Wikiquote:Administrators' noticeboard/Archive/005

TaskEdit

if you have any tasks which you need fellow sysops' hands, please put it on here.

GeneralEdit

Mail requirementEdit

Fellows, please confirm your wiki mail or put it on your userpage. Cheers, --Aphaia 10:49, 3 May 2007 (UTC)

IP vandalEdit

A block on user:76.5.105.107 would be good - cross wiki IP Nazi vandal - moving on to the next clean up - cheers --Herby talk thyme 07:32, 5 May 2007 (UTC)

Thank you for your clean-up, Herby. I didn't notice other his vandalisms. Already I put a 24 hours blocking on this IP address, since a similar text was posted on the user page of this IP address. Reviewing other edits, now I support to extend the term.--Aphaia 07:43, 5 May 2007 (UTC)
Blocked for a week on WP, Books, Commons & Meta <g> & good morning & thanks --Herby talk thyme 07:46, 5 May 2007 (UTC)

Slight ProblemEdit

I recieved a welcome message on my talk page. However, the edit summery was "Asshole." Just wanted to make the admins aware. Markie 21:10, 5 May 2007 (UTC)

Yes, I think that this vandal is trying to create confusion by actually adding the correct welcome message content, but accompanying it with an offensive edit summary. I'm not sure what's the best way to handle this, any ideas? For now I just blocked him for 2 days, and left his edits intact because their content seems fine. iddo999 21:55, 5 May 2007 (UTC)
I think a permanent block is appropriate, as the account was almost certainly created by one of our regular vandals who seem to have nothing more interesting or important to do with their lives than to cause trouble for others. I will delete the pages and renew them just to clean the slate. ~ Kalki 22:16, 5 May 2007 (UTC)
Funny thing, this Markie that I responded to here is actually a cross-wiki vandal (see my usertalk page for details). He probably created the "asshole" edit summaries with his other account, and then complained about his actions here. This person is a piece of work... Yes, one good idea is to delete the pages and re-create them without the offensive edit summary, but it's a minor issue so I guess it's also ok to skip it. Whatever you prefer. iddo999 22:19, 5 May 2007 (UTC)
Also see: http://en.wikiquote.org/wiki/Special:Contributions/TUFKAAP and http://en.wikiquote.org/wiki/Special:Contributions/Kcattaikiw. FWN 22:24, 5 May 2007 (UTC)

the usernames Dark Squall and Jcart1534 (accounts created here at the same time as that of other impersonation attempts) are those of an admin and a user currently on RfA at Wikinews and appear to be part of the impersonation spree. i've notified the two users on their Wikinews talk pages. Doldrums 22:48, 5 May 2007 (UTC)

It is now confirmed after a checkuser that the IP 24.115.238.8, the User:MyName (n:User:MyName) vandal, created the vandal accounts. His IP has been blocked indef on Wikinews. [1].

—The preceding unsigned comment was added by FWN (talkcontribs) 00:36 May 6, 2007 (UTC)

Wikiquote user 24.115.238.8 was blocked for one week beginning April 28 because of vandalism and harassment, which means that the block would have been lifted right in time for the new bout of vandalism and impersonation today. For this reason and because of the history on Wikinews, I am going to place an indefinite block on Wikiquote as well. - InvisibleSun 02:22, 6 May 2007 (UTC)

Timeline of recent WQ/WN impersonation attackEdit

I am posting this message simultaneously to Wikiquote:Administrators' noticeboard (WQ:AN) and n:Wikinews:Admin action alerts (WN:ALERT), using my long-established accounts on each project. By examining WQ's Special:Listadmins to find my username and check my contributions to find this edit, everyone can confirm that I am indeed the real Wikiquote sysop Jeffq. By seeing the simultaneous Wikinews edit, which could not be quickly copied, cross-project links changed, and then reposted by a imposter in the same minute, everyone can confirm that I am the real Wikinews user Jeffq and therefore same person as q:User:Jeffq. I have also used this technique in the past, as can be seen in my Wikinews user contributions page, and Wikinews sysops DragonFire1024 and Nyarlathotep can vouch that they have seen me do this in the past in an effort to stop impersonators. So much for my credentials.

Here is a timeline of the recent Wikiquote/Wikinews impersonation attack, in which a vandal registered Wikinews's "Markie" on Wikiquote, and Wikiquote's "Iddo999" on Wikinews, as well as several supplement usernames to add to the confusion. I have chronologically ordered the two new username creations and the user contributions of the four principles (real q:User:Iddo999 and n:User:Markie, and imposter's fake n:Iddo999 and q:Markie) to demonstrate how this vandal works. I've coded the edits as follows:

  • Real users have black text; imposter's edits are in red text.
  • Wikiquote activity is show with a green background; Wikinews activity has a yellow background.
  • All times are UTC. The date of the attack is 5 May 2007.

I'm hoping that this timeline will help sysops who haven't seen this kind of attack understand how the vandal attempts to provoke them into rash action through alternating reasonable statements and rude comments from supposed foreign sysops with hurt feelings. Here's what happened:

  • 20:40 FAKE Markie: Markie (Talk | contribs | block) New user [2]
  • 20:42 FAKE Markie: (hist) (diff) User:Markie (New page: <div style="margin-bottom:3ex; text-align: center; padding: 1em; border: solid 2px black; background-color: lightblue;">110px[[Image:Flag of t...) (top) [rollback]
  • 20:43 FAKE Markie: (hist) (diff) User talk:Markie (New page: You may have more luck contacting me at [http://en.wikinews.org/w/wiki.phtml?title=User_talk:Markie&action=edit&section=new my Wikinews talk page.])
  • 21:10 FAKE Markie: (hist) (diff) Wikiquote:Administrators' noticeboard (Notice)
  • 21:11 Real Markie: (hist) (diff) NHL:Sharks Lose Game 5 to Wings (tag sources)
  • 21:11 Real Markie: (hist) (diff) NHL:Sharks Lose Game 5 to Wings (unpublish - no cource) (top)
  • 21:13 Real Markie: (hist) (diff) Wikinews:Requested articles (→Los Angeles police uses excessive force on immigration protesters - delete copied and pasted article is linked as source anyway) (top)
  • 21:20 FAKE Iddo999: Iddo999 (Talk | contribs) New user [3]
  • 21:21 Real Iddo999: (hist) (diff) m Category:Proverbs (Reverted edit by Thomaquinaser (talk • contributions) to last version by 210.7.70.46)
  • 21:21 Real Iddo999: (hist) (diff) m Help:Contents (Reverted edit by Thomaquinaser (talk • contributions) to last version by Kalki)
  • 21:21 Real Iddo999: (hist) (diff) m List of films (Reverted edit by Thomaquinaser (talk • contributions) to last version by 194.225.53.189)
  • 21:21 Real Iddo999: (hist) (diff) m List of literary works (Reverted edit by Thomaquinaser (talk • contributions) to last version by Kalki) (top) [rollback]
  • 21:21 Real Iddo999: (hist) (diff) m List of people by name (Reverted edit by Thomaquinaser (talk • contributions) to last version by Poetlister) (top) [rollback]
  • 21:21 Real Iddo999: (hist) (diff) m Wikiquote:Village pump (Reverted edit by Thomaquinaser (talk • contributions) to last version by Aphaia)
  • 21:21 FAKE Iddo999: (hist) (diff) User talk:Iddo999 (New page: Please Leave A Message)
  • 21:21 FAKE Iddo999: (hist) (diff) User:Iddo999 (New page: I've been working mostly on the Noam Chomsky page so far. I also translated the entire page into Hebrew. In case you see a sourced quote I added that doesn't have an online link...)
  • 21:23 FAKE Iddo999: (hist) (diff) Wikinews:Admin action alerts (PLEASE HELP WIKIQUOTE MASSIVE RAPID-FIRE ATTACK)
  • 21:24 FAKE Iddo999: (hist) (diff) Wikinews:Admin action alerts (→MASSIVE RAPID-FIRE ATTACK AT WIKIQUOTE)
  • 21:27 Real Markie: (hist) (diff) Wikinews:Admin action alerts (→MASSIVE RAPID-FIRE ATTACK AT WIKIQUOTE)
  • 21:29 Real Markie: (hist) (diff) User talk:Iddo999 (you said leave a message)
  • 21:29 Real Markie: (hist) (diff) User:Iddo999 (fix the link) (top)
  • 21:32 Real Markie: (hist) (diff) Large Crowds in Midwest: Obama Increases Security (correct date template and tag sources) (top)
  • 21:32 Real Markie: (hist) (diff) User talk:AnnaLothson (weclome) (top)
  • 21:32 FAKE Markie: (hist) (diff) User talk:Iddo999 (MASSIVE-ATTACK?)
  • 21:33 Real Markie: (hist) (diff) User talk:Havelock (welcome)
  • 21:34 Real Markie: (hist) (diff) Wikinews:Admin action alerts (→MASSIVE RAPID-FIRE ATTACK AT WIKIQUOTE - rmv section - not related to wn and is now under control)
  • 21:36 FAKE Iddo999: (hist) (diff) User talk:Markie (WHATEVER)
  • 21:38 Real Markie: (hist) (diff) User talk:Iddo999 (Wikiquote)
  • 21:39 Real Iddo999: (hist) (diff) User talk:Markie (it wasn't me)
  • 21:39 FAKE Markie: (hist) (diff) User talk:Iddo999 (Jerk)
  • 21:41 FAKE Iddo999: (hist) (diff) User talk:Markie (RUDE BEHAVIOR ON WIKIQUOTE) (top)
  • 21:42 Real Markie: (hist) (diff) User talk:Havelock (Water cooler)
  • 21:42 FAKE Markie: (hist) (diff) User talk:Iddo999 (RE: it wasent me)
  • 21:43 Real Iddo999: (hist) (diff) User talk:Markie (→it wasn't me - re) (top) [rollback]
  • 21:44 FAKE Markie: (hist) (diff) User talk:Iddo999 (→RE: it wasent me)
  • 21:45 Real Markie: (hist) (diff) User talk:Iddo999 (→Wikiquote)
  • 21:47 FAKE Iddo999: (hist) (diff) User talk:Iddo999 (CONFIRM IDENTITY)
  • 21:48 Real Markie: (hist) (diff) User talk:Iddo999 (→Wikiquote)
  • 21:50 Real Iddo999: (hist) (diff) User talk:Iddo999 (re)
  • 21:50 Real Markie: (hist) (diff) User talk:Iddo999 (→Wikiquote)
  • 21:51 Real Markie: (hist) (diff) User talk:Iddo999 (→Wikiquote - sign)
  • 21:52 FAKE Iddo999: (hist) (diff) User talk:Iddo999 (→Wikiquote)
  • 21:55 Real Iddo999: (hist) (diff) Wikiquote:Administrators' noticeboard (→Slight Problem)
  • 22:02 Real Markie: (hist) (diff) Wikinews:Admin action alerts (→Cross-Wiki impersonation - reply) (top)
  • 22:04 Real Markie: (hist) (diff) User talk:Iddo999 (blocked template) (top)
  • 22:11 Real Iddo999: (hist) (diff) User talk:Iddo999 (→Markie and Iddo999 account - re)
  • 22:19 Real Iddo999: (hist) (diff) Wikiquote:Administrators' noticeboard (top) [rollback]

Here's how I see the sequence of events:

  • Imposter registers fake q:Markie and complains at Wikiquote:Administrators' noticeboard about vandal's welcome message, actually from himself using another new username.
  • Real n:Markie happens to be doing ordinary editing at the time.
    • NOTE: I suspect Markie was chosen as a currently-editing, known sysop who hadn't been involved in this kind of attack before.
  • Getting no WQ reaction yet, imposter registers fake n:Iddo999.
  • Real q:Iddo999 happens to be doing vandalism reversion, possibly by same vandal under another account.
    • NOTE: Again, Iddo999 was probably chosen as a actively-editing, known sysop unfamiliar with this attack pattern.
  • Imposter, using fake n:Iddo999, posts "MASSIVE RAPID-FIRE ATTACK AT WIKIQUOTE" messages at n:Wikinews:Admin action alerts.
  • Real n:Markie tries to respond to this on alert page and n:Iddo999 talk page.
  • Meanwhile on Wikiquote, fake q:Markie asks real q:Iddo999 on his talk page a logical question: why ask me to help?
  • On Wikinews, after doing some more ordinary editing, real n:Markie decides to delete irrelevant alert.
  • Imposter, as fake n:Iddo999, goes to Wikinews and dismisses real n:Markie with a "WHATEVER" on his talk page. Real n:Markie calmly justifies removal on n:Iddo999's talk page.
  • Imposter quickly returns to Wikiquote as fake q:Markie and calls real q:Iddo999 a "JERK" on his talk page. Real q:Iddo999 calmly denies the attack and suggests it's the vandal.
  • Imposter goes back to Wikinews as fake n:Iddo999 and complains to real n:Markie of "RUDE BEHAVIOR" on his talk page.
  • Imposter quickly returns to Wikiquote as fake q:Markie and claims "it wasent me".
  • Imposter goes back to Wikinews and posts a textually convincing claim to be real WQ sysop asking him to "CONFIRM IDENTITY", but the URL in the link reveals another insult. Real n:Markie nevertheless follows the reasonable request.
  • On Wikiquote, real q:Iddo999 posts a notice of the vandalism from fake q:Markie under the latter's "Slight Problem" at WQ:AN.
  • Imposter tries one more insulting post on Wikinews to real n:Markie before ceasing activity with these two fake usernames.

As I said the first time I saw one of these attacks unfold, I believe the best course of action during the attacks is for each project's sysops to temporarily block the newly-created, supposed foreign sysop names. Once this is done, the confusion from these names will cease. At this point, the real sysops from the projects can confirm whether or not they are the new users on the other project by posting a note on their home project, either on their own user talk page or an appropriate project page (like WQ:AN or WN:ALERT). The other project's sysops can then verify their identity by finding the sysop name using Special:Listadmins (which unlike an admin-list page cannot be spoofed by vandals), clicking the linked username, then checking that user's contributions to find the confirmation posting. For example:

  1. Block wikiquote:User:Markie and wikinews:User:Iddo999 for 1 day.
  2. Each real sysop posts something to their own project; e.g.:
    • wikinews:User:Markie posts to wikinews:WN:ALERT: "The current wikiquote:User:Markie is not me. Please disable this account and/or allow me to re-register it." -OR- "wikiquote:User:Markie is me. Please unblock it."
    • wikiquote:User:Iddo99 posts to wikiquote:WQ:AN: "The current wikinews:User:Iddo999 is not me. Please disable this account and/or allow me to re-register it." -OR- "wikinews:User:Iddo999 is me. Please unblock it."
      NOTE: I don't recommend links in this message, because they can be spoofed. Keep it simple.
  3. Each real sysop checks the foreign project's Special:Listadmins to find the other's confirmation post.
    • q:User:Iddo99 finds "Markie" in Wikinews's listadmins, clicks on his userpage link, then finds his confirmation post in user contributions.
    • n:User:Markie finds "Iddo999" in Wikiquote's listadmins, clicks on his userpage link, then finds his confirmation post in user contributions.
      NOTE: Again, don't trust my links here. Enter "Special:Listadmins" in the Search box and follow the wiki-generated links.
  4. Each sysop now knows whether or not the foreign username is valid, based on the other's posted confirmation message. Each can make the block permament, reverse it, or refer it to a project bureaucrat for reassignment to the established Wikian of that name.

I would recommend not attempting to communicate with the other project, except to post a single request for such a confirmation if they haven't already noticed the impersonation. (Since this vandalism requires the participation of at least one sysop from each project, this is usually not necessary.) Once the accounts are temporarily blocked, the first thing one should check is the user contributions of the real sysop on the other project to look for the confirmation message on some page. The vandal will do his best to sow confusion by making identity-request posts, so the best action is to ignore anything posted to your home project until you see an identity confirmation message on the foreign project.

Of course, the best way to avoid the entire problem is for every sysop on Wikiquote and Wikinews to register their home project username on the other project, even if they never plan to use it. If done with a simultaneous edit to one's user or user talk page that indicates you are establishing a foreign-project account, this will allow that other project to trust you are not a vandal doing this. Until we have unified login, this is perhaps the most effective way to avoid these attacks.

By the way, please note that the vandal will be reading this message. (He has quoted me in at least two attacks to attempt to make them sound more legitimate.) If you don't think this will affect you, understand that he will surely be attacking another set of sysops in the near future. Don't leave yourself vulnerable to this impersonation. Cross-register your usernames. ~ Jeff Q (talk) 01:09, 6 May 2007 (UTC)

Of course, as you see from the above, cross-registering your usernames (even if you never use them) will make life easier for everyone! If we had done so, we wouldn't have wasted a lot of Jeff's life by making him color code a chart for us on cross-wiki actions. :) Cbrown1023 talk 02:42, 6 May 2007 (UTC)
You can always see who has your username registered across all the Wikimedia wikis by using this tool. I encourage EVERYBODY (regular users and admins alike) to see if their username is being used by someone other than themselves. Zachary talk 05:08, 6 May 2007 (UTC)

I've been impersonatedEdit

There's now an account in my name on WikiNews.

21:17, 5 May 2007 Poetlister (Talk | contribs) New user

Can it be blocked please?--Poetlister 22:08, 6 May 2007 (UTC)

I'm not sure if they have been aware of your request, but anyway it was blocked as follows;
23:29, 6 May 2007 FellowWikiNews (Talk | contribs) blocked "Poetlister (contribs)" with an expiry time of indefinite (account creation disabled) (Abusing multiple accounts)
We are better to have a dedicated place for exchanging on going cross-wiki vandalisms, like as noticeboard? --Aphaia 10:06, 7 May 2007 (UTC)
I'd support and help if I could --Herby talk thyme 07:45, 9 May 2007 (UTC)

Sockpuppetry?Edit

I just welcomed two new users: User:Chinolayne and User:J Pittman, created in the last few minutes. They both started by editing List of films. Coincidence?--Poetlister 22:29, 6 May 2007 (UTC)

I have no idea. Chinolayne (talk · contributions) has no edit but List of films. J Pittman (talk · contributions) has several edits besides that, even his or her edits are not so much good, at least on an existing film[4]. It could be coincidence, or not.

According to Single-user login conflict search, both usernames are found only on English Wikiquote. Chinolayne J Pittman.

If you find a bad scant, it may be a good reason to ask a steward to perform CU. --Aphaia 10:13, 7 May 2007 (UTC)

And now, how about? from Special:Logs/newuser

18:26 (cur; last) . . SA3 (Talk | contribs | block) (New user)
18:26 (cur; last) . . SA2 (Talk | contribs | block) (New user)
18:26 (cur; last) . . SA1 (Talk | contribs | block) (New user)

While we don't forbidden multiple accounts per se, but it doesn't seem coincidence/on a good faith. --Aphaia 18:29, 9 May 2007 (UTC)

Emma Watson wikiquote pageEdit

This was supposed to be unblocked on May 6th, 2007. It is still blocked. Just thought you should know.

Thanks. The protection was already expired. I removed the tag. --Aphaia 18:19, 7 May 2007 (UTC)

Question Regarding Use of Wikiquote for School ProjectsEdit

Hello, my account (Mrs. Herntaq) was recently blocked for "Inserting nonsense/gibberish into pages: vandal;" however, I'm not sure what I really did wrong. My only edits so far were to welcome my students, who for a class poroject are contributing to open-source knowledege databases (our class choose Wikiquote, folowling the recommendation of one of my students). Getting back to the question, is this premissible in the rules of Wikiquote? The student who made the sugesstion assured me it was. If not, I'm happy to leave, it would just be a shame if my students had lied to me about this. I thank you for your anticipated reply. 208.53.158.92 18:44, 9 May 2007 (UTC) (Normal account "Mrs. Herntaq"), blocked so using alternate computer

Well, reviewing the activity of Mrs. Herntaq (talk · contributions) and accounts related to it, namely consecutively numbered accounts SA1 (talk · contributions) through SA11, I'd have to say you had the incredibly bad luck to have had only one active student who happens to be a well-known vandal here. Or else you are that vandal and are merely posing as a teacher in another tired variation of the old multiple-user vandalism scheme. Given that most teachers know how to spell words like "permissable" and "following", I'd lean toward the latter interpretation, as Aphaia suggests below. Oh, and thanks for letting us know about your vandalism below using a different IP address (208.53.158.92) in the same Chicago network IP pool. Usually you create another user to do this, but it was a little more obvious this time. ~ Jeff Q (talk) 00:34, 10 May 2007 (UTC)

Strange HappeningsEdit

Have a look at Special:Logs/newuser it seems as if an automated system is creating accounts for vandalisim use. Some of the accounts (SA1 and SA2) have already started a automated "Wazz" attack. We need to have a b'crat preform a meta check-user to get to the source of these unrelentless attacks. 208.53.138.102 19:08, 9 May 2007 (UTC)

UPDATE: Also note User:Vagish (claiming to be Wikipedia User Vagish) was created during the Wazz attack. It seems as if we have another round of Wazz cross project trolling on out hands just waiting to happen. 208.53.138.102 19:14, 9 May 2007 (UTC)

Thank you for your report, I would have been better to act more boldly. 208.53.158.92 was actually Wazz, I think now. I put one month blocking on this IP address.

Since on English Wikiquote Vagish page says s/he is now offline, so I suspect the account here would an impostor. I therefore blocked it until Vagish confirms this account, preventing further disruption, if any. --Aphaia 19:27, 9 May 2007 (UTC)

The account was confirmed by w:user:Vagish. --Aphaia 09:43, 10 May 2007 (UTC)

Two investigationsEdit

copied from m:Requests for CheckUser information


En Wikiquote part 2Edit

note to checkusers: contact Pathoschild for archived data.

Willy on Wheels or its follower attacked ENWQ recently and we changed the move setting from [user] to [autoconfirmed]. It might be dormant accounts, so I request for checkuser to detect those possible vandal accounts. Would you please to perform CU on user:Auburn Pilot, user:Jesus the Tank Engine and User:Pene Naranjo, and let us know accounts created from the same IP addresses, if appropriate? (Hmmm, we need a local page for "long-term vandals"?) --Aphaia 17:02, 10 May 2007 (UTC)

The user operates from a pool of dynamic IP addresses assigned to Virgin Media, with each account on a different address. There is no way to block the user without the possibility of significant collateral damage, given the wide ranges involved.{admin} Pathoschild 04:01:00, 11 May 2007 (UTC)

En WikiquoteEdit

note to checkusers: contact Pathoschild for archived data.

There has just been a recent vandal attack there (the user appears to be a punctuation mark [5]). Reading the Admin board there [6] it looks like this has happened before. I'd like to see CU run to see if there is any connection and (if appropriate) the IP blocked for a period. Thanks --Herby talk thyme 13:23, 10 May 2007 (UTC)

Thanks. From me too I request for checkuser on the requested account as well a series of Wazz accounts, User:SA1 to User:SA11, and User:Mrs. Herntaq. As for discussion, WQ:AN#Question Regarding Use of Wikiquote for School Projects might be more relevant for this vandal whom we called "Wazz". For your information, the account Vagish is confirmed by en:user:Vagish as his or her own, so it was just coincidence. --Aphaia 16:53, 10 May 2007 (UTC)
Vagish was not related, but the following users are: group A{%DB%9D (encoded), Gartermac, Mrs. Herntaq, SA1, SA2, SA3, SA4, SA5, WQAS1, WQAS2, WQAS3, WQAS4), group B{SA6, SA7, SA8, SA9, SA10, SA11, WQAA1, WQAA2). Versioning and whois indicates that the users most likely operated from a computer lab behind a dynamic proxy assigned to Carbon Lehigh Intermediate school Unit 21 (209.18.48.0/20). group A edited from various IP addresses assigned to the school, while group B seems to have used a web proxy installed on ptrhosting.com (72.232.50.146). Versioning indicates a probability that multiple persons were involved, probably students in a computer lab. —{admin} Pathoschild 03:39:27, 11 May 2007 (UTC)

ReactionsEdit

According to the result, I put two blocks

  • For 72.232.50.146 (talk · contributions), one year. Only anon, preventing account creation for now. This setting could be later changed.
  • For 209.18.48.0/20, one day, since it is a ranged block (see WQ:BP). Both accounts and anons are blocked, account creation is prevented.

Your comments will be very appreciated. --Aphaia 06:57, 11 May 2007 (UTC)

The first IP - fine (IMO) and it has been trouble on another Wiki before (late March). The other one - you now have a marker, if it is checked again the history will build but hard to deal with "spread" vandalism like that --Herby talk thyme 12:23, 11 May 2007 (UTC)
I endorse the block. Cbrown1023 talk 20:03, 11 May 2007 (UTC)

P.S. Also the IP address below is being blocked for a month:

Needs review/block?Edit

User:Dapledasfarm and associated IP? Sorry - in a rush! --Herby talk thyme 08:51, 11 May 2007 (UTC)

I put a permanent block on the account, because it was plainly created merely for vandalism and abuse. ~ Kalki 09:00, 11 May 2007 (UTC)
Thanks - an IP edited the same page I marked for deletion - almost certainly the underlying IP of the user. Could be worth a "memo" block for future reference --Herby talk thyme 12:21, 11 May 2007 (UTC)

Report two blockEdit

Just after a mess created by Wazz, two familiar username appeared on our newuser log, and under the suspicion of impostors, I blocked two accounts (Vagish and Tango).

Enwp user:Vagish confirmed it as his or her legitimate account on English Wikipedia, so I unblocked it (it was really a coincidence). On the other hand, User:Tango was taken by a third party according to w:user:Tango. Once I asked Tango to let us know please, if he would like to usurp it, but this is a common name so it could be also coincidence.

It is obvious if SUL is introduced, en:user:Tango will take this account thanks to his huge contributions to English Wikipedia, and I have no other user known with this user name on other projects. But there is a possibility this account was taken on a good faith (note: we haven't perform CU about recent impostors), I would like to hear your opinions how we should do. --Aphaia 09:38, 12 May 2007 (UTC)


Checkuser rightsEdit

moved back to WQ:AN

ChristianityEdit

Heads up really - this page has been vandalised twice today over a couple of hours by the same IP (User talk:71.188.1.236 & warned). They appear to be blanking the same section each time. Thanks --Herby talk thyme 12:55, 17 May 2007 (UTC)

Thank you for your notices, I s'protected page for a day. --Aphaia 18:00, 17 May 2007 (UTC)

Block recommendationsEdit

Hi - can I recommend a couple of IP blocks please - firstly 198.87.3.70 (talk · contributions) is an open proxy and should be blocked for however long your practice here is. Secondly 64.27.13.93 (talk · contributions) is an exploited IP and has been blocked on 4 other Wikis over the past hour or so for three months. This information is derived from a number of sources but relates to cross wiki vandalism. I'll happily supply more information if anyone likes to contact me. Regards --Herby talk thyme 17:18, 18 May 2007 (UTC)

Both blocked! :) Cbrown1023 talk 00:28, 19 May 2007 (UTC)
Thanks - User:66.160.172.234 is the next one! Blocked on en wp indefinitely as a "blocked proxy". Now blocked anywhere I can for 2 years, probably source of recent vandals accounts/exploits. Cheers --Herby talk thyme 07:31, 19 May 2007 (UTC)
Blocked for six months. --Aphaia 07:59, 19 May 2007 (UTC)
Last modified on 20 May 2007, at 08:49