[00:24:00] @cvt LTA on metawiki [00:24:11] Meta administrators may want to block in the interim [00:24:39] [[User:いきるみちのバ力ヤ口ー]] [00:24:39] https://meta.miraheze.org/wiki/User:%e3%81%84%e3%81%8d%e3%82%8b%e3%81%bf%e3%81%a1%e3%81%ae%e3%83%90%e5%8a%9b%e3%83%a4%e5%8f%a3%e3%83%bc [00:24:47] [[Special:CentralAuth/いきるみちのバ力ヤ口ー]] [00:24:47] https://meta.miraheze.org/wiki/Special:CentralAuth/%e3%81%84%e3%81%8d%e3%82%8b%e3%81%bf%e3%81%a1%e3%81%ae%e3%83%90%e5%8a%9b%e3%83%a4%e5%8f%a3%e3%83%bc [00:27:23] @CVT (pinging for dmehus) [00:28:59] @finsanity ty :) [00:43:23] I think the @Stewards should investigate this, honestly. It's so obvious that there's some abuse going on cross-wiki. [00:51:52] And just look at Void go. He's already looking into this. [00:57:34] thanks everyone :) [02:57:31] No problem, dmehus. [07:26:45] oh my goodness. [07:27:04] https://poserdazfreebies.miraheze.org/wiki/User:153.80.249.3 [07:27:24] this user has triggered the blanking abuse filter hundreds of times [07:27:34] im pretty sure close to 1000 [07:28:41] hehe, Doug tripped a filter also for blanking [07:29:56] some very minor vandalism on funvasion, not really actionable, reverted for now https://funvasion.miraheze.org/wiki/Madagascar_3:_Europe%27s_Most_Wanted_Credits?diff=prev&oldid=186570 [08:38:47] did someone open a CheckUser on themself?https://meta.miraheze.org/wiki/Steward_requests/CheckUser#%EC%A0%A0%40wikipediawiki [08:39:07] yeah they did [09:00:08] what is wikigallaghers [09:01:06] [1/2] why would someone want to be checkusered? [09:01:07] [2/2] i guess i would open a request to be cued to know what data is being collected from me [09:02:05] i think pinging cvt might work if it was capitalized [09:04:36] well...maybe [09:21:45] The Gallagher brothers are the members of the band Oasis. [11:30:55] @crystalite13 I fixed their request, as all it led me to was a non-existent wiki. [11:51:13] [1/2] [[Special:CentralAuth/Childrentoucher]] @CVT I found this extremely inappropriate username, and [these abuse logs](https://supergarrysmodserver.miraheze.org/wiki/Special:AbuseLog?wpSearchUser=Childrentoucher) from the ``supergarrysmodserverwiki`` has tried to vandalize a page by trying to [imply that someone named "Console" was a "pedophile"](https://supergarrysmodserver.mira [11:51:13] https://meta.miraheze.org/wiki/Special:CentralAuth/Childrentoucher [11:51:13] [2/2] heze.org/wiki/Special:AbuseLog/225) [and using racial slurs,](https://supergarrysmodserver.miraheze.org/wiki/Special:AbuseLog/229) which indicates a violation of the Global Conduct Policy. It went unnoticed for 3 weeks now, it seems. [11:51:14]

[12:28:01] oh alright [12:29:55] [1/2] yeah that's personal attacks on someone else...oof [12:29:55] [2/2] https://cdn.discordapp.com/attachments/443926951292567562/1532364618121351178/F01B68C5-642B-4FAC-8F40-1029604C37C3.png?ex=6a6c9542&is=6a6b43c2&hm=646f76d15decabfa50b241b41907a5ed569653e6b3eb73cb92f3cda9f2c8a612& [12:30:57] that reminds me of checking AF logs on wikioasis [12:35:16] Yeah, it's definitely a personal attack, but it's also an egregious violation of the Global Conduct policy nonetheless. [12:35:37] which means they should be assassinated [12:35:50] ...this reminds me of someone [12:38:32] What is [this?](https://meta.miraheze.org/wiki/Requests_for_Comment/Igisenderek) [16:55:19] @cvt: [16:55:45] [[Special:Contributions/46.133.41.108]] [16:55:45] https://meta.miraheze.org/wiki/Special:Contributions/46.133.41.108 [16:56:38] locally blocked [17:00:21] heres your @CVT ping but prob unneeded now(?) [17:03:35] thanks :) [17:16:18] @dmehus You might be right that the user might be trolling, and it does seem strange that the user went right into the [[SR/CU]] page just after editing their own user page. [17:16:18] https://meta.miraheze.org/wiki/SR/CU [17:16:18]

[17:18:22] @darkawfulguy64: yep [17:20:00] that's at least the second time you've misspelled that name @dmehus lmao [17:27:45] @thewwrdguy: oh, oops, I never noticed. what's a `fawful`? [17:28:12] oops [17:28:19] nerd* [17:29:10] the one thing in common with all these IPs vandalizing the steward pages, is that they're all Ukraine IPs (various ISPs) [17:29:19] MacFan4000: yeah :( [17:29:34] I'd be surprised if they're actually *in* the Ukraine [17:29:52] > https://mario.fandom.com/wiki/Fawful [17:29:52] thanks Google AI overview [17:31:59] if it continues, I'd be tempted to at least temporarily user protect some of the pages, since there is no reason for an IP to make those sort of requests anyway [17:35:16] MacFan4000: +1 to that. Honestly, there's little reason for IP editors to edit those pages. If it's a legitimate ban appeal, they should be e-mailing Stewards. If it's someone locked out of their account, they should be e-mailing Trust and Safety and/or Tech Team anyway [17:50:23] @dmehus Fawful is one of the villains in the Mario & Luigi series, and is Bowser's Inside Story's main villain. [17:50:58] dmehus: should always be tech [17:51:05] And we will consult with T&S if needed [17:51:18] T&S don't need to review every case of account lock out [17:51:39] RhinosF1: ack okay, thanks :) [17:51:39] Although they will carry out any investigative work on our behalf and they do review declines or cases on the line [17:52:12] If it's an obvious accept (which is almost never because almost no one has a committed identity, gpg key, ssh key etc) then we can just do it [17:52:19] @darkfawfulguy64: ah, yeah, when I saw that Mario wiki page, I thought he/they looked familiar [17:52:42] RhinosF1: absolutely [17:53:24] It might transfer to T&S in its entirety soon though [17:54:06] Special:Recover2FAForUser is a thing in 1.46 [17:54:38] True. I can see that. It does make sense, with T&S engaging Tech Team when needed [17:54:41] Oh [17:54:45] haven't read about that [17:54:55] is a documentation page prepped yet for that? [17:55:31] I don't think upstream have any docs no [17:55:35] ah [17:55:40] We are still assessing any policy changes [17:57:15] At the moment it will remain with Tech until we explicitly decide [17:57:24] There's also a new account recovery tool as part of EmailAuth [17:57:25] ah [17:57:42] oh, that sounds nice :) [17:58:17] Eh [17:58:47] So uh, what do we do about this account? [17:58:51] I kind of like it being difficult, it gives socially engineered T&S/Tech members time to think before handing over accounts [17:59:08] also we almost never recover accounts so [17:59:13] It's not like it's an often task [18:00:28] @Trust and Safety please on that one [18:00:32] Given the username [18:00:54] @darkfawfulguy64 probably a lock and hide for that [18:01:22] Oh, alright. [18:03:21] Which thing specifically are we talking about? [18:03:28] The Igisenderek or the russian IP? [18:03:39] The above is extremely messy to follow. [18:03:53] Those 2 were already handled, I am afraid. [18:05:26] Yeah, sorry about that. [18:06:40] NA, they were talking about the childrentoucher user [18:07:54] What Zppix has said. ^ [18:16:27] UltraSteam20114? [18:25:38] Nah, different one [18:25:47] The ultrasteam is a different issue [18:26:15] You didn't have your CheckUser flag on, so I thought it was strange. [18:54:59] steward hittable unless it is accompanied with content that I need not elaborate which is certainly in ts scope [18:55:24] a name remains in the bounds of exceedingly poor sense of taste and conduct [18:56:50] Agreed [19:00:22] [[Special:CentralAuth/Igisenderek]] I found that the account you mentioned originated from ``secretstaycationwiki`` and hasn't attached their account to Meta. [19:00:22] https://meta.miraheze.org/wiki/Special:CentralAuth/Igisenderek [19:00:23]

[19:00:26] agreed, username alone is grounds for a Username Policy violation and lock. If it has legitimate uses, that can be explained to stewards in an appeal [19:03:50] dmehus I don't think there is such a legitimate reason for such a tasteless username like that, honestly. [19:05:07] @darkfawful64: agreed [19:05:24] I was going to say the sole function would be for them to explain that they will not repeat such poor taste in the creation of another account, but given the edit that accompanied the name it is a character we will not be reconciling anyway I think [19:05:25] eek, I can't get your Discord username correct lol [19:05:33] @darkfawfulguy64* rather [19:06:03] @raidarr: agreed [19:10:51] [This wiki](https://secretstaycation.miraheze.org/wiki/Main_Page) is kinda interesting especially [from the recent changes.](https://secretstaycation.miraheze.org/wiki/Special:RecentChanges?hidebots=1&limit=1000&days=180&enhanced=1&urlversion=2) [19:12:43] oh it looks like an objectwiki... [19:13:31] and looks like it changed scope per the wiki request... [19:13:34] it has ibw connections [19:13:55] https://meta.miraheze.org/wiki/Special:RequestWikiQueue/76137 [19:14:52] Yeah, that should be looked into as soon as possible. [19:16:04] And it smells like one too. [19:16:31] I might be dense but as far as the recent changes point goes it seems to more or less be consistent to the scope with some messiness, its the main page where I get confused [19:16:46] half-broken module mess which appears to relate to some other game [19:17:06] it mentions BFDI on main page but its not mentioned at all in wiki request [19:17:47] I did go ahead and flag that wiki [19:18:16] Alright then. [19:18:19] this appears to be the work of Addmine001371 [19:18:24] very odd [19:19:24] [1/2] you can tell when stuff hit the fan and also see a familiar case referenced here [19:19:25] [2/2] https://cdn.discordapp.com/attachments/443926951292567562/1532467670807478413/image.png?ex=6a6cf53c&is=6a6ba3bc&hm=e844fc08c0c1fe8de3dad53d5d692b55b4f9301ceafddc6d2d0476f7de63d9b4& [19:19:34] the lower entries suggest cause for deeper investigation [19:19:54] [I came across this wiki](https://beautyqueenworld.miraheze.org/wiki/Main_Page) a couple of days ago, and I'm not quite sure what to say [to this.](https://beautyqueenworld.miraheze.org/wiki/Special:RecentChanges?hidebots=1&limit=1000&days=180&enhanced=1&urlversion=2) [19:20:56] @raidarr you know its bad when 2 stewards, a cvt member and a WR create accounts on your wiki within minutes of each other [19:21:46] Some of its pages look like they were copied and pasted, but what's weird is that they never imported anything from Wikipedia. [19:23:17] indeed, zppix [19:24:30] @darkfawfulguy64, some of the files on the site may also be violating copyright without any source information too, but I havent checked for certain, its very possible its just copy and paste at the rate they are making edits [19:24:35] LOL [19:24:44] that wiki needs a deeper dive than I can commit to in the next little while, open for cvt to collect all interesting pints such as the igisendwhatever account creations and what may seem related on a cvtwiki noticeboard page to slightly hasten the investigation process [19:27:03] But wait, [there's](https://thegioiempowermentvietnam.miraheze.org/wiki/Đặc_biệt:Thay_đổi_gần_đây?hidebots=1&limit=1000&days=180&enhanced=1&urlversion=2) [more!](https://worldempowermentvietnam.miraheze.org/wiki/Special:RecentChanges?hidebots=1&limit=1000&days=180&enhanced=1&urlversion=2) [19:29:32] I stand corrected by what I stated earlier. It wasn't the ``beautyqueenworldwiki`` I came across a couple of days ago (as I forgot I visited that wiki last month), it was actually both the ``thegioiempowermentvietnamwiki`` and the ``worldempowermentvietnamwiki`` I encountered. I should've been more clear on that. [19:43:46] Dang, looks like people were shadowing my wikistomping about. [19:44:55] @darkfawfulguy64 , in future please don't make edits on pages that I've swatted with TS hat on, that draws unneeded attention to what should remain a closed matter. [19:45:44] Sorry about that. I should've just waited till that was done and over with. [19:46:30] [There's some vandalism going on here, though.](https://durkomore.miraheze.org/wiki/%D0%A1%D0%BF%D0%B5%D1%86%D1%96%D0%B0%D0%BB%D1%8C%D0%BD%D0%B0:%D0%9D%D0%BE%D0%B2%D1%96_%D1%80%D0%B5%D0%B4%D0%B0%D0%B3%D1%83%D0%B2%D0%B0%D0%BD%D0%BD%D1%8F?hidebots=1&limit=1000&days=180&enhanced=1&urlversion=2) [19:47:00] I'm out of time for today, so will have to leave that for someone else to pick up [19:47:25] Alright then. Have a good rest of your day. [19:53:51] I suppose another @CVT member could help fight off this mess created by the IP editors. ^ [19:54:22] ill take a look [19:54:33] Because I am not gonna waste my time edit-warring with them. [19:54:56] have you been blocking them, and new ones keep springing up? [19:55:08] Yes. They keep springing up. [19:57:56] is your userpage supposed to have possibly sensitive info? [19:57:59] on the wiki [19:58:37] I'm not sure why you're even asking that. I'm 26 years old, not a teenager. [19:59:14] sensitive in the way it has like full name and location and full birthday [20:00:02] I didn't give out my physical address, though. Some people do this too, but not give out their full address or phone number. [20:00:22] ok, good to know [20:01:09] Trust me, I'm not that stupid enough to carelessly reveal that kind of sensitive information out in the open like that. [20:01:16] ugh, the pages have so many IP edits i cant tell which is from vandals [20:02:18] They're all over the place, doing this as a way to try and confuse us. [20:02:33] i'm going to go on a stretch and revert all IP edits [20:02:40] that sound alright or too much? [20:07:18] cleanup at leisure now [20:07:18] If there’s good faith real exits on there preferably not [20:07:22] ips revoked [20:07:53] ok, well some edit summaries from the IPs say stuff like "edit war" and similar [20:07:58] If it’s on time pressure I would rollback to a known good version, smack the baddies and bring back later if needed [20:08:06] If there’s an edit war then depends [20:08:25] and the baddies at this point are gone because no more ip [20:08:47] I think I will leave it permanently to be locally changed because the only bureaucrat who's edited this year is an extremely irregular presence [20:08:52] I still don’t like that remedy [20:08:57] But won’t argue [20:09:24] if ips are to return then it must be established that there will be local control that is not overwhelmed by the warring [20:09:50] otherwise for a wiki without proper management the precedent favors inertia over repetitive cvt-scope messes [20:12:15] if the good edits can be discerned properly, the bad editing IPs blocked for which I believe the 3 month bar should be adequate, and it is established this is a one off and not continuous warring, then the case can be made to reopen in a few days, I would be agreeable to that [20:13:57] which wiki is this? [20:20:15] [[mh:durkomore]] [20:20:15] https://mh.wikipedia.org/wiki/durkomore [20:20:16]

[20:24:13] raidarr: ah, still that one [20:45:05] About time. [20:46:41] I think I'm about to hit the full asn from russia globally given the volume and wide distribution of abuse [20:46:56] last time I checked it there weren't a lot of ranges [20:47:13] You just do what you have to do. [20:48:12] oh there's several asns, very well [20:48:21] may have to be more selective [20:50:19] this may also clear durkomore for ip reopening [20:51:21] It's unfortunate if most of that wiki's contributors are from russia and clustered around those ASNs. [20:51:37] But in fairness, we've had LTAs that were so persistent they got whole regions geoblocked for a time. [20:53:36] I think we are at the point of a carpet bomb action unfortunately because it hits meta, that wiki, perhaps others [20:53:52] drilling into that wiki now to see what ranges are involved and the collateral [20:54:11] will also probably have to mix with deducing what is constructive and what is not which will absorb remaining miraheze time today [20:56:33] Appreciated, I managed to clear out the email queue and a few other LTAs that decided to surface today, so urgent stuff is mostly resolved otherwise [21:06:09] I wonder how often does Miraheze have to deal with LTAs [21:07:10] Daily [21:08:34] Pretty sure it's not as often as WikiOasis, miraheze have roughly over 25x the wikis WO has... [21:09:00] Does it mean 25x less ltas... [21:13:44] [1/2] Surely editor traffic would be a better proxy than wiki numbers. [21:13:44] [2/2] But also, I wouldn't expect a higher number of wikis to result in less vandalism - it leads to more traffic so I'd expect the reverse. [21:14:54] I meant 25x less ltas for wikioasis, not miraheze lol [21:15:13] Oh, I misread. Sorry. [21:50:28] Yes, with the number of wikis (and notability/notoriety of some of them), we do almost certainly get more activity requiring CVT attention. When WikiTide split operations back in 2023, the drop in number of CVT reports was pretty substantial. [21:52:08] a lot of it comes down to measures taken as mediawiki is extremely permissive by default and allows entire categories of vandalism that other wikis have long had enough of and make limited, greatly reducing the occasion for our intervention [21:52:51] which also by nature of CVT is often for places that do not have local moderation that just takes care of things or builds their measures per ^ [21:54:36] even in cases where the IP seems constructive, I find the patterns indistinguishable and a couple times I have cross referenced between the russian wiki and meta and found the same IP engage in abuses on other pages, or even within the same wiki [21:54:58] so I'm afraid it is probable any short term constructive perception from these kinds of IPs is taking the piss [21:55:20] the typical history of pages only becomes stable with already registered users anyway [21:55:50] Yep, in that case, not worth winnowing the IPs then. [21:56:13] we may get some boost in account creation requests with a nuke, but imo probably only marginal [23:02:44] [1/3] phorge spam-only: [23:02:44] [2/3] [23:02:44] [3/3] [23:05:33] thanks Skye, didn't realize they were actively trying to spam on Phorge too; they've been repeatedly hitting the abuse logs on Meta [23:05:47] I DM'd raidarr about the Meta spam [23:06:41] i just dealt with the spam task that was created, though deleting the comments is up to phorge admins [23:06:58] thanks MacFan4000 :) [23:07:50] Locked on wiki [23:09:04] thanks :) [23:27:45] MacFan4000: can you block Special:Contributions/102.102.155.0/24 on Meta? It's spamming the Meta abuse logs [23:34:44] thanks @raidarr :) [23:35:01] just did a narrower hit on it [23:35:36] sounds good [23:35:37] o7 [23:35:51] I had to look up what o7 meant [23:35:58] thanks Google AI Overview :p [23:36:17] that IP is from Casablanca of all places