Wikipedia:Long-term abuse/Page 3

From Wikipedia, the free encyclopedia

This is page 3 of Wikipedia:Long-term abuse/Full. Contains content from User:EvergreenFir/socks and User:Meters.

SPIs[edit]

Recent[edit]

Long-term SPIs[edit]



The UPN Vandal
Wikilifespan2007–present
Known IPsPlease refer to for full list
InstructionsBlock on sight, revert all edits. Suspected socks should be tagged and reported to sockpuppet investigations for confirmation. When reporting, please link to this long-term abuse report. When the active abuse has been taken care of, please update this report with the latest information.
StatusActive

Basic information[edit]

The UPN Vandal (talk · contribs · block log · arb · ssp · SPI confirmed suspected)
UPN Vandal Comprehensive edits analysis
The name "The UPN Vandal" is a descriptive nickname, as this vandal has used more IPs than he has used accounts.

Targeted areas, pages, themes[edit]

In particular, the UPN Vandal targets articles about kids' shows and networks, as well as some movies, production companies, and actors:

Habitual behavior[edit]

  • Talk page edits often start with "Joshua Raymond Hahn", and often contain "YOU UNDERSTAND?" and/or "IS THAT CLEAR ENOUGH?"
  • Article edits always contain unsourced (and highly unlikely) changes, often involving the return of cancelled shows for new seasons or reunion movies; other edits involve remakes of movies, film adaptations, and production staff announcements.
  • Often targets articles involving the Nickelodeon Kids' Choice Awards, including false nominations, host predictions months before anyone has been offered the job to host the ceremony and new categories; often this vandal and Gabucho181 (talk · contribs · deleted contribs · nuke contribs · logs · filter log · block user · block log) tread the same articles and patterns, so care should be taken to determine which vandal is actually doing so.

Cases[edit]

Other notes[edit]

IPs seem to geolocate to Virginia or North Carolina. Most IPs that were already dealt with may have been reassigned.

IP addresses in 2016 and 2017 are usually on 172.164.0.0/16 and 2600:1003:B440::/42.

Blocked IP addresses[edit]

Confirmed and suspected accounts[edit]




Supreme Genghis Khan
Shortcut:
Original name(s)Supreme Genghis Khan
WikilifespanHighly active March 6, 2016 (2016-03-06) – c. September 2017, sporadic vandalism since then continuing as of 2023
Known IPsVarious ranges
Sockpuppet investigationsSupreme Genghis Khan
InstructionsAdmins: Revert, block, and revoke talk page access without communication with the user. Do not add any content, including sock puppet templates, to his userpages. Speedy-delete any pages created by the user, RevDel browser-crashing edits and globally lock accounts.

Non-admins: Revert and report to AIV without communication with the user. Do not add any content, including warning or sockpuppet templates, to his userpages. Tag any pages created by the user for speedy deletion (add {{G5|Supreme Genghis Khan}} to the top of the page, or, if the page is an attack page, replace its content with {{Db-mult|g5|g10}}).

If you use Twinkle or Huggle to tag pages, make sure to uncheck "Notify page creator if possible".

Vandal accounts should also be reported at m:SRG or #wikimedia-stewards connect for global locking.
StatusActive

Basic information[edit]

Supreme Genghis Khan (talk · contribs · block log · arb · SPI suspected)
Comprehensive edits analysis

Supreme Genghis Khan is a vandal and troll who has abused a large number of sockpuppet accounts since 2016. By the time their userpage and those of his sockpuppets, tagged with sockpuppet templates, were deleted as a result of consensus at an MfD discussion in July 2016, he was confirmed to have abused over 190 sockpuppets. Supreme Genghis Khan's account was globally locked in April 2016 following cross-wiki abuse, and following consensus reached in a discussion at the administrators' noticeboard, Supreme Genghis Khan was banned indefinitely from English Wikipedia in May 2016.

Habitual behavior[edit]

Supreme Genghis Khan's disruptive behavior takes many forms, the most common of which include the addition of duplicated images to articles (example) and other users' userpages (example), and other image vandalism such as the replacement of images in BLPs with an image of Genghis Khan, Osama bin Laden, or North Korean leadership (Kim Jong-un and Kim Jong-il; example). Edit summaries can be obscene or defamatory (e.g. "F*** you, [user]!" and "[User] has AIDS!"; example) and may have to be hidden by administrators. This image vandalism can cause browsers to crash; some instances have added nearly 2,000,000 bytes to a page (example).

Other disruption patterns include replacing article content with giant text (e.g. "GENGHIS KHAN FAVOURITE...!"; example), full unwikifying of articles by adding <nowiki> tags (example), personal attacks (often gross; e.g. "[User] is a rapist/pedophile/sex offender") and harassment, abuse of warning templates (example), vandalistic and malicious page moves (example, example), impersonation of other users through usernames and signature forgery (example), creation of hoaxes and attack pages, blanking of AIV reports and obscene unblock requests.

Supreme Genghis Khan has a history of adopting usernames which impersonate or attack users who have blocked or reported him, making close typos, adding e.g. "Genghis Khan", direct attacks, or in some cases variations of the Khan moniker using accented characters to evade detection. Several editors (such as JamesBWatson) have been targeted in this way. Some of his usernames use French language words (example), as evidenced by a recent sockpuppet investigation.

Starting in 2023, this user has also engaged in racist vandalism, typically involving racial stereotypes related to fried chicken and watermelons. Also, there seems to be an ongoing pattern of Genghis Khan related vandalism to MongoDB.

Cases[edit]

Other notes[edit]

Tikeem cumberbatch uttp tcgp own (talk · contribs · block log · arb · SPI suspected), another long-term abuser active during the same time period as Supreme Genghis Khan, is suspected of being a meatpuppet of them. For example, while their contributions are quite different, some sockpuppets have claimed they are "friends", such as Supreme Genghis Khan and Tikeem cumberbatch uttp tcgp own and Supreme Genghis Khan is Tikeem cumberbatch uttp tcgp own's best friend. Note that according to Urban Dictionary, UTTP (also known as YouTube Troll Police) is a known Internet trolling organization.


Socks - Accounts[edit]

Socks/vandals[edit]

  • User:MehranRazi Mehrān/Mihran guy. Blocked after ANI [[2]] but presumably back as another IP. Will probably need an SPI
  • User:Meters/Scarborough school cluster create SPI/ANI on Scarborough schools case since it is not going away. The current stable IP was last blocked on Feb 20 for one week, so keep an eye on this on Feb 27. Yup, immediate return and resumption. Undone but not reblocked this time. SPI this if (i.e., when) he shows up again. Yup, back on March 10. Blocked 3 months this time, so watch for a change in IP. Apr 27 Seem to have died. Probably because it looks like the school will be closed. Spoke too soon. Reappeared in June and July as the static IP. Blocked 6 months. Back again October 2016 as 2607:FEA8:A7A0:57C:ADBB:4C6A:B611:6E81
  • User:Meters/Ananny_socks still active Oct 2016.

IP vandals (mostly cartoons/TV)[edit]

British cartoon date changer (England; usually Sky Broadband ISP or EE Mobile, near Birmingham)[edit]

MOS IP Vandals - Fairfax, VA[edit]

Abuse extends back to 2013. Edit filter 678 was created in response to this vandal. See initial EF request and documentation of abuse at this link.

Grojband, NBC/CBS, 1970s, BBC lists of programs TV vandal - Philippines[edit]

Current MO is to add Grojband to templates for programming in the 1970s, 1980s, and 1990s, even though the cartoon is from 2013. (E.g., [3], [4]).

IP address Date Number edits Geolocation Notes
112.198.103.175 (talk · contribs · WHOIS) 12 May 2016 13 edits Philippines
112.198.103.95 (talk · contribs · WHOIS) 17 May 2016 20 edits Philippines
112.198.118.119 (talk · contribs · WHOIS) 22 May 2016 52 edits Philippines
112.198.118.177 (talk · contribs · WHOIS) 31 May 2016 83 edits Philippines
112.198.103.69 (talk · contribs · WHOIS) 31 May 2016 2 edits Philippines
112.198.118.133 (talk · contribs · WHOIS) 2 June 2016 35 edits Philippines
112.198.75.216 (talk · contribs · WHOIS) 3 June & 29 September 2016 32 edits Philippines
112.198.75.148 (talk · contribs · WHOIS) 4 & 6 June 2016 48 edits Philippines
112.198.103.64 (talk · contribs · WHOIS) 7 & 9 June 2016 32 edits Philippines
112.198.75.71 (talk · contribs · WHOIS) 29 June 2016 12 edits Philippines
112.198.75.157 (talk · contribs · WHOIS) 6 July 2016 13 edits Philippines
112.198.103.222 (talk · contribs · WHOIS) 13 July 2016 11 edits Philippines
112.198.72.239 (talk · contribs · WHOIS) 25 July 2016 3 edits Philippines
112.198.72.112 (talk · contribs · WHOIS) 27 July 2016 10 edits Philippines
112.198.103.159 (talk · contribs · WHOIS) 29 July - 1 August 2016 33 edits Philippines
112.198.118.139 (talk · contribs · WHOIS) 17-19 August 2016 5 edits Philippines
112.198.75.34 (talk · contribs · WHOIS) 21 August 2016 6 edits Philippines
112.198.75.123 (talk · contribs · WHOIS) 25 August 2016 6 edits Philippines
112.198.72.245 (talk · contribs · WHOIS) 2 September 2016 4 edits Philippines
112.198.72.241 (talk · contribs · WHOIS) 5 September 2016 3 edits Philippines
112.198.75.143 (talk · contribs · WHOIS) 16-17 September 2016 24 edits Philippines
112.198.75.16 (talk · contribs · WHOIS) 20 September 2016 28 edits Philippines
112.198.72.40 (talk · contribs · WHOIS) 23 September 2016 41 edits Philippines Blocked on 13:17, 23 September 2016 by Wldr for 31 hours; blocked on 21:27, 24 September 2016 by Wldr for 1 week
112.198.103.75 (talk · contribs · WHOIS) 27-28 September 2016 41 edits Philippines Blocked on 16:28, 28 September 2016 by Wldr for 1 month for WP:LTA
112.198.118.189 (talk · contribs · WHOIS) 29-30 September 2016 17 edits Philippines Blocked on 17:39, 30 September 2016 by Wldr for 31 hours for WP:LTA
112.198.75.163 (talk · contribs · WHOIS) 30 September 2016 3 edits Philippines
112.198.103.119 (talk · contribs · WHOIS) 7 October 2016 20 edits Philippines Blocked on 04:24, 7 October 2016 by MusikAnimal for 31 hours
112.198.75.98 (talk · contribs · WHOIS) 9-10 October 2016 38 edits Philippines Blocked on 17:38, 10 October 2016 by Wldr for 1 month
112.198.75.251 (talk · contribs · WHOIS) 12-15 October 2016 52 edits Philippines Blocked on 21:33, 15 October 2016 by Wldr for 31 hours
112.198.75.240 (talk · contribs · WHOIS) 22-28 October 2016 86 edits Philippines Blocked on 16:43, 28 October 2016 by Wldr for 31 hours

Nonsense Edit Summaries - Cartoon pages (Ontario)[edit]

Adds nonsense, button-smash edit summaries. Has been warned multiple times and never heeded request to make real edit summaries (see first IP's talk page). Like to edit on The Fairly OddParents related pages.

ISP: Rogers Cable Communications Inc

Example edit summaries: gjhjh, gfdgfdgffggfdfgfg, dgfgdfgfdgfdfgdfgd, hfghgfhgfhgfghfghfghfghfhgfhgfghfghfgfh, FGDGFDGFDFGGFDGFD, gfdfgdffdgfgfdgfd

IP address Date Number edits Geolocation Notes
99.248.70.203 (talk · contribs · WHOIS) 9 August 2008 - 29 September 2015 654 Woodbridge, Ontario *Blocked 11 February 2009 for 48 hours by GlassCobra
*Blocked 25 February 2009 for 72 hours by Jclemens
*Blocked 28 February 2009 for 1 week by LessHeard vanU
*Blocked 23 August 2015 for 31 hours by NeilN
*Blocked 30 September 2015 for 1 year by Materialscientist
216.191.38.42 (talk · contribs · WHOIS) 14 April 2015 - 7 June 2016 27 Maple, Ontario
99.248.49.121 (talk · contribs · WHOIS) 13 November 2015 - 3 March 2016 24 Mississauga, Ontario *Blocked 4 March 2016 for 1 week my Materialscientist
99.248.88.234 (talk · contribs · WHOIS) 31 March - 28 April 2016 8 Woodbridge, Ontario *Blocked 14 April 2016 for 2 weeks by Materialscientist
*Blocked 28 April 2016 for 1 month by Ponyo
174.112.103.132 (talk · contribs · WHOIS) 26 May - 16 July 2016 11 Woodbridge, Ontario *Blocked 26 May 2016 for 36 hours by Yamaguchi先生
72.141.224.156 (talk · contribs · WHOIS) 23 July - 21 October 2016 24 Woodbridge, Ontario *Blocked 7 August 2016 for 1 week by Kuru
*Blocked 9 September 2016 for 1 month by Widr
*Blocked 26 October 2016 for 3 months by Oshwah
74.216.198.238 (talk · contribs · WHOIS) 16-20 September 2016 2 Thornhill, Ontario

Likely IPs that are outside of Canada:

IP address Date Number edits Geolocation Notes
89.47.36.206 (talk · contribs · WHOIS) 23 August 2016 3 Romania

Cartoon categories vandals - NYC[edit]

Location: New York City area

Modus Operandi: Fond of adding Qubo, Kids WB, Jetix, YTV, Cartoon Network categories as well as {{Cartoon Network}} to various cartoons. Favorite targets were Jacob Two-Two (TV series), Eliot Kid, Kit vs. Kat, Will and Dewitt, Pleasant Goat and Big Big Wolf.

Current status: Effects still seen today. Appears to have moved to Virginia.

IP address Date Number edits Geolocation
108.27.130.18 (talk · contribs · WHOIS) 26 May, 24 June 2013 6 edits New York City
108.27.140.165 (talk · contribs · WHOIS) 27 May 2013 27 edits New York City
108.27.142.101 (talk · contribs · WHOIS) 31 May 2013 4 edits New York City
108.27.134.45 (talk · contribs · WHOIS) 1 June 2013 3 edits New York City
108.14.190.245 (talk · contribs · WHOIS) 2 June 2013 32 edits Richmond Hill, NY
108.14.176.118 (talk · contribs · WHOIS) 5-6 June 2013 12 edits Long Island, NY
108.14.191.9 (talk · contribs · WHOIS) 6 June 2013 2 edits Long Island, NY
108.14.180.80 (talk · contribs · WHOIS) 7 June 2013 5 edits Elmhurst, NY
108.14.190.22 (talk · contribs · WHOIS) 8 June 2013 38 edits Sunnyside, NY
108.14.185.95 (talk · contribs · WHOIS) 12 June 2013 29 edits Astoria, NY
108.27.143.25 (talk · contribs · WHOIS) 17 June 2013 6 edits New York City
108.27.143.190 (talk · contribs · WHOIS) 19 June 2013 4edits New York City
108.14.190.171 (talk · contribs · WHOIS) 20 June 2013 3 edits Richmond Hill, NY
108.27.128.234 (talk · contribs · WHOIS) 21 June 2013 1 edits Flushing, NY
108.27.138.144 (talk · contribs · WHOIS) 23 June 2013 5 edits New York City
108.14.180.86 (talk · contribs · WHOIS) 23 June 2013 10 edits Elmhurst, NY
108.14.180.13 (talk · contribs · WHOIS) 24-25 June 2013 13 edits Elmhurst, NY
108.27.133.61 (talk · contribs · WHOIS) 25-26 June 2013 14 edits New York City
108.27.129.245 (talk · contribs · WHOIS) 26 June 2013 1 edits New York City
108.27.140.28 (talk · contribs · WHOIS) 27-28 June 2013 6 edits New York City
68.175.36.204 (talk · contribs · WHOIS) 28 June 2013 26 edits New York City
108.14.184.239 (talk · contribs · WHOIS) 28-29 June 2013 26 edits Elmhurst, NY
108.27.140.223 (talk · contribs · WHOIS) 29-30 June 2013 56 edits New York City
108.14.180.92 (talk · contribs · WHOIS) 30 June - 1 July 2013 19 edits Elmhurst, NY
108.14.177.111 (talk · contribs · WHOIS) 3 July 2013 14 edits Astoria, NY
108.14.184.158 (talk · contribs · WHOIS) 5-6 July 2013 28 edits Elmhurst, NY
108.27.139.166 (talk · contribs · WHOIS) 13 July 2013 6 edits New York City
108.14.191.248 (talk · contribs · WHOIS) 13-14 July 2013 9 edits Long Island, NY
108.27.131.126 (talk · contribs · WHOIS) 14-15 July 2013 20 edits New York City
108.27.138.234 (talk · contribs · WHOIS) 19 July 2013 9 edits New York City
108.14.179.40 (talk · contribs · WHOIS) 19-20 July 2013 26 edits Richmond Hill, NY
108.27.132.216 (talk · contribs · WHOIS) 25-26 July 2013 5 edits New York City
108.14.185.205 (talk · contribs · WHOIS) 27 July 2013 4 edits Richmond Hill, NY
108.14.182.40 (talk · contribs · WHOIS) 28 July 2013 7 edits Elmhurst, NY
108.27.132.241 (talk · contribs · WHOIS) 31 July 2013 4 edits New York City
108.27.131.152 (talk · contribs · WHOIS) 31 July - 1 August 2013 4 edits New York City
108.14.190.103 (talk · contribs · WHOIS) 4-5 August 2013 14 edits Sunnyside, NY
108.27.128.147 (talk · contribs · WHOIS) 26 August 2013 8 edits Flushing, NY
108.14.186.110 (talk · contribs · WHOIS) 30-31 August 2013 12 edits Woodside, NY
108.14.177.181 (talk · contribs · WHOIS) 31 August - 1 September 2013 29 edits Astoria, NY
108.27.138.61 (talk · contribs · WHOIS) 3 September 2013 8 edits New York City
108.27.134.66 (talk · contribs · WHOIS) 4-5 September 2013 14 edits New York City
108.14.182.68 (talk · contribs · WHOIS) 8 September 2013 1 edits Elmhurst, NY
108.14.186.240 (talk · contribs · WHOIS) 10-11 September 2013 11 edits Woodside, NY
108.27.134.209 (talk · contribs · WHOIS) 12-13 September 2013 19 edits New York City
108.27.130.140 (talk · contribs · WHOIS) 18 September 2013 1 edits New York City
108.27.136.44 (talk · contribs · WHOIS) 19-20 September 2013 6 edits New York City
108.27.131.244 (talk · contribs · WHOIS) 21 September 2013 38 edits New York City
108.14.190.149 (talk · contribs · WHOIS) 23 September 2013 14 edits Richmond Hill, NY
108.14.181.158 (talk · contribs · WHOIS) 23-24 September 2013 17 edits Astoria, NY
108.27.134.184 (talk · contribs · WHOIS) 25-26 September 2013 9 edits New York City
108.14.188.180 (talk · contribs · WHOIS) 26-27 September 2013 10 edits Astoria, NY
108.14.176.122 (talk · contribs · WHOIS) 27-28 September 2013 13 edits Long Island, NY
108.27.132.157 (talk · contribs · WHOIS) 7-8 October 2013 6 edits New York City
108.27.135.71 (talk · contribs · WHOIS) 9 October 2013 9 edits New York City
108.27.132.206 (talk · contribs · WHOIS) 11 October 2013 24 edits New York City
108.14.184.58 (talk · contribs · WHOIS) 13-14 October 2013 3 edits Long Island, NY
108.14.177.109 (talk · contribs · WHOIS) 15 October 2013 2 edits Astoria, NY
108.27.131.178 (talk · contribs · WHOIS) 25 October 2013 5 edits New York City
108.27.133.12 (talk · contribs · WHOIS) 28 October 2013 7 edits New York City
108.27.132.212 (talk · contribs · WHOIS) 2 November 2013 47 edits New York City
108.27.130.70 (talk · contribs · WHOIS) 2 November 2013 18 edits New York City
108.14.185.103 (talk · contribs · WHOIS) 9 November 2013 20 edits Astoria, NY
108.14.178.51 (talk · contribs · WHOIS) 10 November 2013 17 edits Astoria, NY
108.27.128.140 (talk · contribs · WHOIS) 10-11 November 2013 29 edits Flushing, NY
108.14.180.149 (talk · contribs · WHOIS) 17 November 2013 6 edits Elmhurst, NY
108.14.178.115 (talk · contribs · WHOIS) 19 November 2013 2 edits Astoria, NY
108.14.186.212 (talk · contribs · WHOIS) 20 November 2013 5 edits Woodside, NY
108.27.133.110 (talk · contribs · WHOIS) 21 November 2013 6 edits New York City
108.27.131.88 (talk · contribs · WHOIS) 22 November 2013 3 edits New York City
108.14.182.238 (talk · contribs · WHOIS) 24 November 2013 8 edits Elmhurst, NY
108.14.180.15 (talk · contribs · WHOIS) 24 November 2014 11 edits Elmhurst, NY
108.14.181.206 (talk · contribs · WHOIS) 30 November - 1 December 2013 4 edits Astoria, NY
108.27.132.137 (talk · contribs · WHOIS) 5 December 2013 14 edits New York City
108.27.131.31 (talk · contribs · WHOIS) 7 December 2013 3 edits New York City
108.14.177.228 (talk · contribs · WHOIS) 13 December 2013 3 edits Astoria, NY
108.14.178.22 (talk · contribs · WHOIS) 15 December 2013 1 edits Astoria, NY
108.14.185.149 (talk · contribs · WHOIS) 18 December 2013 3 edits Richmond Hill, NY
108.27.132.171 (talk · contribs · WHOIS) 23 December 2013 6 edits New York City
108.14.179.117 (talk · contribs · WHOIS) 24-25 December 2013 6 edits Richmond Hill, NY
108.14.182.254 (talk · contribs · WHOIS) 25 December 2013 4 edits Elmhurst, NY
108.14.184.122 (talk · contribs · WHOIS) 26 December 2013 1 edits Long Island, NY
108.27.129.192 (talk · contribs · WHOIS) 2 January 2014 5 edits New York City
108.27.131.190 (talk · contribs · WHOIS) 3-4 January 2014 20 edits New York City
108.27.130.192 (talk · contribs · WHOIS) 4 January 2014 2 edits New York City
108.27.130.113 (talk · contribs · WHOIS) 16 January 2014 5 edits New York City
108.14.189.228 (talk · contribs · WHOIS) 7-8 February 2014 31 edits Astoria, NY
108.14.176.106 (talk · contribs · WHOIS) 13-14 February 2014 75 edits Long Island, NY
108.14.184.223 (talk · contribs · WHOIS) 21 August 2014 2 edits Elmhurst, NY
108.14.181.75 (talk · contribs · WHOIS) 22 August 2014 1 edits Astoria, NY
108.14.180.81 (talk · contribs · WHOIS) 21 September 2014 2 edits Elmhurst, NY
108.14.185.162 (talk · contribs · WHOIS) 15-16 November 2014 23 edits Richmond Hill, NY
108.14.184.179 (talk · contribs · WHOIS) 23 November 2014 23 edits Elmhurst, NY
108.14.185.33 (talk · contribs · WHOIS) 12 December 2014 9 edits Astoria, NY
108.14.190.70 (talk · contribs · WHOIS) 28 December 2014 6 edits Sunnyside, NY
108.14.190.120 (talk · contribs · WHOIS) 2 January 2015 2 edits Richmond Hill, NY
108.14.184.239 (talk · contribs · WHOIS) 19 July 2015 -27 August 2015 41 edits New York City
66.65.15.94 (talk · contribs · WHOIS) 14 November 2015 - 10 April 2016 21 edits Jackson Heights, NY
108.6.253.14 (talk · contribs · WHOIS) 30 April - 30 June 2016 40 edits White Plains, NY
2600:1000:B07E:59CE:4DED:A25F:46F6:1315 (talk · contribs · WHOIS) 11 September 2016 5 edits Boston, MA

User may have moved to Boston. Compare this edit on 11 Sept. 2016 to others.

Cartoon categories vandal - Hendron, VA[edit]

Location: Hendron, Virginia.

Connection to previous: Compared New York IP edits to 2604:2000:A005:1F00:A436:4913:F485:8B73 (talk · contribs · WHOIS). User adds unrelated cartoon categories to pages and targets past favorites of the New York IPs (Jacob Two-Two, Will and Dewitt).

History: I recently found an IP address spamming Category:Cartoon Network original programs and other cartoon TV channel related categories. The currently active IPs are in the 2604:2000:A005:1F00* range ([5]) which geolocates to the Hendron, VA area. Originally posted over at EFN, but figured ANI might be the better venue.


Puerto Rican cartoon vandal[edit]

Similar to above editor, but edit summary style differs.

Modus Operandi: Likes to link directly to network or programming block pages in edit summaries or give show name and date range (e.g., [6], [7], [8]). Edits frequently tagged as Mobile edit, Mobile web edit. Recently been changing "Canadian" cartoons to "American" ones.

Location: Geolocates to San Juan, Puerto Rico.

ISP: Varies: Puerto Rico Telephone Company, San Juan Cable

Known targets: Ready Set Learn, Nick Jr. (block), List of programs broadcast by Discovery Kids


IP address Date Number edits Geolocation Notes
70.45.206.57 (talk · contribs · WHOIS) 28 May - 9 June 2016 75 edits Puerto Rico Blocked by Widr on 07:54, 10 June 2016 for 1 month; blocked by Kudpung on 00:02, 11 July 2016 for 3 months
24.41.212.236 (talk · contribs · WHOIS) 27 May - 13 June 2016 18 edits Puerto Rico
207.204.182.12 (talk · contribs · WHOIS) 26 May - 14 June 2016 26 edits Puerto Rico Blocked by Widr on 11:35, 14 June 2016 for 1 month
24.137.239.201 (talk · contribs · WHOIS) 28 May - 19 June 2016 28 edits Puerto Rico
67.224.208.54 (talk · contribs · WHOIS) 21 June 2016 29 edits Puerto Rico Blocked by NeilN on 00:27, 22 June 2016 for 1 month
207.204.155.218 (talk · contribs · WHOIS) 23 June 2016 2 edits Puerto Rico Made same edits as 24.41.212.236 and 207.204.182.12
66.50.164.136 (talk · contribs · WHOIS) 27 June 2016 17 edits Puerto Rico Compare edits on Lunar Jim to past edit by above IP here
207.204.152.29 (talk · contribs · WHOIS) 4 July 2016 32 edits Puerto Rico
173.215.145.78 (talk · contribs · WHOIS) 8-11 July 2016 14 edits Puerto Rico
173.215.183.61 (talk · contribs · WHOIS) 12-24 July 2016 82 edits Puerto Rico Blocked by Materialscientist on 03:31, 25 July 2016 for 1 month
66.50.127.37 (talk · contribs · WHOIS) 9-12 August 2016 34 edits Puerto Rico Compare 173.215.183.61's edit to this IP's edit
173.215.204.25 (talk · contribs · WHOIS) 14-16 August 2016 27 edits Puerto Rico
65.23.250.17 (talk · contribs · WHOIS) 29 August - 5 September 2016 35 edits Puerto Rico Blocked for 31 hours by Wldr at 21:37, 2 September 2016. Resumed vandalism on 5 September. Blocked for 1 week by Wldr at 17:39, 5 September 2016.
24.50.250.115 (talk · contribs · WHOIS) 17 July - 6 September 2016 45 edits Puerto Rico
65.23.250.17 (talk · contribs · WHOIS) 7-8 September 2016 6 edits Puerto Rico
173.215.196.136 (talk · contribs · WHOIS) 7-11 September 2016 16 edits Puerto Rico
70.45.218.18 (talk · contribs · WHOIS) 16-18 September 2016 10 edits Puerto Rico
24.139.252.48 (talk · contribs · WHOIS) 19 September 2016 6 edits Puerto Rico
173.215.140.154 (talk · contribs · WHOIS) 22 September 2016 16 edits Puerto Rico

Lolijij and Baddeck, Nova Scotia, Canada IPs[edit]

Perseverates on things related to Ed the Sock, like creating the articles Ed's Big Wham Bam and Fromage 2004. Known to branch out into other cartoons (e.g., Plot (narrative), Ruby Gloom, Zoboomafoo, The New Adventures of Winnie the Pooh, Timon & Pumbaa (TV series), Tinga Tinga Tales, and Ripe Digital Entertainment). Likes to remove maintenance templates. The user doesn't typically employ edit summaries, but when he does, they're often incoherent. "10 girls for the letter B's complains 6 letters", "Fromage specials never get cut down by the Toronto Ice Storm it's premiere on PBS Kids.", "OK, let the old Fromage specials on PBS Kids". When adding prose, often the result is nonsensical, like here:

"On the DVD Release: Barney & Friends DVD is MuchMusic Fromage 2004 With Bonus Features With Shows Is Barney & Friends. Beetlejuice (TV series) (Remastered). Sarah & Duck (Recreated). SpongeBob SquarePants (season 1). Other Fromage Specials Is Fromage 1988. Fromage 1989. Fromage 1990. Fromage 1991. Fromage 1992. Fromage 1993. Fromage 1994. Fromage 1995. Fromage 1996. Fromage 1997. Fromage 1998. Fromage 1999. Frpmage 2000. Fromage 2001. Fromage 2002. Fromage 2003. Fromage 2005 (Bleep on Coarse Language). Ultra Fromage 2006. Fromage 2013 (Bleep on Coarse Language) & Fromage 2014 (Bleep on Coarse Language), Zoboomafoo, Ni Hao, Kai-Lan (Recreated), Mickey Mouse Clubhouse, Big & Small (Canadian Version), Rugrats, Ed's Nite In & The New Adventures of Winnie the Pooh Is Coming at December 10 2015 on DVD."

See this report for Cyphoidbomb's tagging of this vandal.

I've skimmed through edits from 142.134.* and 142.166.* and 142.177.*

More evidence connecting to Lolijij: [9].

IP address Date Number edits Geolocation Notes
142.166.203.136 (talk · contribs · WHOIS) 13-14 September 2015 24 edits Nova Scotia Earliest discovered case; from Mabou, Nova Scotia
142.166.195.138 (talk · contribs · WHOIS) 14-19 September 2015 31 edits Nova Scotia
142.177.109.11 (talk · contribs · WHOIS) 2-6 October 2015 24 edits Nova Scotia
142.166.199.5 (talk · contribs · WHOIS) 11-12 October 2015 4 edits Nova Scotia Edits on Zoboomafoo and The New Adventures of Winnie the Pooh. Compare to [10]
142.177.43.120 (talk · contribs · WHOIS) 14 October 2015 1 edits Nova Scotia Edit on Zoboomafoo
142.166.90.68 (talk · contribs · WHOIS) 8 October 2015 6 edits Nova Scotia
142.177.45.162 (talk · contribs · WHOIS) 12-13 October 2015 3 edits Nova Scotia On Zoboomafoo and The New Adventures of Winnie the Pooh
142.177.108.135 (talk · contribs · WHOIS) 16-20 October 2015 72 edits Nova Scotia IDed by Cyphoidbomb
142.166.199.107 (talk · contribs · WHOIS) 20 October 2015 25 edits Nova Scotia
142.177.44.176 (talk · contribs · WHOIS) 22 October 2015 9 edits Nova Scotia
142.177.42.162 (talk · contribs · WHOIS) 29 October 2015 13 edits Nova Scotia
142.134.240.115 (talk · contribs · WHOIS) 1-2 November 2015 2 edits Nova Scotia
142.166.205.202 (talk · contribs · WHOIS) 8 November 2015 8 edits Nova Scotia IDed by Cyphoidbomb
142.166.226.231 (talk · contribs · WHOIS) 9 November 2015 3 edits Nova Scotia
142.166.193.94 (talk · contribs · WHOIS) 23 November 2015 3 edits Nova Scotia
142.166.200.2 (talk · contribs · WHOIS) 12 December 2015 7 edits Nova Scotia Edit overlaps with Zoboomafoo and Ripe Digital Entertainment
142.177.42.27 (talk · contribs · WHOIS) 13 December 2015 2 edits Nova Scotia Only edited on Disney Junior
142.166.202.4 (talk · contribs · WHOIS) 17-20 December 2015 5 edits Nova Scotia
142.166.193.139 (talk · contribs · WHOIS) 20 December 2015 - 6 January 2016 30 edits Nova Scotia
142.166.207.14 (talk · contribs · WHOIS) 7-8 January 2016 16 edits Nova Scotia
142.166.200.80 (talk · contribs · WHOIS) 9-11 January 2016 33 edits Nova Scotia
142.177.42.176 (talk · contribs · WHOIS) 13-16 January 2016 66 edits Nova Scotia
142.166.194.78 (talk · contribs · WHOIS) 31 January 2016 20 edits Nova Scotia
142.177.43.106 (talk · contribs · WHOIS) 1-10 February 2016 92 edits Nova Scotia IDed by Cyphoidbomb
Lolijij 10 February - 01 March 2016 - ? See Cyphoidbomb's comments connecting the user and the IPs at this AFD. Indeffed as sock of Maelbros, though Maelbros is from France.
142.177.109.47 (talk · contribs · WHOIS) 8-10 March 2016 14 edits Nova Scotia
142.177.113.82 (talk · contribs · WHOIS) 12 March 2016 2 edits Nova Scotia Trying to insert "Canadian" to Teen Titans Go! like other IPs [11] [12]
142.166.226.133 (talk · contribs · WHOIS) 16-20 March 2016 26 edits Nova Scotia IDed by Cyphoidbomb
142.166.203.47 (talk · contribs · WHOIS) 26-29 March 2016 15 edits Nova Scotia IDed by Cyphoidbomb
142.134.243.215 (talk · contribs · WHOIS) 2 April 2016 1 edit Nova Scotia See this AFD linking to Lolijij
142.134.241.242 (talk · contribs · WHOIS) 9-10 April 2016 21 edits Nova Scotia [13]
142.177.44.133 (talk · contribs · WHOIS) 12-13 April 2016 3 edits Nova Scotia IDed by Cyphoidbomb
142.166.192.6 (talk · contribs · WHOIS) 15 April 2016 2 edits Nova Scotia IDed by Cyphodbomb
142.166.193.231 (talk · contribs · WHOIS) 22-23 April 2016 16 edits Nova Scotia IDed by Cyphoidbomb
142.177.43.246 (talk · contribs · WHOIS) 24-27 April 2016 24 edits Nova Scotia IDed by Cyphoidbomb
142.166.205.165 (talk · contribs · WHOIS) 30 April - 1 May 2016 25 edits Nova Scotia IDed by Cyphoidbomb
142.177.42.6 (talk · contribs · WHOIS) 1-2 May 2016 6 edits Nova Scotia
142.166.205.24 (talk · contribs · WHOIS) 2-7 May 2016 33 edits Nova Scotia Editing on some same pages; rm header boxes [14]
142.166.192.202 (talk · contribs · WHOIS) 8-13 May 2016 26 edits Nova Scotia IDed by Cyphoidbomb
142.177.44.43 (talk · contribs · WHOIS) 14-15 May 2016 9 edits Nova Scotia
142.166.194.111 (talk · contribs · WHOIS) 29-31 May 2016 9 edits Nova Scotia Overlap with Fresh Beat Band of Spies and List of Teen Titans Go! episodes. Compare to [15]
142.166.192.55 (talk · contribs · WHOIS) 31 May 2016 7 edits Nova Scotia Blocked 1 month by Cyphoidbomb
142.177.44.84 (talk · contribs · WHOIS) 6-8 June 2016 11 edits Nova Scotia
142.166.197.117 (talk · contribs · WHOIS) 11 June 2016 9 edits Nova Scotia
142.166.203.214 (talk · contribs · WHOIS) 12-14 June 2016 12 edits Nova Scotia IDed by Cyphoidbomb
142.166.225.126 (talk · contribs · WHOIS) 18-20 June 2016 34 edits Nova Scotia
142.166.192.167 (talk · contribs · WHOIS) 21-25 June 2016 62 edits Nova Scotia Blocked 31 hours by Widr and 1 week by Materialscientist for disruptive editing and removing maintenance tags
142.177.42.171 (talk · contribs · WHOIS) 25-26 June 2016 23 edits Nova Scotia
142.134.240.174 (talk · contribs · WHOIS) 26-28 June 2016 89 edits Nova Scotia
142.166.197.217 (talk · contribs · WHOIS) 2 July 2016 11 edits Nova Scotia
142.177.44.159 (talk · contribs · WHOIS) 5-7 July 2016 27 edits Nova Scotia
24.224.199.7 (talk · contribs · WHOIS) 12-13 July 2016 13 edits Nova Scotia
142.166.224.61 (talk · contribs · WHOIS) 14-15 July 2016 7 edits Nova Scotia Bell Aliant ISP
142.166.203.228 (talk · contribs · WHOIS) 15-17 August 2016 28 edits Nova Scotia Bell Aliant ISP

Animation producers and distributors - New Jersey, Comcast[edit]

User obsesses on editing categories and infoboxes regarding animation producers/distributors/owners. Likes to add Warner Bros. Entertainment ([16]) and remove historical info ([17]). Targets old cartoons recently. Sometimes has Mobile edit, Mobile web edit tags. User is proficient with wiki syntax, including tables.

IPv6 have an ISP of Comcast IP Services.

IP address Date Number edits Geolocation Notes
2601:345:303:EDC5:8804:51F7:9391:74D (talk · contribs · WHOIS) 12 December 2015 - 4 April 2016 267 edits Mount Laurel, NJ Medium confidence; editing in similar areas, same geolocation.
2601:D:7502:41F0:F917:5865:DF33:DD45 (talk · contribs · WHOIS) 3 February 2016 6 edits Mount Laurel, NJ Editing voice actors on old cartoons
2601:81:C400:662C:D4B0:66D7:685A:F10A (talk · contribs · WHOIS) 23 May 2016 1 edits Mount Laurel, NJ
2601:81:C400:662C:68:151A:4BEF:5957 (talk · contribs · WHOIS) 18-19 June 2016 40 edits Mount Laurel, NJ
2601:81:C400:662C:B5AF:FBC:E611:99AE (talk · contribs · WHOIS) 3 June 2016 2 edits Mount Laurel, NJ
2601:81:C400:662C:2D0A:D31F:D180:305F (talk · contribs · WHOIS) 3 June 2016 1 edits Mount Laurel, NJ
2601:81:C400:662C:3540:F6FA:CC19:A339 (talk · contribs · WHOIS) 5 June 2016 1 edits Mount Laurel, NJ
2601:4A:4201:ECF0:F028:7187:8D5:4975 (talk · contribs · WHOIS) 13-14 June 2016 27 edits Mount Laurel, NJ
2601:81:C400:662C:68:151A:4BEF:5957 (talk · contribs · WHOIS) 18-19 June 2016 40 edits Mount Laurel, NJ
2601:81:C400:662C:9833:26DD:4A74:355D (talk · contribs · WHOIS) 19 June 2016 1 edits Mount Laurel, NJ
2601:81:C400:662C:1500:7CBA:77FB:1903 (talk · contribs · WHOIS) 21 June 2016 1 edits Mount Laurel, NJ
2601:81:C400:662C:E5E6:CBFC:10A7:E545 (talk · contribs · WHOIS) 22 June 2016 1 edits Mount Laurel, NJ
2601:81:C400:662C:75B3:C6D3:E343:3309 (talk · contribs · WHOIS) 23 June 2016 1 edits Mount Laurel, NJ
2601:81:c400:662c:e191:c773:4082:faa9 (talk · contribs · WHOIS) 24 June 2016 8 edits Mount Laurel, NJ
2601:81:C400:662C:5DF7:46DB:7EE9:D0B0 (talk · contribs · WHOIS) 26 June 2016 1 edits Mount Laurel, NJ
2601:81:C400:662C:8D07:D991:4ED6:A1 (talk · contribs · WHOIS) 28 June 2016 1 edits Mount Laurel, NJ
2601:81:C400:662C:E1A9:2D8:9573:488D (talk · contribs · WHOIS) 30 June 2016 1 edits Mount Laurel, NJ
2601:81:C400:662C:855D:7660:DFED:5BD4 (talk · contribs · WHOIS) 1 July 2016 44 edits Mount Laurel, NJ
2601:81:C400:662C:5103:660B:7A38:7E5F (talk · contribs · WHOIS) 5 July 2016 1 edits Mount Laurel, NJ
76.98.179.251 (talk · contribs · WHOIS) 18- May - 11 July 2016 Philedelphia, PA Locates near Mount Lauren, NJ. Comcast Cable. Adding Warner Bros. categories like others.
2601:81:C400:662C:A193:2906:D27B:3E80 (talk · contribs · WHOIS) 10 July 2016 3 edits Mount Laurel, NJ
2601:81:C400:662C:DC39:3814:3256:A2AA (talk · contribs · WHOIS) 10 July 2016 1 edits Mount Laurel, NJ
2601:81:C400:662C:F4E5:931A:8882:579A (talk · contribs · WHOIS) 11 July 2016 4 edits Mount Laurel, NJ
2601:81:C400:662C:E891:96D5:CABF:4DA6 (talk · contribs · WHOIS) 11 July 2016 1 edits Mount Laurel, NJ
2601:81:C400:662C:4900:C320:2E81:50C9 (talk · contribs · WHOIS) 11-12 July 2016 23 edits Mount Laurel, NJ
2601:81:C400:662C:D86C:6394:471B:1EAB (talk · contribs · WHOIS) 12-13 July 2016 6 edits Mount Laurel, NJ
2601:81:C400:662C:C587:15D8:95FC:C83D (talk · contribs · WHOIS) 14 July 2016 4 edits Mount Laurel, NJ
2601:81:C400:662C:C82E:7650:16EF:5617 (talk · contribs · WHOIS) 14-15 July 2016 15 edits Mount Laurel, NJ
2601:81:C400:662C:50E9:567F:2758:D881 (talk · contribs · WHOIS) 16 July 2016 2 edits Mount Laurel, NJ
2601:81:C400:662C:99A3:92C6:C2E2:2517 (talk · contribs · WHOIS) 17 July 2016 1 edits Mount Laurel, NJ
2601:81:C400:662C:60ED:4216:C083:F787 (talk · contribs · WHOIS) 17 July 2016 5 edits Mount Laurel, NJ
2601:81:C400:662C:D4B5:D5E6:ECD:EA4 (talk · contribs · WHOIS) 21-22 July 2016 3 edits Mount Laurel, NJ
2601:81:C400:15D0:DDAD:804E:DDF4 (talk · contribs · WHOIS) 22 July 2016 1 edits Mount Laurel, NJ
2601:81:C400:662C:588D:8DC4:7B33:6F02 (talk · contribs · WHOIS) 22 July 2016 1 edits Mount Laurel, NJ
2601:81:C400:662C:6D01:5ADE:E61A:120C (talk · contribs · WHOIS) 23 July 2016 2 edits Mount Laurel, NJ
2601:81:C400:662C:F0A3:F36D:CEB4:61DB (talk · contribs · WHOIS) 24 July 2016 2 edits Mount Laurel, NJ
2601:81:C400:662C:912D:2429:6A51:1AD0 (talk · contribs · WHOIS) 24 July 2016 1 edits Mount Laurel, NJ
2601:81:C400:662C:9471:5B69:DBEE:F602 (talk · contribs · WHOIS) 24-25 July 2016 10 edits Mount Laurel, NJ
2601:81:C400:662C:89D0:459:C16:FA68 (talk · contribs · WHOIS) 26-27 July 2016 3 edits Mount Laurel, NJ
2601:81:C400:662C:21D2:1AA1:23BC:EBC0 (talk · contribs · WHOIS) 27 July 2016 2 edits Mount Laurel, NJ
2601:81:C400:662C:1D3D:FD69:184:8DD6 (talk · contribs · WHOIS) 29 July 2016 1 edits Mount Laurel, NJ
2601:81:C400:662C:F131:9CE8:35B5:A4E3 (talk · contribs · WHOIS) 29-30 July 2016 7 edits Mount Laurel, NJ
2601:81:C400:662C:CCD8:AF2D:ABFC:BED2 (talk · contribs · WHOIS) 8 August 2016 4 edits Mount Laurel, NJ
2601:81:C400:662C:4007:A977:8203:3FF8 (talk · contribs · WHOIS) 10 August 2016 1 edits Mount Laurel, NJ
2601:81:C400:662C:9020:EE6A:526F:353F (talk · contribs · WHOIS) 11 August 2016 1 edits Mount Laurel, NJ
2601:81:C400:662C:D409:7EFC:243A:F7B9 (talk · contribs · WHOIS) 12 August 2016 3 edits Mount Laurel, NJ
2601:81:C400:662C:D583:8AA7:E9DC:29CF (talk · contribs · WHOIS) 13 August 2016 1 edits Mount Laurel, NJ
2601:81:C400:662C:60A6:5F42:78B2:3AB8 (talk · contribs · WHOIS) 16 August 2016 1 edits Mount Laurel, NJ
2601:81:C400:662C:D8EF:848B:CB83:A51F (talk · contribs · WHOIS) 16 August 2016 1 edits Mount Laurel, NJ
2601:81:C400:662C:9D54:87B1:97AB:DB3B (talk · contribs · WHOIS) 18 August 2016 8 edits Mount Laurel, NJ
2601:81:C400:662C:6050:FA8E:CD2B:C2B (talk · contribs · WHOIS) 19 August 2016 1 edits Mount Laurel, NJ
2601:81:C400:662C:3DDF:5759:E798:9B9 (talk · contribs · WHOIS) 19 August 2016 2 edits Mount Laurel, NJ
2601:81:C400:662C:917A:3C62:AD01:B92A (talk · contribs · WHOIS) 19-20 August 2016 15 edits Mount Laurel, NJ
2601:81:C400:662C:99E2:82F7:E956:55F9 (talk · contribs · WHOIS) 20 August 2016 10 edits Mount Laurel, NJ
2601:81:C400:662C:E1B4:800C:1988:31B6 (talk · contribs · WHOIS) 21 August 2016 8 edits Mount Laurel, NJ
2601:81:C400:40A0:FD69:F92C:2029 (talk · contribs · WHOIS) 23 August 2016 4 edits Mount Laurel, NJ
2601:81:C400:662C:1CDB:C1F1:C101:DE50 (talk · contribs · WHOIS) 25 August 2016 63 edits Mount Laurel, NJ
2601:81:C400:662C:6C4F:BEC:7477:20EF (talk · contribs · WHOIS) 26 August 2016 2 edits Mount Laurel, NJ
2601:81:C400:662C:B89E:498E:FC06:5BA6 (talk · contribs · WHOIS) 26 August 2016 12 edits Mount Laurel, NJ
2601:81:C400:662C:47F:ABA3:A02D:9395 (talk · contribs · WHOIS) 26-27 August 2016 13 edits Mount Laurel, NJ
2601:81:C400:662C:CD7C:5D97:BDE6:EE42 (talk · contribs · WHOIS) 28 August 2016 1 edits Mount Laurel, NJ
2601:81:C400:662C:24C6:54D9:A1F8:BBEC (talk · contribs · WHOIS) 28 August 2016 8 edits Mount Laurel, NJ
2601:81:C400:662C:9635:AFF:FE65:F551 (talk · contribs · WHOIS) 29 August 2016 17 edits Mount Laurel, NJ
2601:81:C400:662C:86D:5305:FCF:785B (talk · contribs · WHOIS) 30-31 August 2016 36 edits Mount Laurel, NJ


Likely related (older): [18]

Possibly related from Cellco Partnership DBA Verizon Wireless in NYC, also editing on old cartoons.

IP address Date Number edits Geolocation Notes
2600:1003:B464:3BD0:F866:2F1:EE30:BF45 (talk · contribs · WHOIS) 16 August 2015 48 edits NYC

Care Bears vandal (Brandon1222) - Lexington, SC[edit]

Also see Wikipedia:Sockpuppet_investigations/Brandon1222

IP address Date Number edits Geolocation Notes
98.21.206.5 (talk · contribs · WHOIS) 1 January 2016 2 edits Lexington, SC
98.21.214.103 (talk · contribs · WHOIS) 28 January 2016 3 edits Lexington, SC
75.89.236.116 (talk · contribs · WHOIS) 26 February 2016 5 edits Lexington, SC
98.21.204.123 (talk · contribs · WHOIS) 22 March 2016 16 edits Lexington, SC
98.21.206.239 (talk · contribs · WHOIS) 22 March 2016 1 edits Lexington, SC
75.89.239.169 (talk · contribs · WHOIS) 24 April 2016 3 edits Lexington, SC
98.21.205.193 (talk · contribs · WHOIS) 18-19 June 2016 14 edits Lexington, SC
173.189.12.112 (talk · contribs · WHOIS) 2 July 2016 13 edits Lexington, SC
75.89.233.217 (talk · contribs · WHOIS) 3-5 September 2016 3 edits Lexington, SC
173.189.12.214 (talk · contribs · WHOIS) 5-7 September 2016 14 edits Lexington, SC
173.189.11.228 (talk · contribs · WHOIS) 21 September 2016 1 edits Lexington, SC
98.21.212.214 (talk · contribs · WHOIS) 6 October 2016 2 edits Lexington, SC

Anti-furry, anti-MLP vandal (St. Petersburg, FL)[edit]

Habit: Removes MLP, furry, and sexuality related content from articles. Common target is fur. Example edits: [19], [20]. Edits are usually tagged with Mobile edit, Mobile web edit.

ISP: Time Warner Cable

IP address Date Number edits Geolocation Notes
72.185.123.209 (talk · contribs · WHOIS) 2 May - 20 June 2016 125 St. Petersburg, FL
72.185.108.110 (talk · contribs · WHOIS) 10 - 11 August 2016 2 St. Petersburg, FL
71.178.83.95 (talk · contribs · WHOIS) 30 October 2016 8 Washington, DC Same pages targeted on same manner despite different geolocation

Seattle Disney Vandal[edit]

IP address Date Number edits Geolocation Notes
71.212.121.222 (talk · contribs · WHOIS) 22-24 September 2016 20 Seattle, WA Blocked on 01:00, 24 September 2016 by Oshwah for 72 hours

Alex Piela[edit]

  • 97.100.110.120 - 25 April 2016 (different articles targeted than above IPs)
  • Alex Piela - 20 June 2016 (same as 97.100.110.120)

Salem, Oregon IPs[edit]

No pattern yet, but seen this geolocation a bit recently. Collecting them here for now. See Wikipedia:Sockpuppet_investigations/Wattsj528.

Muskegon, Michigan IPs[edit]

No pattern yet, but seen this geolocation a bit recently. Collecting them here for now. ISP is Comcast

Special:Contributions/50.202.107.170






Szm020730
Original name(s)Image flag vandal
Wikilifespan2016–present
ISPMostly China Telecom; occasionally also China Unicom
Physical locationFujian, China
Sockpuppet investigationsSzm020730
InstructionsAdmins: Revert the edits and block the IP addresses or named accounts without waiting for any user warnings. Do not decline AIV report because it looks "stale".

Non-admins: Revert the edits, no need to warn the vandal. Suspected named socks may be reported to sockpuppet investigations for confirmation. Ongoing disruptions should be reported to AIV with a link to this long-term abuse report to allow more efficient AIV processing by admins.

All: When an IP address or named account has been blocked and confirmed, consider reporting them to meta at m:SRG for global blocks or locks, as this vandal abuses multiple projects.
StatusActive

Basic information[edit]

Szm020730 (talk · contribs · block log · arb · SPI confirmed suspected)

Comprehensive edits analysis
Cross-wiki vandal that adds incorrect flags to articles of places (city/county/district/etc.), primarily editing with IP addresses from China Telecom Fujian. Also known as image flag vandal, or simply the flag vandal. An edit filter is also set up for this vandal.

Their IP addresses, if reported to AIV, should never be considered as stale, as they may resume editing with same or different IP's after stopping for a while. Admins should try to find appropriate rangeblocks as needed.

When reporting disruptions to AIV, please link this LTA page so admins will be able to process the reports more efficiently. Since this involves cross-wiki abuse, consider checking their edits in other projects and reporting disrupting IP's and accounts to meta at Steward requests/Global, so stewards can place global blocks for IP addresses/ranges and global locks for named accounts.

Targeted areas, pages, themes[edit]

Any article of a place, which may be a city, county, district or else. Primarily targets Chinese places, but also vandalizes non-Chinese places. Example pages:

Habitual behavior[edit]

Inserts hoax flags into targeted pages, misleading readers to think a certain flag is used by the targeted city/county/district/etc. This can be the addition of a flag image completely irrelevant to the page -

  • with text below stating "flag of <page name>" in an image box (e.g. [21], [22], usually when the page didn't have an infobox),
  • or to the flag field of an infobox (e.g. [23], [24], [25], [26], [27]).

Since January 2018, the vandal has begun to upload fake flag images named after the targeted places to Commons, before adding those images to the articles, making it less obvious that vandalism is occurring.

An edit session may target multiple pages at a time, and may last for several hours even though there may be relatively long pauses between edits. For example, this IP's first edit and last edit were 12 hours apart ([28], [29]), and they had been active during this time frame, albeit with a 4-hour break ([30], [31]) as well as another 2-hour break ([32], [33]). As a result, AIV reports may look stale but in fact they are not.

Edits in English Wikipedia are mostly by IP's, although there are registered accounts too ([34]). Most frequently hoax additions are made to pages of Chinese places, although other places get vandalized as well – African places are another common target.

This vandal abuses with the same behavior on multiple Wikimedia projects, including but not limited to English, Japanese ([35]), Spanish ([36]), Russian Wikipedia ([37]) and many more, as well as Wikimedia Commons ([38]).

Cases[edit]

Other notes[edit]

Confirmed and suspected accounts[edit]

Sockpuppet categories[edit]

IP addresses[edit]

121.205.49.126 223.104.45.102 219.133.46.12 219.133.46.78 219.133.46.9 219.133.46.8 219.133.46.7 223.104.45.100 223.104.45.104 223.104.45.99 223.104.45.97 219.133.46.74 219.133.46.75 219.133.46.73 219.133.46.70 121.207.74.55 117.24.123.12 120.42.184.160 120.33.101.78

China Unicom[edit]

China Telecom[edit]