UTC)
 * ✅--Cspurrier (talk) 20:17, 31 March 2013 (UTC)


 * --Pi zero (talk) 02:30, 1 April 2013 (UTC)
 * ✅. The spammer is still using a variety of ips assigned to DSL providers in China. There does also appear to be several non-spammers in the same ip range, so it looks like we are still stuck with whack-a-mole style handling. --Cspurrier (talk) 03:25, 1 April 2013 (UTC)


 * --Pi zero (talk) 22:13, 1 April 2013 (UTC)
 * --Pi zero (talk) 23:45, 3 April 2013 (UTC)
 * --Pi zero (talk) 23:51, 3 April 2013 (UTC)
 * --Pi zero (talk) 15:20, 4 April 2013 (UTC)
 * ✅--Cspurrier (talk) 17:47, 4 April 2013 (UTC)


 * --Pi zero (talk) 11:57, 5 April 2013 (UTC)
 * ✅, as China spammer. -- Cirt (talk) 00:36, 6 April 2013 (UTC)


 * --Pi zero (talk) 10:41, 6 April 2013 (UTC)
 * ✅, as the China spammer. -- Cirt (talk) 02:10, 8 April 2013 (UTC)


 * --Pi zero (talk) 15:38, 15 April 2013 (UTC)
 * ✅, -- Cirt (talk) 16:00, 15 April 2013 (UTC)


 * --Pi zero (talk) 20:29, 16 April 2013 (UTC)
 * --Pi zero (talk) 02:38, 22 April 2013 (UTC)
 * This one is bizarre. --Pi zero (talk) 00:38, 23 April 2013 (UTC)
 * --Pi zero (talk) 01:00, 23 April 2013 (UTC)
 * Kveorissn2 and Archipoldoneke are non-matches. Broi2xxbn and Vanderbilt0b are China spammers--Cspurrier (talk) 02:59, 23 April 2013 (UTC)


 * --Pi zero (talk) 03:04, 23 April 2013 (UTC)
 * --Pi zero (talk) 03:33, 27 April 2013 (UTC)
 * --Pi zero (talk) 14:10, 28 April 2013 (UTC)
 * ✅China spammer--Cspurrier (talk) 00:03, 29 April 2013 (UTC)


 * --Pi zero (talk) 19:07, 3 May 2013 (UTC)
 * --Pi zero (talk) 15:50, 5 May 2013 (UTC)
 * --Pi zero (talk) 03:49, 7 May 2013 (UTC)
 * --Pi zero (talk) 18:16, 11 May 2013 (UTC)
 * ✅, China spammer, again. This might perhaps maybe hopefully get easier to manage with universal SUL accounts. -- Cirt (talk) 00:57, 13 May 2013 (UTC)
 * ✅, China spammer, again. This might perhaps maybe hopefully get easier to manage with universal SUL accounts. -- Cirt (talk) 00:57, 13 May 2013 (UTC)


 * --Pi zero (talk) 17:35, 13 May 2013 (UTC)
 * --Pi zero (talk) 17:01, 14 May 2013 (UTC)
 * ✅, lawd these fuckers are annoying. -- Cirt (talk) 20:40, 14 May 2013 (UTC)


 * Different region, but probably open proxies. --Cspurrier (talk) 08:31, 17 May 2013 (UTC)
 * Different region, but probably open proxies. --Cspurrier (talk) 08:31, 17 May 2013 (UTC)


 * --Pi zero (talk) 03:35, 18 May 2013 (UTC)
 * ✅ China spammer--Cspurrier (talk) 06:22, 18 May 2013 (UTC)


 * --Pi zero (talk) 16:07, 19 May 2013 (UTC)
 * --Pi zero (talk) 18:05, 19 May 2013 (UTC)
 * --Pi zero (talk) 21:00, 22 May 2013 (UTC)
 * --Pi zero (talk) 11:00, 23 May 2013 (UTC)
 * --Pi zero (talk) 11:56, 23 May 2013 (UTC)
 * --Pi zero (talk) 14:56, 23 May 2013 (UTC)
 * --Pi zero (talk) 00:53, 24 May 2013 (UTC)
 * --Pi zero (talk) 01:33, 25 May 2013 (UTC)
 * --Pi zero (talk) 11:46, 25 May 2013 (UTC)
 * --Pi zero (talk) 13:26, 27 May 2013 (UTC)
 * --Pi zero (talk) 15:46, 27 May 2013 (UTC)
 * --Pi zero (talk) 14:42, 29 May 2013 (UTC)
 * --Pi zero (talk) 11:27, 4 June 2013 (UTC)
 * ✅, blocked, and tagged. -- Cirt (talk) 04:33, 10 June 2013 (UTC)


 * --Pi zero (talk) 12:08, 11 June 2013 (UTC)
 * ✅, -- Cirt (talk) 18:05, 11 June 2013 (UTC)

Arbitrary section break

 * --Pi zero (talk) 13:17, 15 June 2013 (UTC)
 * ✅, -- Cirt (talk) 05:15, 17 June 2013 (UTC)


 * --Pi zero (talk) 11:24, 23 June 2013 (UTC)
 * ✅. -- Cirt (talk) 22:51, 23 June 2013 (UTC)


 * --Pi zero (talk) 10:46, 27 June 2013 (UTC)
 * --Pi zero (talk) 04:08, 29 June 2013 (UTC)
 * --Pi zero (talk) 15:39, 8 July 2013 (UTC)
 * ✅, blocked, further investigation continued, blocked some rangeblocks. -- Cirt (talk) 16:55, 30 July 2013 (UTC)
 * ✅, blocked, further investigation continued, blocked some rangeblocks. -- Cirt (talk) 16:55, 30 July 2013 (UTC)

Vandal self-identifying as Diego Grez
Related to Diego's account? (Or... there was another one claiming to be Diego a few weeks(?) back, I think?)
 * --Pi zero (talk) 01:54, 31 December 2012 (UTC)
 * ✅ Region match and iirc isp match--Cspurrier (talk) 15:47, 8 January 2013 (UTC)

Username t0rll

 * Can this be looked at and then oversighted from user creation logs?
 * Plus, the IP for the user creation shared on checkuer-l to establish which user is doing the cross-wiki trolling. --Brian McNeil / talk 12:50, 8 January 2013 (UTC)
 * ✅ no match to anything. Does not appear to be an open proxy. --Cspurrier (talk) 15:41, 8 January 2013 (UTC)

Possible block evasion
An article created by currently blocked user Starship9000 has just been recreated by 74.131.177.233. This quacks very like block evasion. Is there technical evidence to support that hypothesis? --Pi zero (talk) 19:55, 6 March 2013 (UTC)
 * ✅ that was carrying out block evasion, and one underlying IP was blocked. -- Cirt (talk) 22:03, 6 March 2013 (UTC)
 * Just as a FYI, Starship9000 was locked globally, so that account will no longer be editing. --Rschen7754 03:18, 23 March 2013 (UTC)
 * I indeffed the IP address yesterday as it edited to request user page deletion. (Did honour the deletion request.) --LauraHale (talk) 20:26, 24 March 2013 (UTC)
 * Reduced the IP block from indef to one year. -- Cirt (talk) 15:16, 30 March 2013 (UTC)
 * I indeffed the IP address yesterday as it edited to request user page deletion. (Did honour the deletion request.) --LauraHale (talk) 20:26, 24 March 2013 (UTC)
 * Reduced the IP block from indef to one year. -- Cirt (talk) 15:16, 30 March 2013 (UTC)

Computron


I would like a checkuser for Computron to confirm they are not, and. If this is confirmed, the existence of the Computron account would be in violation of the global ban from all Wikimedia Foundation projects.

At this point in time, there are a number of people on project who openly believe that Computron is Onewhohelps. This is damaging for project morale because, if true, it implies preferential treatment is being given to a known sockpuppet by knowingly let them edit without first discussing whether the global block restriction should be lifted locally.

Computron has admitted on IRC to knowing Onewhohelps, whom Computron said was a nice girl he knows from high school. (This is pretty impossible, given Surasaman started editing in 2006.) Computron is also exhibiting behaviors similar to Onewhohelps, such as creating petty little conflicts, whining about the lack of attention being paid to him, exhibiting the traits of a newbie while demonstrating expert knowledge and an inability to learn no matter how much guidance is being provided. This sort of picking little squabbles has gone on since a few weeks after they arrived on the project, with my first notice of it shortly after the query regarding the relationship with Onewhohelps was made. There were then veiled nasty comments directed at them. Onewhohelps also has a history of using IRC to pick fights. Computron is continuing in this vein. While Pi zero believes Computron just needs time to learn policy and is bending over backwards to assist this user, Computron's behavior is exactly the sort [//en.wikipedia.org/wiki/Wikipedia:Administrators%27_noticeboard/Archive226 documented on English Wikipedia] where a user similar to Pi Zero bent over backwards to assist the sock to no avail.

This issue really needs to be cleared up given that Computron has repeatedly contacted people to request for permission to upload non-free images to Wikinews locally (without asking for free licenses first, or encouraging the person to upload to Commons) which means they could not be republished elsewhere. --LauraHale (talk) 03:04, 23 March 2013 (UTC)


 * I agree that the suspicion is out there, and is detrimental to everyone including Computron. So for everyone's sake it ought to be resolved if possible.


 * (I'm not bending over backwards, thankyou, any more than I do with anyone else &mdash; said the person with the permanent posture problem. :-) --Pi zero (talk) 03:25, 23 March 2013 (UTC)
 * They share a country, but beyond that the data is all over the place. Both have used a number of ISPs and different systems with no overlap, but this result is not surprising given the gap between datasets. --Cspurrier (talk) 03:41, 23 March 2013 (UTC)

Flaming cats
Latest batch.
 * --Pi zero (talk) 03:48, 28 April 2013 (UTC)
 * ✅ as socks of w:User:Dantherocker1. -- Cirt (talk) 05:26, 3 May 2013 (UTC)
 * --Pi zero (talk) 03:48, 28 April 2013 (UTC)
 * ✅ as socks of w:User:Dantherocker1. -- Cirt (talk) 05:26, 3 May 2013 (UTC)
 * --Pi zero (talk) 03:48, 28 April 2013 (UTC)
 * ✅ as socks of w:User:Dantherocker1. -- Cirt (talk) 05:26, 3 May 2013 (UTC)
 * ✅ as socks of w:User:Dantherocker1. -- Cirt (talk) 05:26, 3 May 2013 (UTC)


 * --Pi zero (talk) 02:43, 4 May 2013 (UTC)
 * ✅ as socks of w:User:Dantherocker1. Please create or update AbuseFilter to help alleviate this. -- Cirt (talk) 20:02, 4 May 2013 (UTC)
 * --Pi zero (talk) 02:43, 4 May 2013 (UTC)
 * ✅ as socks of w:User:Dantherocker1. Please create or update AbuseFilter to help alleviate this. -- Cirt (talk) 20:02, 4 May 2013 (UTC)
 * --Pi zero (talk) 02:43, 4 May 2013 (UTC)
 * ✅ as socks of w:User:Dantherocker1. Please create or update AbuseFilter to help alleviate this. -- Cirt (talk) 20:02, 4 May 2013 (UTC)
 * --Pi zero (talk) 02:43, 4 May 2013 (UTC)
 * ✅ as socks of w:User:Dantherocker1. Please create or update AbuseFilter to help alleviate this. -- Cirt (talk) 20:02, 4 May 2013 (UTC)
 * --Pi zero (talk) 02:43, 4 May 2013 (UTC)
 * ✅ as socks of w:User:Dantherocker1. Please create or update AbuseFilter to help alleviate this. -- Cirt (talk) 20:02, 4 May 2013 (UTC)
 * --Pi zero (talk) 02:43, 4 May 2013 (UTC)
 * ✅ as socks of w:User:Dantherocker1. Please create or update AbuseFilter to help alleviate this. -- Cirt (talk) 20:02, 4 May 2013 (UTC)
 * --Pi zero (talk) 02:43, 4 May 2013 (UTC)
 * ✅ as socks of w:User:Dantherocker1. Please create or update AbuseFilter to help alleviate this. -- Cirt (talk) 20:02, 4 May 2013 (UTC)
 * --Pi zero (talk) 02:43, 4 May 2013 (UTC)
 * ✅ as socks of w:User:Dantherocker1. Please create or update AbuseFilter to help alleviate this. -- Cirt (talk) 20:02, 4 May 2013 (UTC)
 * --Pi zero (talk) 02:43, 4 May 2013 (UTC)
 * ✅ as socks of w:User:Dantherocker1. Please create or update AbuseFilter to help alleviate this. -- Cirt (talk) 20:02, 4 May 2013 (UTC)


 * --Pi zero (talk) 01:09, 30 May 2013 (UTC)
 * Only the one account on that particular technical data, blocked. -- Cirt (talk) 02:58, 30 May 2013 (UTC)

Giovanni Pergolesi
Quacks like socking. User claims on xyr user page to be a ten-year-old. Did a bunch of vandalism in a short time, one of those being addition to User talk:Matthewedwards of tag  .
 * --Pi zero (talk) 22:26, 30 April 2013 (UTC)
 * Nothing else showing up, unless you can give more evidence of what other accounts it may be linked to. -- Cirt (talk) 05:21, 3 May 2013 (UTC)

Kitties new IPs
I've no prior experience with blocking re the new IPs. What's the best way to approach them? We've had two of them (so far) in the past few days doing vandalism featuring 'kittiesonfire'. --Pi zero (talk) 22:52, 4 July 2013 (UTC)
 * ✅, and blocked both. -- Cirt (talk) 03:44, 13 July 2013 (UTC)
 * ✅, and blocked both. -- Cirt (talk) 03:44, 13 July 2013 (UTC)
 * ✅, and blocked both. -- Cirt (talk) 03:44, 13 July 2013 (UTC)

Dan/kitties
Following User:MasturbatingZebra yesterday, today we've
 * --Pi zero (talk) 01:19, 27 July 2013 (UTC)
 * ✅, -- Cirt (talk) 15:39, 27 July 2013 (UTC)


 * --Pi zero (talk) 00:32, 7 August 2013 (UTC)
 * ✅, -- Cirt (talk) 02:47, 7 August 2013 (UTC)
 * --Pi zero (talk) 01:07, 13 August 2013 (UTC)
 * ✅, -- Cirt (talk) 05:36, 13 August 2013 (UTC)
 * --Pi zero (talk) 00:32, 7 August 2013 (UTC)
 * ✅, -- Cirt (talk) 02:47, 7 August 2013 (UTC)
 * --Pi zero (talk) 01:07, 13 August 2013 (UTC)
 * ✅, -- Cirt (talk) 05:36, 13 August 2013 (UTC)
 * ✅, -- Cirt (talk) 05:36, 13 August 2013 (UTC)


 * --Pi zero (talk) 22:22, 1 September 2013 (UTC)
 * ✅, -- Cirt (talk) 04:40, 2 September 2013 (UTC)
 * --Pi zero (talk) 22:22, 1 September 2013 (UTC)
 * ✅, -- Cirt (talk) 04:40, 2 September 2013 (UTC)
 * --Pi zero (talk) 22:22, 1 September 2013 (UTC)
 * ✅, -- Cirt (talk) 04:40, 2 September 2013 (UTC)
 * ✅, -- Cirt (talk) 04:40, 2 September 2013 (UTC)


 * --Pi zero (talk) 01:52, 4 September 2013 (UTC)
 * ✅--Cspurrier (talk) 07:54, 4 September 2013 (UTC)
 * --Pi zero (talk) 01:52, 4 September 2013 (UTC)
 * ✅--Cspurrier (talk) 07:54, 4 September 2013 (UTC)
 * --Pi zero (talk) 01:52, 4 September 2013 (UTC)
 * ✅--Cspurrier (talk) 07:54, 4 September 2013 (UTC)
 * ✅--Cspurrier (talk) 07:54, 4 September 2013 (UTC)


 * --Pi zero (talk) 02:48, 8 September 2013 (UTC)
 * --Pi zero (talk) 02:48, 8 September 2013 (UTC)
 * --Pi zero (talk) 02:48, 8 September 2013 (UTC)
 * --Pi zero (talk) 02:48, 8 September 2013 (UTC)
 * --Pi zero (talk) 02:48, 8 September 2013 (UTC)
 * --Pi zero (talk) 02:48, 8 September 2013 (UTC)


 * NOT blocked, possibly unrelated, created right in the middle of this batch so needs investigated
 * Please root out any sleepers and block the underlying IP(s). Blood Red Sandman  (Talk)   (Contribs) 17:41, 8 September 2013 (UTC)
 * ✅--Cspurrier (talk) 21:03, 8 September 2013 (UTC)
 * And the IP block? Blood Red Sandman  (Talk)   (Contribs) 22:45, 8 September 2013 (UTC)
 * Not very useful unfortunately, xe seems to have access to a fairly good size collection of IPv6 addresses. --Cspurrier (talk) 02:06, 9 September 2013 (UTC)
 * A shame. Thanks anyway. Blood Red Sandman  (Talk)   (Contribs) 15:34, 9 September 2013 (UTC)
 * Please root out any sleepers and block the underlying IP(s). Blood Red Sandman  (Talk)   (Contribs) 17:41, 8 September 2013 (UTC)
 * ✅--Cspurrier (talk) 21:03, 8 September 2013 (UTC)
 * And the IP block? Blood Red Sandman  (Talk)   (Contribs) 22:45, 8 September 2013 (UTC)
 * Not very useful unfortunately, xe seems to have access to a fairly good size collection of IPv6 addresses. --Cspurrier (talk) 02:06, 9 September 2013 (UTC)
 * A shame. Thanks anyway. Blood Red Sandman  (Talk)   (Contribs) 15:34, 9 September 2013 (UTC)


 * --Pi zero (talk) 01:08, 10 September 2013 (UTC)
 * --Pi zero (talk) 01:08, 10 September 2013 (UTC)
 * --Pi zero (talk) 01:08, 10 September 2013 (UTC)
 * --Pi zero (talk) 01:08, 10 September 2013 (UTC)
 * --Pi zero (talk) 01:08, 10 September 2013 (UTC)
 * --Pi zero (talk) 01:08, 10 September 2013 (UTC)

A new set; please check for sleepers and block underlying IPs:
 * --Pi zero (talk) 21:21, 24 October 2013 (UTC)
 * --Pi zero (talk) 21:21, 24 October 2013 (UTC)
 * --Pi zero (talk) 21:21, 24 October 2013 (UTC)
 * --Pi zero (talk) 21:21, 24 October 2013 (UTC)
 * --Pi zero (talk) 21:21, 24 October 2013 (UTC)
 * --Pi zero (talk) 21:21, 24 October 2013 (UTC)

Presumably all related: — Mike moral  ♪♫  01:22, 30 October 2013 (UTC)


 * --Pi zero (talk) 20:04, 30 October 2013 (UTC)
 * ✅. I blocked the range used for a week. This appears to potentially cover a large number of At&t IPv6 customers. There are currently no legit edits from this range, but we will probably want to keep blocks short. --Cspurrier (talk) 19:26, 31 October 2013 (UTC)
 * --Pi zero (talk) 20:04, 30 October 2013 (UTC)
 * ✅. I blocked the range used for a week. This appears to potentially cover a large number of At&t IPv6 customers. There are currently no legit edits from this range, but we will probably want to keep blocks short. --Cspurrier (talk) 19:26, 31 October 2013 (UTC)
 * --Pi zero (talk) 20:04, 30 October 2013 (UTC)
 * ✅. I blocked the range used for a week. This appears to potentially cover a large number of At&t IPv6 customers. There are currently no legit edits from this range, but we will probably want to keep blocks short. --Cspurrier (talk) 19:26, 31 October 2013 (UTC)
 * ✅. I blocked the range used for a week. This appears to potentially cover a large number of At&t IPv6 customers. There are currently no legit edits from this range, but we will probably want to keep blocks short. --Cspurrier (talk) 19:26, 31 October 2013 (UTC)


 * --Pi zero (talk) 15:23, 3 November 2013 (UTC)
 * --Pi zero (talk) 02:21, 4 November 2013 (UTC)
 * ✅. I increased the range more. --Cspurrier (talk) 20:43, 4 November 2013 (UTC)
 * --Pi zero (talk) 15:23, 3 November 2013 (UTC)
 * --Pi zero (talk) 02:21, 4 November 2013 (UTC)
 * ✅. I increased the range more. --Cspurrier (talk) 20:43, 4 November 2013 (UTC)
 * --Pi zero (talk) 02:21, 4 November 2013 (UTC)
 * ✅. I increased the range more. --Cspurrier (talk) 20:43, 4 November 2013 (UTC)
 * --Pi zero (talk) 02:21, 4 November 2013 (UTC)
 * ✅. I increased the range more. --Cspurrier (talk) 20:43, 4 November 2013 (UTC)
 * --Pi zero (talk) 02:21, 4 November 2013 (UTC)
 * ✅. I increased the range more. --Cspurrier (talk) 20:43, 4 November 2013 (UTC)
 * ✅. I increased the range more. --Cspurrier (talk) 20:43, 4 November 2013 (UTC)

Tenacious spammer
Not content with putting spam on xyr own user page, this one Keeps going back to the same user page. Anything underlying one could block? --Pi zero (talk) 11:14, 15 September 2013 (UTC)
 * ✅. IP range has several potentially legit auto-created users. --Cspurrier (talk) 03:32, 19 October 2013 (UTC)

Agroupaccount
Obviously inappropriate username "A group account", admits account is controlled by a "group" in violation of Role account.

Please check for other underlying sockpuppets, there is a possible cross-wiki sockfarm going on here...

Thank you,

-- Cirt (talk) 07:55, 16 December 2013 (UTC)
 * ✅, no other accounts. --Cspurrier (talk) 00:12, 6 January 2014 (UTC)

Seemingly matched set
Four accounts today all created user pages that don't remotely match the user names, and have the collective feel of someone messing around. I'd like to know if they're related, and of course if anything can be done about the underlying IP(s).
 * --Pi zero (talk) 22:46, 19 December 2013 (UTC)
 * ✅ TaneshaTKSC = MagaretBisbee = GabriellaAXS and KristoferYokoya = DillonBowmaker = EleanoreIsaac. There is also a high probability that they are all a match to each other as well. Datacentre IPs, so probably open proxies or hacked systems. --Cspurrier (talk) 00:18, 6 January 2014 (UTC)
 * --Pi zero (talk) 22:46, 19 December 2013 (UTC)
 * ✅ TaneshaTKSC = MagaretBisbee = GabriellaAXS and KristoferYokoya = DillonBowmaker = EleanoreIsaac. There is also a high probability that they are all a match to each other as well. Datacentre IPs, so probably open proxies or hacked systems. --Cspurrier (talk) 00:18, 6 January 2014 (UTC)
 * ✅ TaneshaTKSC = MagaretBisbee = GabriellaAXS and KristoferYokoya = DillonBowmaker = EleanoreIsaac. There is also a high probability that they are all a match to each other as well. Datacentre IPs, so probably open proxies or hacked systems. --Cspurrier (talk) 00:18, 6 January 2014 (UTC)