moved from User:Wik's user page

People have been asking about the recent vandalbot attacks. So we can say something here, and edit it to keep it up to date.

What we've got is edits from random accounts. Also, some from raw IPs. Each account makes a single edit, so blocking accounts doesn't work. The underlying IPs are mostly open proxies, which we've been blocking with Template:BlockedProxy. Currently vandalism to User:, User talk:, Wikipedia:, and Wikipedia talk: pages - aimed at Wikipedians, not readers. Some page moves. Some edits faked to look like page moves. Most vandalism is replacing a randomly chosen letter of the alphabet with another one.

Some proposed solutions:

• captcha
• disable new account creation and edits by anons.
• diable edits by non-sysops

For the record, the following is Jimbo Wales' post to wikipedia-l in which he reproduces Wik's vandalism threat and Jimbo's own response to it. Note that Jimbo is satisfied that the threat does indeed come from Wik (and I should add that the modus operandi of the latest attack matches that of previous attacks ascribed to Wik). -- ChrisO 11:57, 17 Jun 2004 (UTC)

Jimmy Wales jwales at bomis.com

Tue Jun 15 09:45:30 UTC 2004

The usual. The threat here is direct and warrants a permanent ban. I

can confirm this email to be that of user Wik, because he emailed me

using this account before he was banned, etc. The two are adequately

associated.

If it is possible to tie user Quagga to the ongoing activity on those

pages, then Quagga should be banned as well, not because of Wik's

threats but because the behavior is simple trolling.

Myself, I wonder if Wik is not just trolling himself in order to

harass us. One can never tell -- it seems that people will go to

extreme lengths when the point at stake is completely trivial,

juvenile, stupid and pointless.

--------------------------

From: wik1234 at fastmail.fm

Date: Mon, 14 Jun 2004 21:47:21 UT

Date: Mon, 14 Jun 2004 13:47:21 -0800

To: "Jimmy Wales" <jwales at bomis.com>

Subject: Quagga's vandalism

The vandalism goes on and on:

06:09, 14 Jun 2004 Isomorphic deleted "User talk:Wik/Talk/Wik" (trolling

by some anon)

06:09, 14 Jun 2004 Isomorphic deleted "User:Wik/temp" (trolling by some

anon)

06:09, 14 Jun 2004 Secretlondon deleted "User talk:User talk:Wik"

(content was: 'I have sucked hairy balls for most of my life. i enjoy

wathing elephants have sex because incase you didnt know, the elephant

penis is the size of my ...')

I made the mistake of trusting your word; you gave a supposedly final

warning to Quagga, but didn't follow up on it. Therefore I'll now give

you the final warning: if Quagga isn't banned within 24 hours, I'll

start a script which does everything automatically including changing

proxies as needed, so don't hope that I will tire of it; nor is there

anything else you can do against it. It will run until Quagga is banned.

Too bad you don't understand any other language.

• First vandalized Recentchanges and goings-on then this page as Aooa. (Can't find initial IPs in my history. He's going to come back a few times before he tires. - Tεxτurε 22:13, 15 Jun 2004 (UTC)
  • Initial IP was 167.206.174.29 - Tεxτurε 22:14, 15 Jun 2004 (UTC)

Some other usernames used by this user: Quuutaxivi, Qibedib. --Lst27 22:51, 15 Jun 2004 (UTC)

I found some more usernames that this user uses. Yuhutobor and Qabutow. These usernames should be blocked immediately. --Lst27 23:02, 15 Jun 2004 (UTC)

Also Rihod and Jueoiumiba. -- Cyrius|✎ 23:09, 15 Jun 2004 (UTC)

Also Oazevo, Laeauu and Toreb. --Lst27 23:17, 15 Jun 2004 (UTC)

It's Wik making good on his threat. See the mailing list at http://mail.wikipedia.org/pipermail/wikien-l/2004-June/013553.html. RickK 23:25, Jun 15, 2004 (UTC)

It's from a US IP block - sorry to disappoint you - you must be gutted. Secretlondon 23:56, 15 Jun 2004 (UTC)

Messed with User:Quagga's talk page: http://en.wikipedia.org/w/wiki.phtml?title=User_talk:Quagga&action=history

Secretlondon's comment is a non sequitur. What eveidence is there that Wik is not posting from the United States? RickK 04:28, Jun 16, 2004 (UTC)

When he's been on IRC he's had a German IP address - hwoever if they are open proxies then the location doesn't matter Secretlondon 04:33, 16 Jun 2004 (UTC)

His email address - instead of ending with .com or .net ends with .fm. .fm is for the Federated States of Micronesia --Kwagga (Quagga)

Fastmail is a well-known e-mail service, it just uses the .fm because it's abbreviated as that. The site is actually owned by a guy in Australia. [1] [ alerante | “” 14:12, 23 Jul 2004 (UTC) ]

They're open proxies - can be used from anywhere in the world... Oh, and he's got other email accounts, inc. a yahoo one.

Please look at the history of VfD. There are a series of edits that appear to be random find&replace of letters. Please protect the page soon. There are apparently several of us trying to keep the vandalism under control and we're stepping on each other... Rossami 21:05, 16 Jun 2004 (UTC)

See Vandal-bot above - Tεxτurε 21:12, 16 Jun 2004 (UTC)

There appears to be some question as to whether the vandalbot operator is actually Wik. For what it's worth, my talk page wasn't targeted until I sent Wik an email via Wikipedia containing a pop culture reference which seemed apposite. This is evidence that the operator of the vandalbot was at the receiving end of my email. You'll have to decide for yourselves how convincing this evidence is. -- Cyan 02:33, 17 Jun 2004 (UTC)

Brion and I made a feature allowing you to view all contributions from recently created accounts:

• Special:Contributions/newbies
• Special:Contributions/newbies with enhanced rollback

Contributions from the last 1% of user accounts to be created are shown. That's about 780 accounts. Not all Wik's, of course, but a fair proportion of them are. -- Tim Starling 08:16, Jun 17, 2004 (UTC)

Thanks for finding all those bot usernames Kingturtle. I used that list to perform an SQL query overwriting the user passwords. So now the accounts can't be used, so there's no need to have them cluttering up the block list. -- Tim Starling 01:26, Jun 18, 2004 (UTC)

• Glad to hear it. I had actually given up. It was mighty time consuming. Kingturtle 06:18, 18 Jun 2004 (UTC)

Would it make sense to add another level of protection in? I.e., mark a page as "slightly protected", meaning only logged in users can edit it, or only users with a certain minimum number of edits, etc... (or is this what sysop is for now?) --ssd 02:53, 18 Jun 2004 (UTC)

Hmm, someone was ahead of the times! 68.39.174.238 16:26, 17 July 2006 (UTC)[reply]

In case these accounts have not been found by other means, here is a list of recent "character" vandals from Wikipedia talk:Help on June 17 & June 18. Some edits were marked minor (confusing a couple of reverters), and all accounts only made one edit each. --Zigger 03:34, 2004 Jun 20 (UTC)

Aeuoqole, Cesipip, Dedeiufoie, Devueafi, Eiuexojigin, Nieouub, Oahanuluweji, Oilojenomo, Rebuf, Ruaeyab, Toiat, Vude.