[02:24:35] [discord] Yeah, that makes a lot more sense. [02:25:01] [discord] @Doug / dmehus Hope you're available tonight to deal with the CU requests I've added here. [03:37:33] @DarkMatterMan4500, okay, will look above [03:41:48] @DarkMatterMan4500 (cc: @raidarr), I don't think Blu-Ray Haas is likely, chiefly because DVD Haas != "Nobh"/"Noah", despite some local administrators insisting they're related, we've not found any evidence this is the case [03:42:00] Agent, can you ping DMM and raidarr for me please? [03:44:51] [discord] @raidarr ^ [03:44:56] [discord] DMM was pinged already [04:24:50] Agent, thanks :) [04:37:07] [discord] Thank you for that range block. hopefully that keeps them quiet for a while [04:38:02] hb1290, thanks. I was going to reach out to you first, but figured you wouldn't mind. It's anon. only, and, hopefully, should have minimal effect on legitimate users. I've created a help page if anyone is affected :) [04:38:51] I will suggest to @raidarr and @Reception123 to limit use of that T-Mobile rangeblock to 30-60 days, at most, and always local only where there is persistent and sustained abuse and disruption [04:43:07] $log Locally soft rangeblocked [[mh:closinglogosgroup:Special:Contributions/2607:FB90::/32|T-Mobile USA IPv6 range]] due to persistent, sustained abuse and disruption, for 30 days. Locally endorsed by local administrator(s) [04:43:07] https://mh.wikipedia.org/wiki/closinglogosgroup:Special:Contributions/2607:FB90::/32 [04:43:13] Saved item "Locally soft rangeblocked [[mh:closinglogosgroup:Special:Contributions/2607:FB90::/32|T-Mobile USA IPv6 range]] due to persistent, sustained abuse and disruption, for 30 days. Locally endorsed by local administrator(s)" [04:43:13] https://mh.wikipedia.org/wiki/closinglogosgroup:Special:Contributions/2607:FB90::/32 [04:43:24] $log Locally soft rangeblocked [[mh:companybumpers:Special:Contributions/2607:FB90::/32|T-Mobile USA IPv6 range]] due to persistent, sustained abuse and disruption, for 30 days. Locally endorsed by local administrator(s) [04:43:24] https://mh.wikipedia.org/wiki/companybumpers:Special:Contributions/2607:FB90::/32 [04:43:31] Saved item "Locally soft rangeblocked [[mh:companybumpers:Special:Contributions/2607:FB90::/32|T-Mobile USA IPv6 range]] due to persistent, sustained abuse and disruption, for 30 days. Locally endorsed by local administrator(s)" [04:43:31] https://mh.wikipedia.org/wiki/companybumpers:Special:Contributions/2607:FB90::/32 [04:45:36] $log Created read whitelisted [[mh:cvt:Advice to T-Mobile IPv6 users|help page]] on [[mh:cvt|cvtwiki]]. [[m:Counter Vandalism Team|CVT]] members [[rfc:2119|should]] use the following block reason, of 30-60 days and ''always'' soft and local:

Persistent abuse & disruption. [[mh:cvt:Advice to T-Mobile IPv6 users|T-Mobile soft rangeblock]]. [[m:Counter Vandalism Team|Counter Vandalism Team]] action

[04:45:36] https://mh.wikipedia.org/wiki/cvt:Advice_to_T-Mobile_IPv6_users https://mh.wikipedia.org/wiki/cvt https://meta.wikimedia.org/wiki/Counter_Vandalism_Team https://tools.ietf.org/html/rfc2119 https://mh.wikipedia.org/wiki/cvt:Advice_to_T-Mobile_IPv6_users https://meta.wikimedia.org/wiki/Counter_Vandalism_Team [04:45:45] Saved item "Created read whitelisted [[mh:cvt:Advice to T-Mobile IPv6 users|help page]] on [[mh:cvt|cvtwiki]]. [[m:Counter Vandalism Team|CVT]] members [[rfc:2119|should]] use the following block reason, of 30-60 days and ''always'' soft and local:

Persistent abuse & disruption. [[mh:cvt:Advice to T-Mobile IPv6 users|T-Mobile soft rangeblock]]. [[m:Counter Vandalism Team|Counter Vandalism Team]] action

" [04:45:45] https://mh.wikipedia.org/wiki/cvt:Advice_to_T-Mobile_IPv6_users https://mh.wikipedia.org/wiki/cvt https://meta.wikimedia.org/wiki/Counter_Vandalism_Team https://tools.ietf.org/html/rfc2119 https://mh.wikipedia.org/wiki/cvt:Advice_to_T-Mobile_IPv6_users https://meta.wikimedia.org/wiki/Counter_Vandalism_Team [06:25:58] .gj Void-bot [06:25:58] You're doing good work, Void-bot! [06:57:22] Welcome Guest95. If you need to report spam or abuse, please feel free to notify any of the voiced (+v) users, if it contains personal information you can pm them, or email us at cvt [at] miraheze.org [06:58:38] Welcome Camenati. If you need to report spam or abuse, please feel free to notify any of the voiced (+v) users, if it contains personal information you can pm them, or email us at cvt [at] miraheze.org [07:05:50] Camenati: can we help [07:23:21] I forgot I had this tab open. I was simply testing to see if I can get in. Sorry about that. [09:52:52] [discord] @Doug / dmehus That's what I initially thought. [13:16:30] [discord] I think haas and noah are at best uncertain links and shouldn't really be treated as the same, that is, noah indicators should come absolutely first when they appear clearly [13:16:50] [discord] in any case noted on the t-mobile business, which is unfortunate given its reach [14:23:02] [discord] [[Special:CentralAuth/Pmb1226]] Uhhh, there's a vandal vandalizing the `giantesswiki`: https://giantess.miraheze.org/wiki/Special:Contributions/Pmb1226 [14:23:02] https://meta.miraheze.org/wiki/Special:CentralAuth/Pmb1226 [14:23:03] [discord] [14:23:03] [url] User contributions for Pmb1226 - Giantess Wiki | giantess.miraheze.org [14:23:04] [url] Global account information for Pmb1226 - Miraheze Meta | meta.miraheze.org [14:27:41] [discord] Can someone on @CVT please handle this one? ^ [15:05:58] $log addressed significant vandalism on [[mh:giantess|giantesswiki]] with reversions, revdels and local block [15:05:58] https://mh.wikipedia.org/wiki/giantess [15:06:06] Saved item "addressed significant vandalism on [[mh:giantess|giantesswiki]] with reversions, revdels and local block" [15:06:06] https://mh.wikipedia.org/wiki/giantess [18:06:08] raidarr: around [18:07:45] [discord] hmm [18:08:02] raidarr: I need you irc side for a PM [18:08:12] Or look at cvt feed [18:08:30] well maybe you don't want to look [18:08:42] [discord] oh, giantess again [18:09:01] Yes [18:09:32] [discord] https://giantess.miraheze.org/w/index.php?oldid=36039&rcid=34883 @raidarr This crap re-appeared again. [18:09:33] [url] Articles and press - Giantess Wiki | giantess.miraheze.org [18:09:40] raidarr: let me know if there's anything we can do to assist [18:09:59] @DarkMatterMan4500: please don't link to the diffs publicly [18:10:05] And delete your discord message [18:10:06] [discord] what I need is a co-investigator to see why semi-established accounts have been going off on giantess today [18:10:17] raidarr: join irc [18:10:22] [discord] the first one was disturbingly established and to me indicates conspiracy of some sort [18:10:27] Note: DO NOT CLICK THAT LINK [18:10:28] on [18:11:07] [discord] RhinosF1 Sorry about that. [18:11:25] [discord] I should have linked the user's global account information instead [18:11:30] [discord] I should have linked the user's global account information instead. (edited) [18:12:10] [discord] I suspect it's the same user we dealt with this morning. [18:12:30] yes [18:12:35] Me + Raidarr are talking [18:13:34] [discord] I deleted the message, although IRC can still see it. [18:15:05] [discord] [[Special:CentralAuth/DelSaraf]] Here's the account in question by the way. [18:15:05] https://meta.miraheze.org/wiki/Special:CentralAuth/DelSaraf [18:15:05] [discord] [18:15:06] [url] Global account information for DelSaraf - Miraheze Meta | meta.miraheze.org [18:17:18] Here I am on IRC. [18:17:27] $log revdel'd inappropriate content on giantesswiki [18:17:35] Saved item "revdel'd inappropriate content on giantesswiki" [18:18:32] Reception123 Thanks for rev'delling the inappropriate content. [18:19:27] no problem darkmatterman450 [18:19:59] The only thing I regret doing here was linking it here in public as RhinosF1 pointed that out to me. [18:21:11] darkmatterman450: I'm a bit confused, why? [18:21:31] I personally only saw blatant inappropriate/racist/CoC violating content but there's no rule against reporting that here [18:21:35] Reception123: because users don't need to see them images [18:21:40] Ah, images [18:21:45] I didn't see them, I just mass deleted [18:21:51] ^ Exactly what RhinosF1 said above. [18:22:42] Reception123 You're right. There's no rule saying about reporting it here. That would've been silly. [18:23:21] s/saying about/against [18:23:21] darkmatterman450 meant to say: Reception123 You're right. There's no rule against reporting it here. That would've been silly. [18:40:14] [discord] raidarr So they were the same person eh? [18:40:20] [discord] no [18:40:25] Oh. [18:40:26] [discord] though the agent responsible may have been the same [18:40:52] So you think those 2 accounts were hacked somehow? [18:41:34] [discord] technical evidence makes that very probable to me [18:42:22] And it seems like there's no master to find, is there? :( [18:43:07] [discord] Special attention should be paid now to any more potentially compromised accounts if that’s the case [18:43:23] [discord] That I agree with. 🙂 [18:44:29] [discord] no known master [18:44:37] [discord] it does strike me as very 'ed' vandalism [18:44:52] Something we should **ALL** pay close attention to. [18:45:06] [discord] I'd like to consider an abusefilter, local and/or global for that sort of addition [18:45:24] [discord] Then by all means, go for it. 🙂 [18:45:30] [discord] That would make sense [18:45:32] [discord] I am the worst person to actually make the filters [18:46:05] [discord] but, I do see the need, especially since there were a lot of components to the vandalism I think are globally strikable [18:46:06] [discord] hehe,maybe chrs could help [18:46:14] [discord] I'd very much appreciate chrs's intervention [18:47:09] [discord] But he seems to be logged out on IRC for some days now.. [18:47:56] [discord] He was on a few hours ago I believe [18:48:25] [discord] Either way, it may be possible to just use an existing filter and tweak it a little to look out for any other words [18:51:18] [discord] Oh [19:08:15] o7 John [19:13:28] Hey [21:05:19] what sort of filter are we looking at? [21:05:19] [tell] chrs: 2022-04-26 - 16:46:05UTC tell chrs Hello, Can we talk when you're around? [21:07:45] [discord] @Ugochimobi about this or something else? [21:11:47] [discord] Possible expansion to include more keywords, but also mass blanking/significant content removal, perhaps a more liberal content removal clause where a lot is removed but combining keywords [21:12:58] [discord] so it's possible to block the uploading of files by hash via an abusefilter, which could block low-effort goatse/shock site vandalism [21:14:03] [discord] Yeah, 2 users were suspected of being compromised by someone to upload shocking or gore content that would easily be matched up to those of Encyclopedia Dramatica. [21:14:25] [discord] uh yeah I saw the image title that got spammed [21:14:43] [discord] Oh, forgot about that. Heh hehehe. 😛 [21:16:51] [discord] `action == 'upload' & file_sha1 == 'fa4d4ef5024534bc6ac146d480d9f27f19f0c48b'` should help [21:17:16] [discord] How great is that filter? [21:18:27] [discord] blocks you from uploading goatse [21:19:10] [discord] stupidly easy to get around (if someone understands the filter it's whack-a-mole not worth playing), but it stops you from just grabbing the image from [redacted] and uploading [21:19:30] [discord] it's a good stopguard against default one-offs at least [21:19:58] [discord] technically I could do the same by referring to other such ED files and pretty much hitting that line outright [21:20:04] [discord] since there were several in use/could be used [21:26:22] [discord] ``` [21:26:23] [discord] action == 'upload' & [21:26:24] [discord] equals_to_any(file_sha1, [21:26:26] [discord] 'fa4d4ef5024534bc6ac146d480d9f27f19f0c48b' /* comment here */ [21:26:27] [discord] ) [21:26:28] [discord] ``` [21:26:30] [discord] would be a more general structure [21:29:33] [discord] for outright mass blanking, there's the wikipedia filter: https://en.wikipedia.org/wiki/Special:AbuseFilter/3 which can be set up with a rate limit [21:40:39] [discord] yeah, a hit on pure mass blanking sounds particularly useful [21:47:52] [discord] then there's the usual stuff to deal with mass-adding of specific words (i.e. slurs/sexual things) [22:18:49] [discord] I have bad news [22:19:09] [discord] Noah somehow managed to circumvent the T-Mobile block on the CLG Wiki https://closinglogosgroup.miraheze.org/wiki/User:Thegoat_is_on_the_loose [22:19:12] [url] User:Thegoat is on the loose - CLG Wiki | closinglogosgroup.miraheze.org [22:19:23] [discord] noah is proficient in the use of proxies [22:19:27] [discord] those are not so easy to wipe en masse [22:21:17] [discord] oh wait a minute, there's more in that range than doug knew about [22:21:53] [discord] cc @Doug/dmehus or @Orduin if available; ipv6 t-mobile needs coverage as well [22:22:05] [discord] cc @Doug/dmehus or @Orduin if available; ipv6 t-mobile needs (local) coverage as well (edited) [22:23:13] [discord] another remedy we can test locally though: above abusefilter set to harshly smack anyone coming out and blanking in that manner [22:23:31] [discord] Almost immediately after that account got globalled... https://closinglogosgroup.miraheze.org/wiki/User:NYC_Subway [22:23:33] [url] User:NYC Subway - CLG Wiki | closinglogosgroup.miraheze.org [22:24:28] [discord] We already have an AF for page blanking but it's set to "log only" [22:25:00] [discord] Good idea [22:25:07] [discord] well, lets set it to 'kill them' >.> [22:25:34] [discord] it doesn't actually seem to be very accurate anyway [22:25:45] [discord] there are flagrant blanks and it doesn't seem to match them at all [22:25:46] [discord] @raidarr If you're up to nuke the entire T-Mobile IPv6 range then you could via Special:MassGlobalBlock [22:26:12] [discord] if these users are autoconfirmed then it doesn't affect them [22:27:00] [discord] I don't think it was ever a mass *global* block, just a local one [22:27:12] [discord] or did I misunderstand the scope [22:27:30] [discord] ah, I forgot it's only a local block [22:27:48] [discord] we need a Special:MassLocalBlock now [22:28:04] [discord] the wiki might benefit from wikipedia's slimmer anti-blank mechanism [22:28:21] [discord] I've been trying to slow this kid's blanking and profanity-laced vandalism down by repeatedly undoing and redoing a small edit I make to pages he's targeting to try to lock him out of being able to edit the page until the admins or stewards take action, but this kid has been ***RELENTLESS*** and it's getting so exhausting [22:28:25] [discord] seems to work? [22:28:33] [discord] @raidarr ^ [22:28:37] [url] Abuse filter log - Miraheze Meta | meta.miraheze.org [22:29:31] [discord] Seems this wiki has a lot of unnoticed spam: https://thestarsareright.org/wiki/Special:AllPages [22:29:32] [url] All pages - The Stars Are Right | thestarsareright.org [22:30:39] [discord] could be done via a script if needed [22:32:23] [discord] Seems this wiki has a lot of unnoticed spam: https://thestarsareright.org/wiki/Special:AllPages [22:32:24] [discord] (I noticed on the list of wikis that it has thousands of users but only a few pages - possible dormant spammers?) (edited) [22:32:25] [url] All pages - The Stars Are Right | thestarsareright.org [22:34:23] [discord] If anything, this filter should be fully enabled [22:34:24] [discord] I've set up the global anti-blank filter to put a hard stop in the activity, doesn't yet do much like auto block [22:34:41] [discord] seems to be working [22:34:44] [discord] set it up locally I should say [22:35:32] [discord] And they found a way to bypass that [22:35:37] [discord] lovely [22:37:40] [discord] i've got some ideas on how to stop that [22:37:51] [discord] [[Special:CentralAuth/User is good]] [22:37:51] https://meta.miraheze.org/wiki/Special:CentralAuth/User_is_good [22:37:52] [discord] [22:37:52] [url] Global account information for User is good - Miraheze Meta | meta.miraheze.org [22:37:54] [discord] hmm [22:38:22] [discord] seems like doug actually issued a block against the ipv6 range that is in question [22:38:28] [discord] so now I'll have to backtrack [22:39:08] [discord] for the moment, i'd suggest taking the check `new_size/(old_size + 1) < 0.1` from the wikipedia filter [22:39:57] [discord] ach, now I'm just not reading, it *is* another range [22:40:07] [discord] I'll just have to figure out how big it is and strike accordingly I guess [22:40:18] [discord] user is now spamming [22:40:48] [discord] it's painful to see that he hasn't given up [22:41:51] [discord] ^ This [22:42:56] [discord] hardblocked 'till I figure out a bit more about the involved range [22:43:19] [discord] ahh the wonders of tmobile [22:45:36] [discord] Thank you for globalling the accounts and hardblocking their range raidarr! 😁 [22:47:05] [discord] doesn't look like there was a rangeblock, only a specific IP [22:47:19] [discord] Thank you for globalling the accounts and hardblocking their ip raidarr! 😁 (edited) [22:47:20] [discord] which is odd since autoblock should catch that [22:48:25] [discord] I hardblocked the one [22:48:34] [discord] dmehus struck one range, but there's many more in increment [22:48:43] [discord] I'll go ahead and wipe out a few now [22:50:11] Greetings, this is Camenati. There is a user by the name of NYC Subway who is blanking pages on the CLG Wiki. [22:50:30] [discord] Done ^ [22:50:34] [discord] [22:50:35] [url] User:Void/massGBlock.js - Miraheze Meta | meta.miraheze.org [22:50:50] [discord] (does both btw) [22:50:57] [discord] o [22:51:03] [discord] TIL [22:51:09] [discord] I defer to Void if he's aware of a more finessed way to handle t-mobile than what I'm doing, which is basically blowing away x.x.(everythingafter)/32 that is connected to it incrementally [22:52:17] [discord] apparently t-mobile also has an abuse reporting service I might take them up on [22:52:32] [discord] https://plazmaburst.miraheze.org/wiki/SITUS_SLOT_ONLINE_TERPERCAYA_SLOT_ONLINE_TERLENGKAP_2021 - Spam made by https://meta.miraheze.org/wiki/Special:CentralAuth/Alexaclient [22:52:33] [discord] https://plazmaburst.miraheze.org/wiki/Situs_judi_slot_online_gampang_menang - Spam made by https://meta.miraheze.org/wiki/Special:CentralAuth/Reskrimpolr [22:52:34] [url] Situs judi slot online gampang menang - Plazma Burst Official Wiki | plazmaburst.miraheze.org [22:52:34] [discord] https://plazmaburst.miraheze.org/wiki/User:Agen38pokerjudi - Spam in a SocialProfile page [22:52:35] [url] Global account information for Reskrimpolr - Miraheze Meta | meta.miraheze.org [22:52:36] [discord] https://closinglogosgroup.miraheze.org/wiki/User:Dominoqq, https://rottenwebsites.miraheze.org/wiki/User:Dominoqq, https://mrlove.wiki/wiki/User:Dominoqq- Spam in SocialProfile page [22:52:37] [discord] https://thestarsareright.org/wiki/Special:AllPages - Mass spam that requires various deletions [22:52:37] [url] SITUS SLOT ONLINE TERPERCAYA SLOT ONLINE TERLENGKAP 2021 - Plazma Burst Official Wiki | plazmaburst.miraheze.org [22:52:38] [url] User:Agen38pokerjudi - Plazma Burst Official Wiki | plazmaburst.miraheze.org [22:52:39] [url] User:Dominoqq - CLG Wiki | closinglogosgroup.miraheze.org [22:52:40] [url] All pages - The Stars Are Right | thestarsareright.org [22:52:40] [discord] we've lots of spam [22:52:41] [url] Global account information for Alexaclient - Miraheze Meta | meta.miraheze.org [22:52:42] [url] User:Dominoqq - Rotten Websites Wiki | rottenwebsites.miraheze.org [22:52:44] [url] User:Dominoqq- - Mr. Love Wiki | mrlove.wiki [22:52:58] [discord] damn [22:53:24] [discord] it seems these bots are becoming aware of CentralAuth and global accounts [22:54:05] [discord] I'm going to look like a tyrant with all the locks and cus I've been doing today [22:56:36] [discord] https://plazmaburst.miraheze.org/wiki/User:Sparta7 [22:56:36] [discord] https://plazmaburst.miraheze.org/wiki/User:Sovur [22:56:38] [discord] https://plazmaburst.miraheze.org/wiki/User:Sparaa7 [22:56:38] [url] User:Sovur - Plazma Burst Official Wiki | plazmaburst.miraheze.org [22:56:38] [url] User:Sparta7 - Plazma Burst Official Wiki | plazmaburst.miraheze.org [22:56:39] [discord] https://plazmaburst.miraheze.org/wiki/User:Keuntungan_Bisa_di_Peroleh_Dengan_Bermain_Judi_Slot_Online_QQOWL [22:56:40] [url] User:Sparaa7 - Plazma Burst Official Wiki | plazmaburst.miraheze.org [22:56:40] [discord] https://plazmaburst.miraheze.org/wiki/User:Slotgame77 [22:56:41] [url] User:Keuntungan Bisa di Peroleh Dengan Bermain Judi Slot Online QQOWL - Plazma Burst Official Wiki | plazmaburst.miraheze.org [22:56:42] [discord] https://plazmaburst.miraheze.org/wiki/User:Segelan [22:56:42] [url] User:Slotgame77 - Plazma Burst Official Wiki | plazmaburst.miraheze.org [22:56:43] [discord] https://plazmaburst.miraheze.org/wiki/User:Stefany88 [22:56:43] [url] User:Segelan - Plazma Burst Official Wiki | plazmaburst.miraheze.org [22:56:44] [discord] SocialProfile spam ^ [22:56:44] [url] User:Stefany88 - Plazma Burst Official Wiki | plazmaburst.miraheze.org [22:57:07] [discord] oh dear [22:57:17] [discord] I'm going to need to use more finesse for this aren't I [22:57:21] [discord] https://crappygames.miraheze.org/wiki/User:Qquoonum - SocialProfile spam [22:57:23] [url] User:Qquoonum - Crappy Games Wiki | crappygames.miraheze.org [22:57:27] [discord] i believe it would actually be a /28 in this case [22:57:45] [discord] hm, I was just mimicking what doug did with the 90 and incrementing to 91, 92... [22:57:55]