Wikibooks:Reading room/Administrative Assistance/Archives/2009/March

Kaka wats
Ordinarily I'd give the user name the benefit of the doubt, but in context it seems likely to be intended scatologically: the user made four edits, all in a few minutes &mdash; three vandalism (which I undid, along with two strikingly similar edits by 86.0.40.11 made at the same time), and one creation of a straightforwardly scatological user page. There isn't really any point in letting this one sit around to gain autoconfirmation, is there? --Pi zero (talk) 20:53, 9 March 2009 (UTC)
 * Thanks - blocked. &mdash; Mike.lifeguard &#124; talk 20:58, 9 March 2009 (UTC)

Admin Advice Requested
It is with some surprise that I find the term powdering their vaginas within a bicycle repair article. Proposing to reword the paragraph, I note that by some mischance the text of the reference section is not available to the casual editor. Can an admin advise how to rework the piece? See Fixing a Flat, end of the page. Thanks, Armchair (talk) 18:06, 14 March 2009 (UTC)


 * Hi, the text you see at the end of the page is part of an inline reference higher up the page - you just need to edit it out (do a "find" on the text you want to delete and you'll find it at line 52ish on the page). I've deleted it now - see here for where it was. Unusual? Quite TalkQu 20:03, 14 March 2009 (UTC)

Block request
Per an SPI case at enwiki a CheckUser was requested, CU evidence (here) and editing habits confirm that User:33ohmygad is one of many abusive sockpuppets at enwiki. After checking with the SUL utility I figured I would alert you guys that one of the 20+ accounts has registered here and am requesting an indefinite block on the account. Thanks, Stepshep (talk) 00:45, 15 March 2009 (UTC)
 * Thanks - this has been handled. No socks locally, but it's the same account as enwiki. &mdash; Mike.lifeguard &#124; talk 06:07, 30 March 2009 (UTC)

"Good site, admin" bot
Of late there has been a spate of edits by anonymous ip's, wherein they replace an often substantial block of text with "Good site, admin". I have been reverting those edits and blocking these ips on sight without notice. I think leaving a note on the talk page is pretty much going to be useless, as I am convinced that these edits are being made by zombie machines. No one is going to read them.

I've been applying a 3 month block, but I wonder if that's long enough. If anyone else has any insight or recommendations on this, I'm all ears. --Jomegat (talk) 15:29, 29 March 2009 (UTC)


 * The bot operator probably has thousands of IPs available. And they probably change all the time. Blocking them all probably isn't an option (unless someone somehow taps directly into the source of IPs used by the program the bot is running from (the ips used by xRumer or whatever spamming program is being used).
 * Right now the bot seems to only be comming back to the same pages.
 * You could try blocking edits from IPs on the pages where you know the unwanted activity to be (I know of XQuery/Adder and XForms/Search Form) for a week or something.
 * From experience we know it will probably be back on other pages in some weeks, but it might not be on this wiki. --Jorunn (talk) 05:55, 30 March 2009 (UTC)


 * I've been working on these bots on a cross-wiki basis for some time & it is certainly true they have several thousand IPs at their disposal. I'm blocking them globally as needed - you can help me by adding IPs to m:User talk:Mike.lifeguard/malbots. Beyond that, they're open proxies, so you can give them a long block - I normally do 1 year AO/ACB. Protecting their targets may be useful, but Extension:AbuseFilter has been found very effective in stopping them. I think it'd be useful to think about adding that here. Both Meta and Commons have had good experiences & it can also help with other pattern vandals. &mdash; Mike.lifeguard &#124; talk 06:03, 30 March 2009 (UTC)


 * I've been applying a 1 year block plus a semi-protection of the target page. I only used 1 year because that seemed to be what Mike did! Unusual? Quite TalkQu 06:59, 30 March 2009 (UTC)


 * I went ahead and protected Adventist Youth Honors Answer Book/Arts and Crafts/Scrapbooking from anonymous edits, as that is a frequent target of this beasty. I'll also bump future blocks up to a year, and I left a list of ip's at Mike's malbot page on meta.  I'm thinking it might be useful to create a Template:malbot page to subst into a malbot's talk page.  That template could add the page to Category:Malbot, so maybe we find these a little easier.  And now I'm wondering if maybe we should leave the Scrapbooking page unprotected so we could use it as a honeypot?  The edits won't show for anon users since we have flagged revs, and I'm here several times per day anyhow.  But then again, with thousands of ip's, these efforts are like teardrops in the ocean.  --Jomegat (talk) 01:23, 31 March 2009 (UTC)
 * I wouldn't bother tagging the userpages. There's literally thousands of IPs & I've already got a good start on linking things together at Meta (which combines with our spam monitoring etc too). As for a honeypot, there are actually whole wikis for that ( for example) and there are >730 Wikimedia wikis being targeted. I don't think leaving one page unprotected is much of a honeypot. Keeping track of the IPs & blocking them is the best thing to do. BTW, I sorted the batch of IPs you left for me, Jim - thanks. &mdash; Mike.lifeguard &#124; talk 01:30, 31 March 2009 (UTC)
 * The thought behind Template:Malbot was that it would add the talk page to Category:Malbot making it easier to collect ip addresses as we come across them. If you don't think that's useful, then I will happily defer to your judgement.  You know a lot more about this than I do.  Also, I agree with your honeypot assessment! --Jomegat (talk) 01:40, 31 March 2009 (UTC)
 * The system I have on Meta uses hidden links to the IP talk pages to link everything together (ie using the pagelinks table of MediaWiki), which is more useful than a category. This lets us easily check if IPs have been the subject of discussion before, and if so we can also see exactly what page(s). This has proven useful in terms of spam monitoring, and seems to be working nicely for the malbots too. &mdash; Mike.lifeguard &#124; talk 01:43, 31 March 2009 (UTC)