Wikipedia:Edit filter/Requested/Archive 7

Add links
From Wikipedia, the free encyclopedia

Completed requests

Pages created by ContentTranslation with unnecessary syntax

Tag pages that were created by the ContentTranslation extension and have unnecessary HTML tags or attributes.

Initial conditions:

  • The page has the contenttranslation tag.
  • The page has any of the following strings:
    • cx-segment
    • cx-highlight
    • data-segmentid

Action: Add the tag "contenttranslation-needcheck".

Examples:

There may be more conditions in the future, but this is a start. --Amir E. Aharoni (talk) 07:00, 25 May 2016 (UTC)

 Done
OK, I managed to do it myself: Special:AbuseFilter/765.
No need to check for the tag for now—I'll add it later if needed.
But comments welcome :) --Amir E. Aharoni (talk) 12:46, 25 May 2016 (UTC)
A couple of comments:
The actual tag name is "contenttranslation-needcheck" to be similar to "visualeditor-needcheck".
I disabled it for now because of https://phabricator.wikimedia.org/T136540 , but will reenable when the issues are resolved. --Amir E. Aharoni (talk) 04:43, 31 May 2016 (UTC)

Triple parentheses

  • Task: Log vandalism of articles that add triple parentheses around names.
  • Reason: The Triple parentheses is a recent right-wing phomonenon used to single out the names of individuals with a Jewish background for anti-semetic harassment. The Anti-Defamation League considers this practice to be hate speech, and thus, its use on Wikipedia outside of the relevant article can be assumed to be vandalism, because there is no other legitimate use for encircling a name with three pairs of parentheses.

- ViperSnake151  Talk  17:18, 7 June 2016 (UTC)

The regex matching for that would be \(\(\(.+\)\)\) - so maybe:
!("autoconfirmed" in user_groups) & (  
   trip_par :="\(\(\(.+\)\)\)";
   added_lines irlike trip_par & (
     !(removed_lines irlike trip_par)
    )
  )
would work? -- samtar talk or stalk 11:28, 8 June 2016 (UTC)
Currently in testing — MusikAnimal talk 19:59, 8 June 2016 (UTC)
 Done at Special:AbuseFilter/766, though this might get merged into another filter at some point — MusikAnimal talk 14:53, 13 June 2016 (UTC)
@MusikAnimal: could this be defeated by the use of html entities? & #40; and & #41; - eg. (((test))) -- samtar talk or stalk 21:29, 19 June 2016 (UTC)
It could! Not sure if anyone has tried to cleverly get around the filter, but doesn't hurt to check for the entities as well. Thanks — MusikAnimal talk 23:35, 19 June 2016 (UTC)

Interwiki added

- Magioladitis (talk) 14:05, 22 June 2016 (UTC)

@Magioladitis: Just to clarify, this will need to match against any inclusion of inter- wiki/language wikilinks in article space? -- samtar talk or stalk 14:11, 22 June 2016 (UTC)
Samtar yes. Unless it is given with leading colon which is when it is given as a real link in the body text. -- Magioladitis (talk) 14:14, 22 June 2016 (UTC)
(edit conflict) I don't entirely see why an edit filter needs to be used here? A bot is doing the job of removing these links, and either way as these are good faith edits it's unlikely the filter would be set to anything other than "log the edit" in the abuse log. If anyone does go down this route I think \[\[(?!en)(\w{2}):\w+\]\] would capture this -- samtar talk or stalk 15:03, 22 June 2016 (UTC)
Adding Interwiki links is actually still a very convenient way to link other languages. The bots at Wikidata will pick up that the links have been added, and then they are removed by another bot. All the while no damage is done. There's no real need to send people to another site to do this. -- zzuuzz (talk) 14:18, 22 June 2016 (UTC)

zzuuzz no. it is not that convenient. This way results in many conflicting interwiki links. Right now we have tents o thousands conflicting interwikis. That's why I ask for a filter. We provide a very easy way via THIS very site by just clicking on the left column. -- Magioladitis (talk) 14:20, 22 June 2016 (UTC)

OK, well we'll probably disagree, but then you probably find wikidata easy to navigate. The way I see it if the bots can't figure it out, it might be a stretch for the humans. -- zzuuzz (talk) 14:45, 22 June 2016 (UTC)
zzuuzz Still, if we want to move them, we need to detect them. -- Magioladitis (talk) 07:45, 26 June 2016 (UTC)
I think this needs broader consensus. Perhaps open a thread at WP:VPP? — MusikAnimal talk 16:13, 27 June 2016 (UTC)
MusikAnimal what kind of consensus is needed? there is already a consensus that a bot remove interwikis and there is also consensus to store interwikis in Wikidata. So, I can't understand what is the issue here. -- Magioladitis (talk) 16:39, 27 June 2016 (UTC)
We've already seen opposition to the idea, so I thought getting a few more opinions in on it couldn't hurt. My main concern would be if the interlanguage link were accompanied by a large constructive change, I'd be hesitant to even issue a warning in the fear they might abort the edit altogether. I suspect most of the time these links are usually added by themselves, without other changes, and we should be able to target small changes like this with the filter. I'll create a test filter so we can better understand what we're dealing with — MusikAnimal talk 16:49, 27 June 2016 (UTC)
 Done Running at Special:AbuseFilter/1 (thanks to Samtar for the regex!) Once this is refined I'll move it to a dedicated filter and we'll go from there — MusikAnimal talk 21:20, 28 June 2016 (UTC)

Blanking TemplateData

  • Task: Tag all edits in the Template: namespace if <templatedata> is removed. The tag should say something like "blanking TemplateData".
  • Reason: Many editors don't know what WP:TemplateData is or why it is used, as it is fairly new. I saw one editor removing TemplateData from multiple templates today, with the explanation that it was an unnecessary copy of the human-readable documentation.
    The purpose of the tag is to (a) make it easier for users who are familiar with TemplateData to check the edits, and (b) provide an easy link to the documentation for editors who aren't familiar with TemplateData, to reduce the likelihood of this problem in the future.

- WhatamIdoing (talk) 19:14, 28 December 2015 (UTC)

@WhatamIdoing: Seems reasonable; could you provide some diffs of the recent edits? It will help with making sure the filter is doing the right thing. Thanks, Sam Walton (talk) 19:51, 28 December 2015 (UTC)
Here's one: [1] The TemplateData block is JSON and therefore very standardized. If both <templatedata>...</templatedata> tags are being removed, then the block is being removed. There may be good reasons to do this (it's empty, it's a duplicate, you're moving it to the /doc subpage...) but it should be sufficient to check for the removal of the opening and/or closing tag. WhatamIdoing (talk) 20:00, 28 December 2015 (UTC)
Hi Sam, is there anything I can do to help with this? Can you {{ping}} me whenever it's done? WhatamIdoing (talk) 17:16, 30 December 2015 (UTC)
@WhatamIdoing: Special:AbuseFilter/744 is currently monitoring this, though it could be implemented better; will see what edits it flags and improve as necessary. Sam Walton (talk) 18:18, 30 December 2015 (UTC)
Thanks! So far, it's caught one simple case of presumed vandalism and one person trying to write an article on a template's /doc page. I'll keep an eye on it. Can you add a visible tag in the edit summary? I want editors who look at their own contributions to be able to get more information about this. WhatamIdoing (talk) 17:47, 31 December 2015 (UTC)
@WhatamIdoing: I'll add tags once we've ascertained that the filter is logging the edits it should be :) Sam Walton (talk) 18:18, 31 December 2015 (UTC)
So far, so good. I'm checking daily and will let you know if I find it catching something that it shouldn't. Today's entry is someone adding TemplateData when he wanted a {{documentation}} page; he correctly self-reverted that and figured out how to do it. (Maybe we need a "Add a /doc page" link on templates, too.) WhatamIdoing (talk) 18:11, 1 January 2016 (UTC)
@WhatamIdoing: Thoughts? Sam Walton (talk) 09:57, 10 January 2016 (UTC)
So far, so good. Mostly, it looks like inexperienced editors adding blank or obviously wrong TemplateData, and then self-reverting. There have been no false positives. I'll keep tracking it, but I think it's probably safe for you to add a tag on the edits now. WhatamIdoing (talk) 20:56, 10 January 2016 (UTC)
@WhatamIdoing: I notice you removed TemplateData from a template; is moving it to a doc page something that's ok to do? If so there will be a number of false positives for this, unless you think we should just tag every removal for simplicity. Sam Walton (talk) 10:37, 16 March 2016 (UTC)
Yes, it's fine to put it on a /doc page. I'm willing to live with the false positives. We've actually been getting more from people adding and then self-reverting almost blank TemplateData. WhatamIdoing (talk) 23:35, 16 March 2016 (UTC)

@Samwalton9: Is there any chance you could make this only apply to non-confirmed users? Alternatively, if this bar is a little low, we could try something like users with < 100 edits. The filter is currently catching a lot of false positives (examples: [2][3]), and although that's not a disastrous thing, I think we could limit this filter in that way without losing too many problematic edits. Also pinging WhatamIdoing. Omni Flames (talk) 08:28, 28 June 2016 (UTC)

I've added a 100 edit limit :) Sam Walton (talk) 08:57, 28 June 2016 (UTC)
Thanks! That should help. Omni Flames (talk) 09:12, 28 June 2016 (UTC)

 Done Call it wearing in the hat, but I've gone and moved this to completed because a working filter is available, hope that is okay with yourself Samwalton9 :) -- samtar talk or stalk 19:30, 28 June 2016 (UTC)

I'm satisfied with whatever you all decide. However, I suspect that TemplateData still seems weird and strange even to people who have made 100+ edits, so it might be removed when it shouldn't be by people with much higher edit counts. The number of incidents is fairly low (about 15 per month before this change). So if checking the edit count has a performance cost, it might not be worth it. (Again, whatever you decide is okay with me.)
Also, there are other reasons to check some of these. For example, this edit was flagged, but what's interesting there isn't the removal of the TemplateData, which defined the |collapse=; what's interesting is the silent removal of the ability to collapse the template (at which point, the TemplateData became irrelevant). WhatamIdoing (talk) 07:05, 1 July 2016 (UTC)

Eolgi highway vandalism

  • Task: It would be great if we could create a filter to catch mentions of "eolgi". Such a filter would, ideally, be applied to all pages in the article namespace. Alternatively, it could only check edits to highway articles. Preferably this kind-of filter would be set to disallow, but we could use tag-only if necessary.
  • Reason: This filter is necessary in-order to counter persistent disruptive editing from this LTA. It would also be nice to stop edits which add something along the lines of "e o l g i", to stop edits such as [4]. Here are some other examples of this users vandalism: [5][6]. Omni Flames (talk) 08:25, 30 June 2016 (UTC)
In testing at 774 - @Omni Flames: currently in testing at private filter 774 -- samtar talk or stalk 10:25, 30 June 2016 (UTC)
Thanks Samtar! Could you let me know if it gets any hits? Omni Flames (talk) 10:29, 30 June 2016 (UTC)
@Omni Flames: of course :) -- samtar talk or stalk 10:32, 30 June 2016 (UTC)
I had a, since disabled, filter looking for this last year. I can't find it now though. Sam Walton (talk) 13:07, 30 June 2016 (UTC)
Ah. Special:AbuseFilter/676. Sam Walton (talk) 13:08, 30 June 2016 (UTC)
@Samwalton9: well that's miles better than the one I knocked up, I'll disable mine -- samtar talk or stalk 14:31, 30 June 2016 (UTC)

Ah, so there's already a filter for this? Is it still disabled, and if so, why? Omni Flames (talk) 22:16, 30 June 2016 (UTC)

 Done (sort of) This needs to be discussed in private, but basically we are aware of this ongoing disruption and are doing what we can to prevent it. No promises — MusikAnimal talk 15:24, 1 July 2016 (UTC)
See also Wikipedia:Edit_filter/Requested/Archive/7#Allow_Interstate_Highway_articles_to_have_separate_protection_levels — MusikAnimal talk 15:49, 1 July 2016 (UTC)

Aggressive IP hopper

  • Task: Provide me (or whomever) a notice when certain phrases preferred by an aggressive IP hopper are added to the article space.
  • Reason: Assist me (or whomever) in their timely removal.
  • See: AN/I report 1 • AN/I report 2 • my sandbox

Aggressive, repeated disruption that has led to several IP blocks, the effect of which is hindered by the fact that this editor can IP-hop at will. If possible, I would like to receive notifications when the following exact phrases are added to article space (another editor suggested Google Alerts; they don't work):

  • causing death
  • leading to death
  • complicatios from
  • she bore him
  • her expecting parents
  • resting_place=cremated

My thanks in advance, 🖖ATS / Talk 02:47, 26 June 2016 (UTC)

@ATS: Just a clarification - as for "provide ... a notice", would a tag suffice? -- samtar talk or stalk 14:10, 26 June 2016 (UTC)
Samtar, I'm utterly new to this aspect ... that seems to be what I'm looking for. Would you recommend I ask a current filter manager, or request the permission myself? 🖖ATS / Talk 20:30, 26 June 2016 (UTC)
@ATS: this would have to be actioned by a current manager if it's deemed suitable for a filter - personally, given that every single edit made is checked against the edit filters, I think a lot of false positives would end up getting tagged. I imagine there are a lot of good faith additions made daily which contain some of the above strings - would you be willing to check all of these? -- samtar talk or stalk 20:43, 26 June 2016 (UTC)
Yes, that would be the idea of a notification rather than, say, an automatic revert: so that I can check each such edit through its own (lack of) merit. So, Samtar, if you would be so kind, how properly do I do this? 🖖ATS / Talk 20:48, 26 June 2016 (UTC)
We could probably get this with a simple regex, something like ((causing|leading to) death|complicatios from|she bore him|her expecting parents|resting_place=cremated). However, to clarify, you will not receive a notification when such an edit is made. The only way you'll be able to find edits tagged by this filter via a filtered version of recent changes, so you'll have to be willing to check them manually. Additionally, I'm honestly not too sure if this filter would really be all that good an idea. Most of the edits it would catch would be false positives. In less this is a really massive and widespread problem, I'm not sure if this is necessary. Omni Flames (talk) 04:58, 28 June 2016 (UTC)
Okay, Omni Flames, thanks for the help. 🖖ATS / Talk 05:01, 28 June 2016 (UTC)

@Omni Flames and ATS: In testing at private filter 770 - I've set this private even though the regex (kindly provided by Omni!) is above due to the fact alterations may be made to make this harder to circumvent. Would have tested at filter 2 but it's currently in use, so we'll see how many hits this gets, which I imagine will be a few seeing as this hopper is still pretty active -- samtar talk or stalk 18:17, 28 June 2016 (UTC)

Thank you so much, Samtar. Fortunately this hopper is much less active than he has been, but that can always change. 🖖ATS / Talk 20:19, 28 June 2016 (UTC)

Butting in here, but my auto-proofreading alarm was set off by "complicatios from", which was repeated in Omni Flames's code. ATS, is this the exact phrase you want? — Gorthian (talk) 21:00, 28 June 2016 (UTC)

Good spot Gorthian, in the actual filter I must have had my own alarm go off and I "corrected" it - hopefully that's okay ATS! -- samtar talk or stalk 21:04, 28 June 2016 (UTC)
Yeah, Gorthian, it was supposed to be "complications from". My bad. 🖖ATS / Talk 21:11, 28 June 2016 (UTC)
In a former life, I worked for four years as a proofreader...and I've not been able to quit since. Sometimes it comes in handy. — Gorthian (talk) 21:46, 28 June 2016 (UTC)
Ah, good catch Gorthian! Hopefully this filter will get a few hits. Omni Flames (talk) 22:01, 28 June 2016 (UTC)
So did I, back when there was such a thing as a "typing service". Damn, that was forever ago ... 🖖ATS / Talk 23:52, 28 June 2016 (UTC)

@ATS: filter had a hit, could you confirm this is the vandal? -- samtar talk or stalk 06:14, 29 June 2016 (UTC)

Not the same editor, no, but none of those edits was sourced. Thanks. 🖖ATS / Talk 09:45, 29 June 2016 (UTC)
@ATS: Ah right, well you can check the log for any others? Still only testing, could probably do with a bit of tweaking -- samtar talk or stalk 09:48, 29 June 2016 (UTC)
@Samtar: Only EFMs can see private filter logs . Omni Flames (talk) 09:52, 29 June 2016 (UTC)
@Omni Flames: It's gone straight to my head! Drat, I'll keep an eye on them and ask if I'm unsure it's the same LTA -- samtar talk or stalk 10:04, 29 June 2016 (UTC)
@Omni Flames: would the community be comfortable with giving me EFM permission? I would monitor very little and write nothing I don't understand, so its use would be extremely limited. 🖖ATS / Talk 20:06, 29 June 2016 (UTC)
@ATS: I'm not the best person to ask about that . However, I do know that the community has granted the right for viewing purposes only before, usually temporarily. Omni Flames (talk) 21:56, 29 June 2016 (UTC)
Much obliged. I'm crafting an official request now. 🖖ATS / Talk 22:16, 29 June 2016 (UTC)

BTW, the filter worked. He was already spotted and reverted. 🖖ATS / Talk 23:16, 29 June 2016 (UTC)

 Done Looks like the filter is working as expected. Will leave it going for the time being. Could some kind editor pop this in the completed section as I'm editing by phone at the moment -- samtar talk or stalk 15:57, 1 July 2016 (UTC)

Plot summary copyvios

  • This could be narrowed down to large edit_deltas of non-autoconfirmed editors to plot/synopsis sections, and as such I can see some merit to the proposal. Sam Walton (talk) 15:21, 18 January 2015 (UTC)
  • @MER-C: Would you mind taking a look through the past few days of diffs to see if sufficient numbers are copyvios for this filter to be worth it? Sam Walton (talk) 17:22, 22 January 2015 (UTC)
  • I had a look and found nothing. However, you've set the size threshold too high -- my experience is that the copyvio plot summaries are usually only one paragraph (3-7 lines) long. I've changed it to 400 bytes. You are also missing the very important scenario when a plot section is added without there being an existing section and an edit summary -- you'll want to search for the addition of a level 2 header like [Pp]lot|[Ss]ynopsis as the trigger. MER-C 12:04, 23 January 2015 (UTC)
  • That's fair, and yes I hadn't thought of that, added a flag for that too. Sam Walton (talk) 20:03, 23 January 2015 (UTC)
  • Disabled for now because I've run out of ideas on how to narrow this. Plot/synopsis/summary is far too vague a search term to be useful. Sam Walton (talk) 19:54, 28 January 2015 (UTC)
MusikAnimal has improved the filter a bit so we'll see how it goes. Narrowed to adding a new section rather than checking for any largeish plot/summary edit to existing ones. Sam Walton (talk) 19:20, 7 April 2015 (UTC)
@MER-C and MusikAnimal: Could you check if the filter is worth continuing? Sam Walton (talk) 12:08, 25 May 2015 (UTC)
Seems to be worthwhile — MusikAnimal talk 16:59, 19 May 2016 (UTC)

Removing Template:Dead link

  • Task: Mark removal of {{dead link}}, as well as the removal of all templates that redirect to it. Just tag; don't warn or prevent the user from making the edit
  • Reason: See WP:AN#SEO spam attack. We've discovered people whose idea of spamming is to remove broken links and replace them with spam. There's no way to track when comparatively new accounts do this on the most random articles (e.g. Special:Contributions/Tomofm2 did this at Eyepiece, Excise tax in the United States, Camp Tarawa, and Kona Pacific Public Charter School, all with deceptive edit summaries), so it would be easiest if we could just look through a log of all actions in which dead links were removed. Of course, a lot of these URL replacements (most, perhaps?) will be valid; that's why we just need to tag them, so that a human can look through them. - Nyttend (talk) 20:53, 5 December 2014 (UTC) PS, are there any bots that remove these links? If so, the filter might be instructed to exclude edits by flagged bots, since they're not going to be spamming. Nyttend (talk) 21:50, 5 December 2014 (UTC)
An additional flag might be the inclusion of 'dead link' in the edit summary. User Tomofm2 wrote it in one and the newly noticed user Divine4778 also wrote it in some of their edit summaries. Sam Walton (talk) 17:58, 9 December 2014 (UTC)
Would it also be possible to track changes to the url that precedes a {{dead link}} template? If we start monitoring the use of this template the SEO people might just leave it in the articles and replace the broken links anyway. So a possible marker should also detect changes to links that have been flagged with [dead link]. De728631 (talk) 01:00, 10 December 2014 (UTC)
If we detect "dead link" in removed_lines and completely ignore whether it occurs in added_lines, it will accomplish that. Jackmcbarn (talk) 05:45, 28 December 2014 (UTC)
See the recently created WP:DEADLINKSPAM for an overview. Sam Walton (talk) 16:52, 24 December 2014 (UTC)
I've created a filter at Special:AbuseFilter/711, log only for now. Presently it requires no tag to be present in added_lines to avoid false positives from users removing a dead-linked sentence altogether. It will probably be worth investigating whether this is actually a common occurrence at some point. Sam Walton (talk) 16:50, 21 July 2015 (UTC)

Persistant spam

  • Task: put under observation and/or disallow words "Javad_Ramezani" by not autoconfirmed users with a timestamp atleast one year.
Very smart longeterm interwiki spamster, Copies some lines from some other article adds words Javad_Ramezani for self promotion, and creates new articles with new article names from new ips or new user names.


  • Please refer
this google search on en wikipedia
this google search on wikipedia.org to include all possible wikis
Wikipedia:Articles for deletion/Iran man Besides also refer User:Iran man.
Woman (song javad) as of now still not gone for deletion request.
Insertion seems to haves been made also at article List of Iranian musicians

I suppose experinced spam fighters need to look into the issue.

- Mahitgar (talk) 05:10, 27 May 2015 (UTC)

While this request is pending, still the same spam seems to continue. From google search I came across Aman az Eshgh (album) this page, where in there seems to be three attempt of recreation and admins deleting the same 31st may, 4rth June, 6th June. and also I came across a latest one dated 8th JuneHero (Javad song) which is still to get nominated for deletion process.
Mahitgar (talk) 17:26, 8 June 2015 (UTC)
Mahitgar (talk) 06:11, 24 June 2015 (UTC)

Fixed position vandalism, again

Could a filter have prevented Special:Diff/669919700? -- John of Reading (talk) 15:27, 4 July 2015 (UTC)

Probably. Any setting of the z-index: property should at least prompt the question "why"? If it's a very high value, it's almost certain to be malicious. For comparison, the puzzleball, search box and "languages" list all have a z-index of 3, and there's not much in Wikipedia that needs a higher value. --Redrose64 (talk) 18:08, 4 July 2015 (UTC)
Jackmcbarn set up a filter at Special:AbuseFilter/705. Sam Walton (talk) 18:56, 4 July 2015 (UTC)
And disabled, seems like this was short term vandalism. Sam Walton (talk) 19:29, 26 July 2015 (UTC)

Warn against clipboard hijacking

  • Task: Recognize the addition of strings similar to what I removed in this edit, which are caused by clipboard-hijacking scripts on the source sites, and warn users before the edit is saved.
  • Reason: Some websites use clipboard hijacking techniques that add text if someone copies and pastes something, usually the article title in our case. Not only is the text almost always inanely promotional, it frequently breaks citations. It seems like the added text is formulaic enough that it might be targetable by a filter.

- {{Nihiltres|talk|edits}} 21:02, 4 June 2015 (UTC)

@Nihiltres: Can you give more examples to show what text is added by other sites? Targeting a single site should be easy, and with more examples I assume targeting a bunch wouldn't be too much harder. PHANTOMTECH (talk) 21:57, 4 June 2015 (UTC)
@PhantomTech: Here and here are some more; there are probably others in my contributions but I'd have to sift through more thoroughly. {{Nihiltres|talk|edits}} 22:15, 4 June 2015 (UTC)
@Nihiltres: Thanks, here are some regexes for anyone that wants to try out a filter.
  • read more( at|(?!\.|,|\s)\W)
  • title ?= ?[^\|\}]*?read more
  • title ?= ?[^\|\}]*?read more( at|(?!\.|,|\s)\W)
Any of those will catch all the examples given. The first one is the broadest, second refines to reference titles only (as opposed to anywhere in the article) and the third tries to remove any false positives from the second. I'm not sure which will work best, it all depends on the false positives that come up, it should be checked with a added_lines irlike and !removed_lines irlike to avoid bugging people who haven't added the reference themselves. PHANTOMTECH (talk) 22:44, 4 June 2015 (UTC)
 Done This has been created by Nihiltres at Special:AbuseFilter/702. Sam Walton (talk) 22:08, 3 July 2015 (UTC)

Persistent sockpuppetry involving a name

  • Task: Disallow the creation of usernames involving variations of the words "smooth" and "aashu". If that is not possible for technical reasons, prevent IPs and new accounts from adding content involving such words.
  • Reason: Please see this SPI for reference. This indeffed user keeps recreating similar promotional accounts involving his stage name Smoothest Aashu.

- De728631 (talk) 18:41, 15 May 2015 (UTC)

@De728631: Created, log only for now at Special:AbuseFilter/690. Sam Walton (talk) 11:19, 25 May 2015 (UTC)
Awesome, thank you, Sam. And it's working, too. See Wikipedia:Sockpuppet investigations/Smoothestaashu007. De728631 (talk) 16:35, 31 May 2015 (UTC)
@De728631: Excellent. I may set the filter to disallow the edits (they'll still show up in the log for further investigation) as a deterrent. Thoughts? Sam Walton (talk) 16:48, 31 May 2015 (UTC)
@Samwalton9: Personally I think blocking should be avoided, as it will probably just make the user switch to a different name and become harder to catch. (talk to) TheOtherGaelan('s contributions) 19:49, 19 June 2015 (UTC)
Alrighty,  Done in that case, filter is working. Sam Walton (talk) 09:24, 23 June 2015 (UTC)

Emoji

  • Task: Filter should detect anonymous edits which add emoji and prevent the edits. Filter should add a tag and/or warn for similar edits from logged in users. (They could be legitimately used on talk pages.)
  • Reason: Anonymous editing on mobile devices has been turned on,[9] and we are now seeing vandalism that uses emoji.[10]

- Kaldari (talk) 00:01, 8 April 2015 (UTC)

Emoji has long lists of unicode blocks. Should all of those be checked or only some of them? (A specific list of code ranges would be useful here.) Do any of these have legitimate uses? For my part, my browser fails to render most of those symbols. Dragons flight (talk) 00:55, 8 April 2015 (UTC)
Five main ranges from emoji: U+1F300..U+1F5FF, U+1F600..U+1F64F, U+1F680..U+1F6FF, U+2600..U+26FF, U+2700..U+27BF Dragons flight (talk) 17:02, 8 April 2015 (UTC)
Testing as Special:AbuseFilter/680. Dragons flight (talk) 17:48, 8 April 2015 (UTC)
What a cute regex: [🌀-🙏🚀-🛳☀-➿] :) Kaldari (talk) 17:53, 8 April 2015 (UTC)
For me that displays as "unprintable square"-"unprintable square", "unprintable square"-"unprintable square", "sun icon"-"unprintable square". You don't happen to know what fonts actually include these things? I'm a little impressed to see 50 hits in the log during only the first 8 hours. Dragons flight (talk) 02:42, 9 April 2015 (UTC)
I've added a warning now. So far, the only edit I've noticed that might be considered legitimate was [11] where ★ was used in an album name. Dragons flight (talk) 18:55, 9 April 2015 (UTC)
I've removed ★ and ☆ which seems to be getting a number of false positives, mostly from stylized music titles in Asian languages (e.g. Japanese), but don't seem to be used for vandalism in the current sample set. Dragons flight (talk) 18:00, 13 April 2015 (UTC)
 Done Seems to be working well. Sam Walton (talk) 11:57, 25 May 2015 (UTC)

Ankur Mazumder filters

  • Task: This filter should be able to catch the prolific sockpuppeteer Ankur Mazumder (talk · contribs) who persistently creates autobiographies about himself (example of such a page) in both userpages of his socks (usually) and in the article space (not as often; deleted examples Ankur Mazumder, Www.Ankurmazumder.com, and Computer Field Of Ankur). In addition, another filter should be added to detect additions of his mention into articles like Hooghly Collegiate School by IP socks of this sockmaster.
  • Reason: Adding these filters and setting them up to just log such actions would greatly assist us in finding and blocking socks of this user. Currently, one needs to do a lot of searching to come across socks, and in some cases it may take long before the sock is discovered.

- Gparyani (talk) 05:07, 18 March 2015 (UTC)

@Gparyani: Are all pages exactly the same? If not could you provide a few more samples so I can find similarities, I'm not an admin so I can't see the deleted pages. PhantomTech (talk) 22:49, 20 March 2015 (UTC)
@PhantomTech: Unfortunately, most of the pages he's created have been deleted. However, there may be another one laying around in old revisions of the userpages of the sockpuppets. It would be great if an admin could see this request. Gparyani (talk) 23:17, 20 March 2015 (UTC)
I've pasted some deleted userpages here: User:Anna Frodesiak/Blue sandbox. They are the last few socks and the original master userpage. Anna Frodesiak (talk) 23:33, 20 March 2015 (UTC)
Thanks, ThePhantomBot is being setup to detect the page creations and will begin logging them in the next few days, whenever it is running. PhantomTech (talk) 00:07, 21 March 2015 (UTC)
What about the other part? Did you read my last sentence in the task section? Gparyani (talk) 00:13, 21 March 2015 (UTC)
I missed the last part but I'll add that too. PhantomTech (talk) 00:40, 21 March 2015 (UTC)
@PhantomTech: As an edit filter, or to your bot? Gparyani (talk) 00:46, 21 March 2015 (UTC)
@Gparyani: To the bot, I don't have the permission for edit filters and I'm not sure that this is frequent enough to have an edit filter made. PhantomTech (talk) 00:58, 21 March 2015 (UTC)
Created at Special:AbuseFilter/673 as log only for now. Sam Walton (talk) 21:46, 29 March 2015 (UTC)
@Samwalton9: You may also want it to check for userpage creations, which is more important. Gparyani (talk) 02:50, 3 April 2015 (UTC)
Wasn't aware, thanks, now checking user space too. Sam Walton (talk) 09:06, 4 April 2015 (UTC)
 Done Seems to be working fine so I've switched it to disallow the edits. Editors who attempt to make the edits should still be double checked. Sam Walton (talk) 22:20, 18 May 2015 (UTC)

"<User X> IS A PROSTITUTE" sockpuppets

- TL22 (talk) 18:31, 17 May 2015 (UTC)

Make that 9, 6 pointed at me, 1 at User:Geraldo Perez, another one at User:EvergreenFir and another one at User:Joseph2302. --TL22 (talk) 22:54, 17 May 2015 (UTC)
 Already done by Callanecc. See the SPI I linked above. Self-closing request. --TL22 (talk) 10:41, 18 May 2015 (UTC)

Fixed typo

  • Task: Pick up anonymous edits that have inaccurate formulaic edit summaries like "Fixed typo", "Fixed grammar" or "Added links", often in combination.
  • Reason: We are getting one heckuva lot of them these days, often concealing petty vandalism that ClueBot NG is simply not picking up. Examples: [12] [13]

- Redrose64 (talk) 19:31, 8 May 2015 (UTC)

We already have the "canned edit summary" thing for that. --TL22 (talk) 01:01, 9 May 2015 (UTC)
I've seen that tag elsewhere, but it's not on these examples. --Redrose64 (talk) 07:44, 9 May 2015 (UTC)
Special:AbuseFilter/633 doesn't pick up combinations of canned edit summaries. The regex could be changed to ^(?:\/\* .* \*\/ )?(Fixed typo|Fixed grammar|Added links|Added content)(?:, \g<1>)*$ to detect them as long as recursive subpattern matches are possible, if not then it isn't too hard to change it to still work. PHANTOMTECH (talk) 05:27, 27 May 2015 (UTC)
This one wasn't a combination of canned edit summaries, but didn't trigger the tag. --Redrose64 (talk) 12:01, 27 May 2015 (UTC)
The edit summary in that one doesn't have the default space after the section name, ^(?:\/\* .* \*\/ ?)?(Fixed typo|Fixed grammar|Added links|Added content)(?:,? \g<1>)*$ is the modified version (of my already modified version above) that will detect both that and the combinations. Might not be a bad idea to modify the filter to ignore case also. PHANTOMTECH (talk) 05:59, 28 May 2015 (UTC)
I presume these canned summaries are from the mobile app? If so they shouldn't change much. All the best: Rich Farmbrough, 02:13, 3 July 2015 (UTC).
Examples: this user's first four edits. --Redrose64 (talk) 19:10, 3 July 2015 (UTC)
The canned edit summaries are from the mobile app or mobile web interface. I will update the filter to handle combinations of the canned edit summaries. Going to go ahead and archive this now as the discussion is many moons old. Thanks — MusikAnimal talk 02:04, 19 September 2015 (UTC)

Pimmara Charoenpukdi

- Rebecca1990 (talk) 05:03, 9 March 2016 (UTC)

Jwala Sharma filter

  • Task: Prevent IP editors from having the ability to save edits containing the phrase "jwala sharma"
  • Reason: A large number of IPs have been editing articles relating to safety to insert sentences starting with "As per Mr. jwala Sharma (Asian society of Safety Engineers)", and then including a quote that either restates material already in the article and/or is a copyvio. This appears to be a concerted effort to promote Mr. Sharma and the ASSE. I have found almost 200 such edits from the following IPs:
Extended content

See WP:ANI#Numerous edits promoting Mr. Jwala Sharma and the Asian society of Safety Engineers. - Ahecht (TALK
PAGE) 19:11, 23 March 2016 (UTC)

Added to filter 58. Jackmcbarn (talk) 20:39, 26 March 2016 (UTC)

Caidin Detection

  • Task:
What is the filter supposed to do?
Detect use of any of the following terms (case insensitive):
  1. "BreakABall"
  2. "Break-a-Ball"
  3. "showbox film error"
When detected, the filter would take appropriate actions. I am not sure of the limits of its ability are or what is considered appropriate but maybe something along these lines:
  • Automatically revert all the user or IP's article space edits in the last 24 hours.
  • Automatically block the user or IP for 48 hours.
  • Automatically report the user or IP through an appropriate channel (either SPI or something else) so that an administrator can confirm that it really is Caidin and extend the block to indefinite if they think it necessary or release the block early if it is a false positive.
To what pages and editors does it apply?
  • To all articles (except Showbox, if possible, as there would be a very small risk of a false positive there) but not to talk pages or other pages where we may need to use these phrases to discuss these issues. If Showbox can not be excluded then that is unlikely to cause any problems.
  • To all unregistered/IP editors and to all non-autoconfirmed editors. It seems unlikely that he will go to the trouble of getting his socks autoconfirmed so this reduces the risk of false positives.
  • Reason: Caidin is a long term vandal who keeps coming back on new IPs and registering new accounts. His edits are quite predictable. See Wikipedia:Sockpuppet investigations/Caidin-Johnson and its archive for the sordid history. He has a number of things that he likes to write about that only exist in his own imagination. If we can catch his regular key phrases automatically it will save the trouble dealing with him manually. Being reverted and blocked instantly may even persuade him that it is not worth continuing to try to get his nonsense into Wikipedia. The risk of it affecting anybody else is very small as none of his stuff exists in the real world and his key phrases are incredibly unlikely to be used by anybody else except when discussing his behaviour. I have checked and it seems that none of them are used in the article space at the moment.

- DanielRigal (talk) 00:07, 30 December 2015 (UTC)

@DanielRigal: Log only for now at Special:AbuseFilter/750. Sam Walton (talk) 10:07, 10 January 2016 (UTC)
 Done Working fine, set to disallow. Sam Walton (talk) 10:31, 16 March 2016 (UTC)

Starship9000

  • Task: To detect if Starship9000 is editing and log and/or disallow edits
  • Reason: See Wikipedia:Sockpuppet investigations/Starship9000. I have been dealing with this user over at Commons and he is continuing here. I have created an Abuse Filter that will detect if he starts editing again. I will email the mailing list with the specific filter as it is set to private.

- Techman224Talk 04:17, 1 January 2016 (UTC)

Changing owner field in infoboxes

  • Task: Disallow non-autoconfirmed editors from changing the |owner= field in certain infoboxes, such as {{Infobox NHL team}} (but likely useful to apply to most sports infoboxes)
  • Reason: Periodic vandalism of articles like this, this and this has been going on for years, but seems to be increasing in frequency lately, perhaps in part because media has taken to writing lazy "someone vandalized Wikipedia hyuk hyuk" articles as of late (e.g.: CSN Chicago). I have no recent examples since I don't follow many articles for other sports teams, but I have seen these types of vandal edits on baseball, basketball and football team pages in the past. I could put together a list of templates if this is doable and desirable.

- Resolute 00:08, 15 May 2015 (UTC)

Sigh... Again and again. Resolute 16:58, 15 May 2015 (UTC)
@Resolute: A list of templates to monitor would be useful. Tracking all |owner= changes will be too broad I think. Sam Walton (talk) 11:22, 25 May 2015 (UTC)
@Samwalton9: - Sure. The NHL infobox listed above (and which would allow me to lift protection on three articles), {{Infobox MLB}}, {{Infobox basketball club}}, {{Infobox NFL team}} and {{Infobox football club}} would be a good start. All five use the same owner= parameter. Resolute 14:00, 25 May 2015 (UTC)
@Samwalton9: It keeps happening. Fortunately, the NHL playoffs will end soon, but I think we've had to protect at least seven team articles during the post-season for this exact reason. I'm seeing it in the odd NBA article as well. Thanks! Resolute 14:16, 3 June 2015 (UTC)
Another example, this time from MLB. Resolute 16:14, 30 June 2015 (UTC)
Last fresh example I'll add, as there is no further need to demonstrate that this is ongoing, imo; [28]. Thanks, Resolute 15:32, 2 July 2015 (UTC)
Okay, one more. So add {{Infobox American football team}} to the list. Resolute 01:20, 24 July 2015 (UTC)
  • @Samwalton9: - Any further thoughts on this? It's still happening. Thanks! Resolute 00:01, 24 November 2015 (UTC)
    • @Resolute: Sorry. I've been meaning to get back to a few of these edit filter requests. Log only at Special:AbuseFilter/735. Sam Walton (talk) 00:16, 24 November 2015 (UTC)
      • Awesome, thanks! Is there anything you want/need me to do while this filter is in logging mode only? Resolute 00:38, 24 November 2015 (UTC)
        • @Resolute: If you're familiar with this kind of vandalism then just keeping an eye on the log would be useful. I know next to nothing about sports teams so it might take me more time to spot vandalism from constructive edits. You can note any false positives here. Also let me know if you see vandalism that isn't caught by the filter which should be. Sam Walton (talk) 00:40, 24 November 2015 (UTC)
          • Will do, thanks. Ownership changes in sports are quite rare, so almost no legitimate changes occur - I think it's been two years for the NHL. The easy way to tell though is if you see a logged entry where the change is to a currently active player. That is pretty much what every example I have posted above is. Resolute 00:47, 24 November 2015 (UTC)
  • @Samwalton9: - I knew this was a problem overall, but 23 hits in a day and a half? Oy. Looking through the log, I see only two edits that aren't obvious vandalism. This one was just changing spacing (needless, but also harmless), but is something I have seen done in the past. Could the filter be modified to ignore edits like those? The second is this, which I think might be vandalism since I can't find any evidence of a person by that name joining ownership, but is ambiguous enough that I can't 100% say it is so. The other 21 hits are all pure vandalism (or a self-revert of vandalism). Resolute 21:41, 25 November 2015 (UTC)
    • @Resolute: Not sure we can do anything about the first edit; unless there's a variable in the filter I'm not aware of (specifically, one which could check the number of lines edited would be useful). We could look for small edit diffs, which would remove edits which also add/remove content to the article and happen to edit the owner field as a result, but I'd like to see if that would be apply to more edits. Will keep watching :) Sam Walton (talk) 21:56, 25 November 2015 (UTC)
      • I'm still watching this. The edits are about 95% vandalism or vandalism clean-up. I saw one where the anon clearly acted in good faith (but got it wrong anyway) and only a handful that seemed plausible or proper - mostly southeast Asian soccer teams. Resolute 17:13, 9 December 2015 (UTC)
@Samwalton9: It looks like about 97% of these edits are vandalism. I have personally seen this happen a lot and often it is vandalism. Is there any when the filter is set to dissalow that the message displayed could be changed so as not to scare off good faith editors? Eteethan(talk)🎄 01:41, 19 December 2015 (UTC)
@Resolute: I'd be hesitant to switch this filter to disallow given the 3% false positive rate and the potential for further potential false positives when owners do actually change or a small edit is made to the owner field. I think there might be potential for tagging with "Potential vandalism" though. Thoughts? Sam Walton (talk) 21:58, 19 December 2015 (UTC)

@Samwalton9: I think that at this point tagging would be fine. Eteethan(talk)🎄 02:55, 20 December 2015 (UTC)

Aargh! Look at this! I had to revert this myself while looking through the log. Please begin tagging now. Eteethan(talk)🎄 03:01, 20 December 2015 (UTC)
Virtually every good faith edit I have seen has involved soccer's infobox. If we limited to the big four North American sports, we could probably disallow. But as is, tagging seems to be a good next step. Resolute 17:32, 20 December 2015 (UTC)
@Eteethan and Resolute:  Done! Now tagging as "possible vandalism". Sam Walton (talk) 17:46, 20 December 2015 (UTC)

WPCleaner

  • Task: Tag edits made with WPCleaner. It's not actually an edit filter request, just a request for the creation of the tag, as it is possible now to create tags than can afterwards be applied to edits through the API. It has been done on frwiki, where there's now a dedicated tag for WPCleaner as there are also other dedicated tags for other tools. As I don't have access to administrator tools, I don't know how to create such tags that are different from edit filters: on frwiki, they appear in Special:Tags with a special source, "Appliquée manuellement par les utilisateurs et les bots" which translates to "Applied manually by users and bots".
  • Reason: It's easier to track what each tool is used for if there's a dedicated tag, instead of having to look at the edit comment to see.

- NicoV (Talk on frwiki) 21:44, 9 August 2015 (UTC)

I'm not actually familiar with how creating/editing tags is supposed to work now that we can change them, as far as I'm aware the discussion to enable editing or removing tags closed with the consensus that who could edit them could be decided later on, when a custom tag had actually been made. I'll look into this. Sam Walton (talk) 12:24, 17 August 2015 (UTC)
@NicoV: Ok, after much reading I've found that we're waiting on this change. Once the tag editing UI has been restricted I'll be happy to create the tag. Sam Walton (talk) 13:21, 17 August 2015 (UTC)
@Samwalton9: Thank for the answer ! I hope that it means that any registered user could still apply a tag when making an edit (which will be needed for WPCleaner as anyone can use the tool), only preventing users to change tags of an existing edit. --NicoV (Talk on frwiki) 04:59, 24 August 2015 (UTC)
@NicoV: I believe that's the case, yes. There are two tag userrights as far as I understand, one allows a user to place a tag when making an edit, and the other allows them to edit and delete placed tags. I think the former is in some way enabled for all users. I've left Cenarium a message asking when we can expect the change to go through but I haven't had a response yet. Sam Walton (talk) 15:39, 1 September 2015 (UTC)
@NicoV: Cenarium has made the tag, I'm not sure how it's supposed to be integrated with WPCleaner now, but it's in Special:Tags and at MediaWiki:Tag-WPCleaner. Sam Walton (talk) 13:09, 4 September 2015 (UTC)
Thanks a lot, I changed WPCleaner configuration, and it works. --NicoV (Talk on frwiki) 20:25, 6 September 2015 (UTC)
@NicoV: Excellent. Any idea why there are two account creations tagged with it? Sam Walton (talk) 20:49, 6 September 2015 (UTC)
Not at all, it's not possible to create accounts with WPCleaner, so it's been done by some other mean. Strange also, is that they were created at the same time. --NicoV (Talk on frwiki) 21:21, 6 September 2015 (UTC)
@NicoV and Samwalton9: The tags were added after the fact by a probable vandalism account, Zoraistanism (talk · contribs), see Special:Log/tag, I've removed them. The tag editing UI is hidden in histories and logs with css but users can still directly access the special page to edit tags (Special:EditTags), or they may have a weird setup where the css hack doesn't work. That's one of the reasons for restricting the userright to update tags (this commit). We just need to watch the tag log from time to time to see it if happens again. Cenarium (talk) 22:27, 6 September 2015 (UTC)

Selami Mustafa

- Yunshui 雲水 08:47, 3 September 2015 (UTC)

And 178.220.93.253, 178.220.93.173, 178.220.93.140. Sometimes it's just the string "Selami Mustafa". - DVdm (talk) 09:38, 3 September 2015 (UTC)
And Selamim (talk · contribs · deleted contribs · logs · filter log · block user · block log). Burninthruthesky (talk) 09:29, 4 September 2015 (UTC)
@Yunshui: Right. Back it: 178.220.242.165 (talk+ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser (log)). Please put a simple end to this. - DVdm (talk) 09:48, 5 September 2015 (UTC)
Log only for now at 725. Sam Walton (talk) 10:00, 5 September 2015 (UTC)
 Done Set to disallow, seems to be working fine. Sam Walton (talk) 12:26, 6 September 2015 (UTC)

@Samwalton9:. Continues now as 178.220.104.153 (talk+ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · block log · cross-wiki contribs · CheckUser (log)) — see edit [29], section header "Selami :04/01/1991". Edit filter should probably be narrowed to anything containing "Selami" - DVdm (talk) 13:03, 8 September 2015 (UTC)

@DVdm: It's been through a few iterations, I'm mostly playing catch-up with the changing patterns, but I'm keeping an eye on it and can hopefully stay on top of it. Sam Walton (talk) 18:27, 13 September 2015 (UTC)

Denied requests

Inexperienced users removing amboxes

Sometimes, inexperienced users try to remove article maintenance tags (amboxes) from articles.

  • Task: Every time an IP or unconfirmed user removes a {{notability}}, {{news release}}, or {{COI}} ambox from any article, please tag the edit.
  • Reason: This filter will help us to notice edits such as these.[30][31][32][33][34][35][36][37][38][39][40][41][42][43][44][45] It's happened many times on Wikipedia that COI users have wrongly removed such amboxes. Often, they use a blank edit summary, making the damage hard to catch. Tagging the edits will make it easier for us to notice and undo the damage.
(Dear Wikipedians: Please freely edit and improve this filter request.)

Thank you. —Unforgettableid (talk) 00:43, 18 September 2013 (UTC)

Not done. Detecting each and every tag that gets removed would put a severe strain on the server resources. Reaper Eternal (talk) 13:13, 16 November 2013 (UTC)
I thank you for your reply.
  1. OK, we could watch only for the removal of {{notability}} (perhaps the most important ambox) and ignore all other ambox removals.
  2. Let me suggest some non-obvious optimizations (besides the obvious "look at user groups first"). For one thing, we could only look at edits where edit_delta is between -10 and -100. This is an imperfect heuristic, but would save time. Next, we could look only at edits where the edit summary is blank: if there's an edit summary, then this is probably either a section edit or some other non-tag-removal edit. Okay; by now we've already eliminated a huge proportion of edits. Next, we could look at the first byte of either old_wikitext or removed_lines: if it's not '{', we can stop now. Finally, we could search through the contents of removed_lines. We could use contains "otability": a literal search is probably faster than a glob or regexp search.  Question: Would such a filter still be too CPU-intensive? And if so: which condition would be the biggest problem?
  3. This filter is non-crucial and non-private. If the client has JavaScript on, we could theoretically design the infrastructure to offload all non-crucial, non-private filtering work to the client; if the client has JavaScript off, we could just skip those filters.
—Unforgettableid (talk) 07:53, 27 November 2013 (UTC)
 Denied, closing as stale -- samtar talk or stalk 09:58, 3 July 2016 (UTC)

Replacing text with repeating characters vandalism

  • Task: To disallow editors that not only add repeating characters to an article but also remove content.
  • Reason: I did a check on the recent changes page that all of the most recent edits that remove content under the "repeating characters" tag filter are vandalism.

- Minima© (talk) 22:06, 17 February 2014 (UTC)

 Denied, closing as stale request, where a filter already exists -- samtar talk or stalk 09:58, 3 July 2016 (UTC)

G-Zay

@Sjones23: I imagine the reason for this filter having not been made yet is the lack of anything obvious to search for. Can you suggest anything we could search for in edits that would pinpoint this user? Perhaps something relatively unique they tend to write in edit summaries or edits. Sam Walton (talk) 20:36, 8 April 2015 (UTC)
Well, I'll see what can be done about it. Lord Sjones23 (talk - contributions) 20:53, 8 April 2015 (UTC)
 Denied, as stale -- samtar talk or stalk 10:00, 3 July 2016 (UTC)

Joshua Hawkins fakearticling

  • Task: Block edits from adding "Joshua Hawkins"/"Josh Hawkins"+"Motorsports" or "Joshua Hawkins"/"Josh Hawkins"+"MedIevil"/"Medievil" or "Joshua Hawkins"/"Josh Hawkins"+"IndyCar"
  • Reason: This is a serial sockmaster; see Category:Wikipedia sockpuppets of MrJoshThehawk. All of these accounts are "throwaways" that appear, create a user talk page with a WP:HOAX/WP:FAKEARTICLE team chart for NASCAR or, in one case, IndyCar that has "Joshua Hawkins Motorsports" with "Josh Hawkins" as a star driver (and before it was salted creating a hoax bio at Joshua Hawkins with articlespace links to same), and then vanish before, a month or two later, popping up under a new account to do the exact same thing. Given the serial nature here blocks are useless; therefore I believe an edit filter is appropriate for putting a stop to this the next time they try. - The Bushranger One ping only 11:35, 1 October 2013 (UTC)
@The Bushranger: If this is still happening, remove the stale tag. PhantomTech (talk) 06:06, 20 March 2015 (UTC)
@The Bushranger: Do you know if this is still a problem, 3 years on? Omni Flames (talk) 22:30, 27 June 2016 (UTC)

 Denied No response, assuming stale -- samtar talk or stalk 10:02, 3 July 2016 (UTC)

XSS Filter detect

  • Task: Block Internet Explorer 8+ users from saving edits that triggered the XSS Filter (Bug 32013). The XSS Filter transforms periods, bracket, and parentheses to the Number sign. One simple implementation might be ##[^{|}<\n>[\];:*]{5,255}?##
  • Reason: Because IE is extremely sneaky doing this after show change displays everything correctly and devs refuse to send the header to stop the filter. We've had many complaints about this.

— Dispenser 06:11, 27 August 2012 (UTC)

Dispenser, do you know if this is still an issue? Sam Walton (talk) 09:07, 19 January 2015 (UTC)
Yes, its still an issue 29 months later. This will continue as computers running Internet Explorer 7/8 (End of Life 12 Jan 2016) and have commendable market share. Windows XP has an 18% market share or 1 out of every 6 computers and the highest version of Internet Explorer is 8. Of course WMF could increase interoperability, but they're too distracted by the Web Design Hipsters. — Dispenser 19:52, 19 January 2015 (UTC)
You could match lines removed with \[\[([a-z ]{1,50}\|)?[a-z ]{1,25}]] and lines added with ##([a-z ]{1,50}\|)?[a-z ]{1,25}## to identify the changing links. PhantomTech (talk) 07:33, 21 March 2015 (UTC)
@Samwalton9: It also occurs with IE9-11, in addition to IE8. Consequently, it should be implemented. See WP:VPT#Characters replaced with #. Gparyani (talk) 00:44, 29 October 2015 (UTC)
@Dispenser and Gparyani: Log only at Special:AbuseFilter/736. I'm not particularly confident in this filter, I think it should probably check removed_lines and use some better regex, but this might be sufficient. Apologies for the delay. Sam Walton (talk) 00:39, 24 November 2015 (UTC)
Definitely needs better regex than I'm able to understand, disabled for now. Sam Walton (talk) 09:29, 3 December 2015 (UTC)

@Dispenser and Samwalton9: do we know if this is still an issue? If not, can that filter be marked for deletion? -- samtar talk or stalk 19:11, 28 June 2016 (UTC)

 Denied No response, assuming stale -- samtar talk or stalk 10:05, 3 July 2016 (UTC)

Returning IP troll

  • Task: Stop IP's starting with "86." using "rv v" from reverting my latest edits
  • Reason: A user is obsessed with reverting all my changes, constantly coming back under new "86.XXX.XXX.XX" to revert my changes, and anyone who reverts said reverts until said IP is banned and they come back under a new one a few days or so later. The user reverts my latest four edits and then reappears under a new, similar IP also starting with "86." I and many others have battled with this vandal/stalker, but they seem to have a personal vendetta against me. The user does not communicate beyond using "rv v" in the edit summary. Much more detail in my latest WP:AN report which in turn links to my latest WP:ANI report on the user. There's another report that I made on AN/I way, way back, but finding that one is beyond me since it's over six years old now. I'm hoping that this combined with me having reported the user to their ISP will deal with this. Eik Corell (talk) 16:53, 1 February 2016 (UTC)
@Eik Corell: Not sure if an edit filter would be the best option here, but it could work with something like this.
!("user" in user_groups) & (
  "86\." in user_name & (
    "rv v" in summary
  )
)
Omni Flames (talk) 09:46, 27 June 2016 (UTC)
 Denied not a good use for an edit filter - edit filters check against every edit made (in one way or another), and should only be used in certain instances -- samtar talk or stalk 10:09, 3 July 2016 (UTC)

Migosyrn

  • Task: Disallow any edits that follow the standard patterns of the socks of User:Migosyrn's edits.
  • Reason: This user has become increasingly hard to handle when it comes to stopping the user. Considering that he has a standard sort of editing style, the edit filter may be helpful here.

My name isnotdave (talk/contribs) 16:28, 7 September 2015 (UTC)

I'll pop this as  Denied for the time being then - as always, if it starts up again leave us a new request and we'll get on it. Thank you for checking up Omni! -- samtar talk or stalk 10:24, 3 July 2016 (UTC)

Soft skin

For more of an idea of what kind of edits 69.163's talking about, see Wikipedia:Sockpuppet_investigations/Soft_skin#20_February_2016. Ian.thomson (talk) 06:12, 20 February 2016 (UTC)
If this is just going to be monitoring one page, then I don't think it's a great candidate for an edit filter. The abuse filter checks every edit made, there's no point creating one if it's use is going to be limited only to Wikipedia:Reference desk/Miscellaneous. Omni Flames (talk) 10:25, 3 July 2016 (UTC)
 Denied per OF's rationale -- samtar talk or stalk 15:23, 6 July 2016 (UTC)

John Gingles

  • Task: Prohibit spammers from inserting John Gingles's unpublished memoirs as sources.
  • Reason: See [47] [48] [49] and my recent contribs. This is widespread sneaky abuse.

-- In actu (Guerillero) | My Talk 16:16, 2 December 2015 (UTC)

@In actu: It's not entirely clear to me what's happening here; users are inserting fake references where the author is John Gingles? Is there more discussion about this somewhere or is this just something you've noticed? Should be doable, I'd just like some context. Sam Walton (talk) 19:55, 28 December 2015 (UTC)
@Samwalton9: It is something I noticed. Over the course of several years a number of accounts and IPs have inserted unpublished memoirs by "John Gingles" as references to all sorts of articles. --Guerillero | Parlez Moi 00:53, 29 December 2015 (UTC)
@Guerillero: Any chance you can help track down some diffs where these sources are added? The Article Blamer doesn't seem to be working properly and I need a bit more information before I can write a well optimised filter. Sam Walton (talk) 19:35, 1 January 2016 (UTC)
@Guerillero: Based on the diffs you provided, I think a regex along the lines of <ref(.*)>John Gingles(.*)<\/ref> would work. What do you think of that? Omni Flames (talk) 10:08, 3 July 2016 (UTC)
Sounds good to me! --Guerillero | Parlez Moi 15:03, 3 July 2016 (UTC)
Testing at Special:AbuseFilter/773 -- samtar talk or stalk 15:58, 6 July 2016 (UTC)
Here is the combined edit of the IP which [this is supposed to undo. It's not clear to me that the "undo" has a sharp relationship with the IP's edits, but Ihave not examined either closely.
In terms of an edit filter, I would imagine this regex could be included in an omnibus filter, rather than creating a new one for what appear to be 16 or so edits over 4 years. Indeed unless I have missed something, this is not anything like the volume that we would normally consider for edit filters - and may even be good faith editing. All the best: Rich Farmbrough, 18:56, 6 July 2016 (UTC).
@Rich Farmbrough: I'd popped it into my test filter, no hits for now and having reviewed your comments I agree that a standalone filter here probably isn't worth it -- samtar talk or stalk 07:10, 8 July 2016 (UTC)
 Denied per above — MusikAnimal talk 01:49, 12 July 2016 (UTC)===Allow Interstate Highway articles to have separate protection levels===

I just requested lots of interstate articles that have little to no vandalism to be either Unprotected or Pending Change Protected on Wikipedia:Requests for page protection. The requests got denied because they were bulk protected. That means that all Interstate articles are required to have the same protection level. A user said to me that in order to have certain Interstate articles to have separate protection levels, you have to come here to request it. Change the protection requirements for all articles in Category:Interstate Highway System now and eliminate the bulk protection requirements for those articles. Then those articles will be allowed to have separate protection levels.

Not quite, what I said was pages related to the Interstate Highway System have been bulk protected until an edit filter (that is already in development) is tested and deemed ready to remedy the problem that is being temporarily solved via bulk page protection. In at least 3 different places, I have requested that you list what you would like to add to these pages. I think you will have a better chance of getting your requested changes implemented by responding to that request rather than asking for help at this page, which is only tangentially related to the issue at hand. Cheers,Dave (talk) 05:23, 12 May 2016 (UTC)
We have a filter running. Please email me or the mailing list if you see relevant edit getting through — MusikAnimal talk 16:54, 19 May 2016 (UTC)
Reply / Update: Iron Pipeline has been requested for unprotection on Wikipedia:Requests for page protection.

Language speaker data

  • Task: Filter the 'speakers' parameter of {{Infobox language}} for changes, similarly to how changes to height and weight in bio boxes are tagged. (If possible, filter 'date' and 'ref' under the same tag: these are all elements of the population figure.) Should apply to editors without advanced permissions.
  • Reason: Population inflation is a chronic problem with our language articles, and isn't easy to detect if you don't see it happen. Although this wouldn't catch changes to the text, vandals and POV warriors normally change the info box as well. This isn't just a problem with IPs, but often with signed-in POV editors. The date may be changed to make the data look recent. If 'date' and 'ref' can be covered without increasing server load significantly, please include them; otherwise 'speakers' is the main problem.

— kwami (talk) 00:28, 2 November 2012 (UTC)

Page deleted, then identically-named page created

  • Task: Say a page has been deleted, then a non-sysop with an editcount under 5,000 later creates another page with the same title. If this happens, please silently tag the page-creating edit with a tag. The tag should say that a page with that name has already been deleted X number of times.
  • Reason: This will help Wikipedians to more easily notice when a formerly-deleted page has been recreated. This will help make it more obvious to them when they should nominate "new" pages for deletion. It will also make it more obvious when a page title should be SALTed.

Thank you, —Unforgettableid (talk) 08:38, 30 August 2013 (UTC)

Unless I'm mistaken, the edit filter can't see the deletion log for a page being edited, so this isn't technically possible. A bot would be better for this. Jackmcbarn (talk) 13:51, 30 August 2013 (UTC)
Thank you for your reply. AnomieBOT (talk · contribs) runs a task called NewArticleAFDTagger, which tags recreated AfD-deleted pages with {{old AfD multi}}. AFAIK there is no bot which tags recreated PROD-deleted pages or recreated speedily-deleted pages. Where is the best place for me to request that someone provide that functionality? (In vaguely-related news: bugzilla:10331, which requests a page-creation log, is still unfixed despite five years and one patch.) Cheers, —Unforgettableid (talk) 06:03, 2 September 2013 (UTC)
That would be Wikipedia:Bot requests. Jackmcbarn (talk) 16:37, 3 September 2013 (UTC)
OK, thank you. So it's best that I go there instead of contacting User:Anomie directly? —Unforgettableid (talk) 19:14, 4 September 2013 (UTC)
Can do both. Wifione Message 19:34, 4 September 2013 (UTC)
I requested a {{old prod full}} tagger bot at Wikipedia:Bot requests/Archive 57#Bot to tag "PROD Survivors" and "Recreated Articles", and put a {{talkback}} template at User talk:AnomieBOT, but (despite one empty promise I got) nobody coded anything. Many have thought about writing such a bot, but nobody has ever written a practical one; I explained the matter further in my request there. I didn't create a bot request to tag recreations of CSD-deleted pages, but someone else is welcome to do so if they like. —Unforgettableid (talk) 07:53, 27 November 2013 (UTC)
Hmm, I just had an idea for how this can be implemented:

(action = "delete") | (action = "edit" & old_size = 0)

with a per-page throttle.
However whether this might be worth it or better suited for a bot is another question. Triplestop (talk) 03:53, 21 September 2013 (UTC)
That's an interesting solution. I hadn't thought of using the rate limiter like that. It looks like it would work, but it seems a bit hacky and would have a few FPs and oddities, such as tagging the deletion of a newly-created page, and tagging undoing of page blanking. Jackmcbarn (talk) 12:45, 21 September 2013 (UTC)
User:ThePhantomBot is currently logging this type of behavior and I plan to make it do more than that after it has been approved. PhantomTech (talk) 06:47, 25 March 2015 (UTC)

David1350

  • Task Flag or deny edits by socks of David1350 (talk · contribs) that create defamatory userspace articles on Navid Khiabani. Articles have been repeatedly deleted and they've taken to hiding them in userspace. Latest sock is Teamfact1 (talk · contribs), before that Factsheet (talk · contribs). Note that a number of Iranian IPs edited Factsheet's userpage.
  • Reason The material violates BLP and is part of a persistent campaign to use WP to denigrate Iranian expatriates. Acroterion (talk) 11:57, 17 August 2015 (UTC)
A periodic userspace search would probably be a better idea, this appears to be sporadic over a long time period. Sam Walton (talk) 12:16, 17 August 2015 (UTC)
Fair enough. Thanks Sam for looking into it. And thanks Acroterion for making the request. I'll keep doing what I'm doing, which is periodic searches. I'm also posting at sock user talks to try to help him see the futility. Best, Anna Frodesiak (talk) 07:50, 18 August 2015 (UTC)

Driver 3 vandal

  • Task: Can this filter be re-enabled please?
  • Reason: The Driver 3 vandal filter was added following this request, it has worked and stopped the vandalism to the article. On or before 2 June the filter was disabled. The vandalism has now returned (24 June and 25 June) proving that there is still a need for this. Can it be re-enabled please? - X201 (talk) 08:22, 25 June 2015 (UTC)
@Reaper Eternal: Since you disabled this, can you respond here? Also, page protection just on that page isn't really enough since the vandal targets many other pages (listed in the filter's definition). Jackmcbarn (talk) 15:57, 26 June 2015 (UTC)
@X201: I discussed this on IRC with Reaper, who feels that since this vandal isn't affecting a large number of articles, it's not worth having a filter and the pages should be protected instead. Jackmcbarn (talk) 00:33, 2 July 2015 (UTC)
I'm struggling with the logic. Is Reaper saying that its better to have protection that blocks all IP editors and that will lapse after a while, allowing the vandal back in, and which dumps the problem back on other editors, so that they have to clean up vandalism and re-apply for protection again. But an edit filter that blocks the one person who's causing the problem and cuts out the problem at source, is not worth having? - X201 (talk) 08:34, 2 July 2015 (UTC)
Without comment as to the usefulness of the filter, the logic is like this: Each time an edit is saved it gets checked against all filters, running through each filter's conditions until it doesn't fulfill a condition at which point it moves on to the next. This takes time (in terms of edit save time) and processing power, and we have a limit on this - see the top of Special:AbuseFilter. "X [edits] have reached the condition limit of 1,000" means that recently X edits haven't been checked against all filters correctly because they hit a limit imposed on us on how many conditions any edit can be checked against. For this reason we need to prioritise filters that stop the most widespread and damaging cases, we can't afford to have unlimited numbers of filters. Sam Walton (talk) 08:54, 2 July 2015 (UTC)
  • As per the first bullet above, problematic changes on one article are not a good candidate for an edit filter, largely because of the condition limit described above. In that sense, indefinitely semi-protecting the article (if needed) is preferable to consuming conditions for a one-article filter. I'm moving this to the denied section. –Darkwind (talk) 07:34, 5 August 2015 (UTC)

Nopirosyadi

  • Task: Help stop pages created by Nopirosyadi and his socks from being created in the first place. Basically, there are two major things that the sockfarm attempts to create: an article about a company named Quebec Telemarketing and one about another company named Toitures Du St Laurent, both of which were deleted at AfD (Wikipedia:Articles for deletion/Quebec telemarketing and Wikipedia:Articles for deletion/Toitures Du St Laurent). After a while, the socks continue to recreate the pages, despite the previous consensus to remove them. To create this edit filter, you can see the various (now deleted) pages they have created in the past at Wikipedia:Sockpuppet investigations/Nopirosyadi/Archive.
  • Reason: A simple title blacklist entry is not enough, as judging by the various titles they use, writing one that covers them all would result in many false positives. A filter that actually checks the content of the involved pages is perfect for this task.

- Gparyani (talk) 20:13, 2 July 2015 (UTC)

We've had trouble with this sockfarm for several months, and it's a chore to protect all the recreated titles and their demon spawn with individual RFPP requests. The machinations they go through to try and get themselves inserted into the encyclopedia are completely ridiculous. We really do need the abuse filter to catch these guys for at least a few months. KrakatoaKatie 02:17, 3 July 2015 (UTC)
Created at Special:AbuseFilter/704. Will monitor and report any accounts caught to the SPI. If it works well for a while I'll switch to disallow. Sam Walton (talk) 20:00, 3 July 2015 (UTC)
@Samwalton9: Why is it hidden from public view? Is there something in it that you'd rather not reveal? If not, could you unhide it so I can see if the filter is sufficient to catch the sockfarm? Gparyani (talk) 01:38, 4 July 2015 (UTC)
@Gparyani: I can see the filter – it looks for the two names above, though I think it might be better to just use the word 'toitures' instead of that entire phrase. It's hidden from public view because we don't want to give anything away to the spammers, particularly if we add words or phrases to the filter in the future. It has nothing to do with hiding anything from you. KrakatoaKatie 04:39, 4 July 2015 (UTC)
@Gparyani: This is basically the reason; in cases of these kinds of spammers it's not unreasonable to think that they would click through to the filter and discover how to get around it. I've watchlisted the SPI page so if any get through I'll double check and improve the filter. Sam Walton (talk) 08:21, 4 July 2015 (UTC)
@Gparyani: I've disabled the filter because it hasn't had any hits over the past week. I think it will be best to just search for those terms every so often. Sam Walton (talk) 08:10, 12 July 2015 (UTC)

New user changing pronouns in trans BLP

  • Task: Warn and flag new and unregistered users against changing the pronouns in an article; perhaps even stop such edits if pronouns are the only thing which is changed. If feasible, tailor the filter to articles which are in one or more categories that contain the words "transgender" or "LGBT". If feasible, only take action (warn/stop the edit) if, say, ≥3 pronouns are changed, to prevent false positives (possibly legitimate rewrites where a quote is switched for another quote, typofixes, etc).
  • Reason: One persistent form of vandalism is new and unregistered users changing the pronouns on Wikipedia's articles on trans people. The Manual of Style is clear on the matter. Recent example: [50]. (If anyone doubts that this is a common occurrence, I can track down more examples.)
    If even a warning is felt to be too strong an action, at least flagging the edit would be appreciated, because in all the pronoun-switches I've seen new users make to BLPs, I don't recall a single one that wasn't reverted as inappropriate and in contravention of the site's guidelines on the matter.

- -sche (talk) 22:00, 2 July 2015 (UTC)

Reading the note in one of the sections below that edit filters are resource-intensive and having a large number of them is bad, I concede that an edit filter for this is probably not a high priority. -sche (talk) 22:06, 2 July 2015 (UTC)
Examples: this user's first four edits. --Redrose64 (talk) 19:10, 3 July 2015 (UTC)
I don't think this is possible with an edit filter, at least not as far as I understand how to write them. We can search edit diffs, old text, and new text for strings. If they changed all the pronouns in the text from one to the other, or all in the sections they edited, then that could work, but I don't see it working well otherwise. I'll wait to see if any other edit filter writers have any ideas though. Sam Walton (talk) 19:53, 3 July 2015 (UTC)
Would it be feasible to check for: edits by new and unregistered users (if possible: to articles where the old text contained "transgender" or "LGBT") which removed \bshe\b and simultaneously added \bhe\b or vice versa, and resulted in the addition/removal of fewer than 100 bytes? (Edits of this sort tend to result in only small changes to page size, so if cutting down the diff-size-limit further would make the filter less resource-intensive, one could probably drop it as low as 40 bytes.) The filter could just tag rather than warn/block, until it became apparent whether it was sufficiently tailored or had false positives. -sche (talk) 04:57, 4 July 2015 (UTC)
This would likely have a lot of false flags. This would be implemented by searching removed_lines form one pronoun and added_lines for the other, but that searches the whole block of text they were editing in, and it's not unreasonable to think that the other pronoun might be there anyway, referring to someone other than the article subject. Sam Walton (talk) 08:25, 4 July 2015 (UTC)
You could compare, for example rcount(added_lines,"\b(he|she)\b) == rcount(removed_lines,"\b(he|she)\b) & !rcount(added_lines,"\b(she)\b) All the best: Rich Farmbrough, 22:38, 26 July 2015 (UTC).

Creating a blank page

  • Task and reason: Filter should prevent the creation of blank pages: warn on the first occurrence, warn on the second, and just keep warning without allowing the edit to be saved until at least one character is entered. I wasn't aware that this was possible, but apparently it is. Presumably coding should be simple: block the edit if (1) it's a page creation, and (2) the resulting page will have a size of 0 bytes. Such a page creation is never a good idea; admins, IPs, and everyone else should equally be prevented.

- Nyttend (talk) 20:51, 27 June 2015 (UTC)

This already exists as Special:AbuseFilter/632, though it only tags new blank articles as "new blank article" [51]. I'm inclined to agree that this seems like something we could disallow rather than simply creating a list of tagged pages. Dragons flight (talk) 02:04, 28 June 2015 (UTC)
Does it have to be restricted to articles only? Might as well make it other namespaces, since all creations of blank pages will be accidents (nobody complains about being prevented from making an accident!) or bad-faith creations. Meanwhile, I've updated it so that it prevents "the user from performing the action in question". I don't understand the coding, so I didn't dare make changes except to the little check box at the bottom. Nyttend (talk) 03:32, 28 June 2015 (UTC)
Does it really need to warn infinite times? That is too much biting the newbies, just one Warn would be enough. --TL22 (talk) 11:45, 28 June 2015 (UTC)
I've re-allowed edits flagged by the filter. Looking through the log shows a number of occurrences where a new users creates a blank page, and then proceeds to create an actual article from there. I wouldn't want to have discouraged these users from creating their articles, which "An automated filter has identified this edit as potentially unconstructive, and it has been disallowed" is likely to do. Patrolling the filter log for leftover blank pages isn't hard work and is, I believe, worth it if it stops us discouraging new users. FYI, When creating a blank article you do already get a warning that "The page you are creating is blank. If you click "Save page" again, the page will be created without any content." Sam Walton (talk) 11:57, 28 June 2015 (UTC)
If some people really are engaging in the work flow 1) create blank page, 2) create content for page, then I agree that there is no reason to prohibit that behavior (even if it is a little suboptimal). Probably best to just log/tag these things then. Dragons flight (talk) 17:01, 28 June 2015 (UTC)
Then maybe I remembered wrongly what's involved in the warning. Aside from things we don't use (e.g. un-confirming an editor), I thought the only options were "do nothing", "insert a tag", and "warn", which basically was just the system giving you a notice instead of allowing you to go ahead with the edit. And I thought the message was more of the "Are you sure you want to do this?" sort, not a big warning message. I'd be in favor of something saying basically "You attempted to create a page without any content; if this were intentional, you may try again at creating it, but please include some content". Apologies for the confusion. Nyttend (talk) 01:16, 29 June 2015 (UTC)
That sounds reasonable, but it seems the software does that already. Sam Walton (talk) 22:05, 3 July 2015 (UTC)

Redirects to badimages

To deal with socks of 1abacada (talk · contribs) who have discovered that they can redirect pages to files on the bad images list, a filter is needed to prevent this, at least for autoconfirmed users (though I can't see a reason for anyone short of an admin to do this). Acroterion (talk) 02:51, 4 May 2014 (UTC)

@Acroterion: I've created a filter definition that will stop this behavior and emailed it to you. To enable it here, first add yourself to the abusefilter group at Special:UserRights/Acroterion. Then, go to Special:AbuseFilter/import, paste it, click "Import data", then click "Save filter". Jackmcbarn (talk) 00:50, 13 May 2014 (UTC)
Acroterion did this filer get set up? Sam Walton (talk) 21:57, 21 January 2015 (UTC)
Not that I'm aware of: I don't have the technical expertise to review it, and since I'd b e responsible for its effects, I didn't make myself an abuse filter editor, etc. Acroterion (talk) 21:54, 24 January 2015 (UTC)
@Acroterion: Set up at Special:AbuseFilter/700 (finally). Sorry for the delay. Sam Walton (talk) 16:20, 18 June 2015 (UTC)
Thanks. I don't think it's been an issue recently, but it will prevent someone else from doing it if it occurs gto them. Acroterion (talk) 16:59, 18 June 2015 (UTC)
@Acroterion: Seems that it's not currently a pressing issue so I've disabled the filter. Sam Walton (talk) 13:17, 30 June 2015 (UTC)

Draft being moved to mainspace before review

  • Task: This filter should be able to detect whether an editor attempts to move a draft before review (technically, before the draft has been sumbitted for review (not counting declined reviews) or if the draft has been moved by the draft creator) and warn the moving editor with a friendly notice (since people who do that tend to not know how drafts work and are doing it in good faith).
  • Reason: People who create drafts tend to move their drafts to the mainspace before sumbitting them for review, which can be bad because the article can have some problems that could normally be detected by a draft reviewer, and can lead it to a(n) PROD/CSD/AFD tag on the article.

- TL22 (talk) 18:20, 27 March 2015 (UTC)

Since I'm not receiving any response; User:Samwalton9? --TL22 (talk) 23:53, 13 April 2015 (UTC)
@ToonLucas22: I've been going back and forth on whether this is suited to an edit filter. Though I agree it would be useful for everyone, edit filters are more for edits which are necessary to track or stop, and we're quickly running out of room for new filters. Sam Walton (talk) 12:04, 25 May 2015 (UTC)
 Not done for this reason. Sam Walton (talk) 09:25, 23 June 2015 (UTC)

John Daker sockpuppets

  • Task: Disallow removal of {{blockedsock|John Daker}}, {{sockpuppet|John Daker}} and all templates that redirect to {{sockpuppet}} with "John Daker" on the first parameter.
  • Reason: See Wikipedia:Sockpuppet investigations/John Daker. The editing pattern of this user's sockpuppets is to remove sockpuppet tags from confirmed sockpuppets of him, then begin vandalizing pages. --TL22 (talk) 23:13, 2 June 2015 (UTC)

- TL22 (talk) 23:13, 2 June 2015 (UTC)

I thought I'd replied here when I made Special:AbuseFilter/695, but apparently not. It worked but I've disabled it again since it's not a huge issue and the socks are generally noticed anyway. Sam Walton (talk) 09:23, 23 June 2015 (UTC)

shadow youtube spam

- JacktheHarry (talk) 22:21, 22 April 2015 (UTC)

@JacktheHarry: Not sure if this is a widespread enough issue to warrant an edit filter, but Special:AbuseFilter/691 is log only for now to see. Sam Walton (talk) 11:28, 25 May 2015 (UTC)
@JacktheHarry: I don't think this filter is worth continuing given the low number of hits, disabling. Sam Walton (talk) 16:15, 18 June 2015 (UTC)

Prevent vandalism disguised as typo fixes

  • Task: Block/warn against (not sure which) any non-autoconfirmed edits with a summary of "Fixed typo" and a diff larger than +5/-5.
  • Reason: Many vandals use the summary "Fixed typo" as a disguise, and most legitimate typo fixes won't change more than 5 characters.

- (talk to) TheOtherGaelan('s contributions) 06:10, 15 June 2015 (UTC)

Canned edit summaries, including "Fixed typo" are already tagged, blocking/warning would probably just cause vandals to stop using the edit summary and make them harder to find. PHANTOMTECH (talk) 07:41, 15 June 2015 (UTC)
See #Fixed typo below. --Redrose64 (talk) 10:40, 15 June 2015 (UTC)
Moved to denied as a duplicate. Sam Walton (talk) 16:32, 18 June 2015 (UTC)

Block complicated phishing operation that is using Wikipedia articles

  • Task: Blacklist "agorahoo3yigtggf"
  • Reason: A phishing operation targeting the Agora (online marketplace) is using the Wikipedia article to lure in victims. The page is currently semi-protected, but they are dedicated enough to make sockpuppets and get them autoconfirmed. An example of their work. Their scam is probably highly lucrative, but it can hampered significantly if the string "agorahoo3yigtggf" (their phishing URL) is blacklisted. .onion addressed that are not just random text are time consuming to generate, and they will not be able to easily produce another one that is passably confusable for the legitimate address. Antrocent (♫♬) 20:54, 10 June 2015 (UTC)
@Antrocent: Not done, please make URL blacklist requests here. Sam Walton (talk) 23:03, 10 June 2015 (UTC)
@Samwalton9: it is not a normal URL so the EL blacklist will not work. It is designed to look like one, but it is more like a code used with special software. It is not linked in the article (because it can not be accessed with a normal web browser), the phishers are hoping that it will be copy-pasted. Antrocent (♫♬) 23:21, 10 June 2015 (UTC)
@Antrocent: Oh sorry, I see. Is it only happening on this article? Sam Walton (talk) 23:25, 10 June 2015 (UTC)
Yes, sorry! Antrocent (♫♬) 00:13, 11 June 2015 (UTC)
Hmm. I'm reluctant to make an edit filter for one article, though I suppose it wouldn't be a very demanding one since the first condition would be to check that this page is the one being edited. Full protection is an option, but Pending Changes 2 would actually be preferable. We should wait to see if the semi-protection works beyond this one autoconfirmed user anyway, so I'll have a think in the meantime. Sam Walton (talk) 00:19, 11 June 2015 (UTC)
 Not done Semi-protection seems to have worked. Sam Walton (talk) 16:14, 18 June 2015 (UTC)

IP MOS vandalism filter - culry quotes, decapitalization

Diff examples:
Ping me if more explanation or diffs are needed. Thank you!

- EvergreenFir (talk) Please {{re}} 21:43, 4 April 2015 (UTC)

Hi EvergreenFir, do you know if this has happened with more IPs? Edit filters aren't used for enforcing the MOS but if this is a long-term issue with more than just these three IPs then I could set one up. Sam Walton (talk) 16:47, 5 April 2015 (UTC)
For future reference the filter currently in my sandbox should be able to detect the curly quote and logical quote changes. Capitals would be impossible to check as far as I know. Sam Walton (talk) 16:58, 5 April 2015 (UTC)
@Samwalton9: I found two more in the 68.98.155.* range: 68.98.155.48 (talk · contribs · deleted contribs · logs · filter log · block user · block log) (from late 2014) and 68.98.155.223 (talk · contribs · deleted contribs · logs · filter log · block user · block log) (currently active). They use the same "punctuative corrections" edit summary.
I honestly am not too sure how the edit filters work, so I'll take your word for it on the capitalization stuff. Their primary MO seems to be (1) "punctuative" in the edit summary and (2) the curly quotes.
I'll look in some other IP ranges under 68.98.*.* now that I learned how to get the user contribs to show IP ranges. Cheers! EvergreenFir (talk) Please {{re}} 16:32, 6 April 2015 (UTC)
Found another from April - December 2013: 68.98.154.182 (talk · contribs · deleted contribs · logs · filter log · block user · block log) EvergreenFir (talk) Please {{re}} 16:58, 6 April 2015 (UTC)
And some more:
@Samwalton9: Thank you very much! Is there anything I should do when the filter catches them other than revert (and possible warn)? EvergreenFir (talk) Please {{re}} 20:06, 7 April 2015 (UTC)
@EvergreenFir: Not for now. I'll be keeping an eye on the filter too and after a while of having the filter in log only mode we'll see if its useful and how to proceed (perhaps disallowing the edits). Sam Walton (talk) 20:34, 7 April 2015 (UTC)
@Samwalton9: Sounds great! Thank you! EvergreenFir (talk) Please {{re}} 20:36, 7 April 2015 (UTC)
@EvergreenFir: The filter's been disabled since all the edits were coming from one IP, which I've blocked. Their recent edits might need looking through though. Sam Walton (talk) 16:21, 18 June 2015 (UTC)
@Samwalton9: Thank you again for all your help. I'll take a look and keep an eye out for similar edits that prompted this filter request. Cheers! EvergreenFir (talk) Please {{re}} 16:28, 18 June 2015 (UTC)

Copyviocore

  • Task: Due to an OTRS ticket, I noticed that in this edit, Template:Copyviocore was added by an anonymous user, blanking the article for six months for anyone who wanted to read it, and was not noticed by any users.
  • Reason: This filter would allow for the monitoring of the placement of this template by non-autoconfirmed users (or users who normally do not add it, maybe those with less than 1,000 edits or something) to prevent vandalism, as it could be easily used to cover over articles that vandals may not like, with no quick consequences.

- Kevin Rutherford (talk) 22:17, 13 April 2015 (UTC)

@Ktr101: Log only for now at Special:AbuseFilter/692. Sam Walton (talk) 11:55, 25 May 2015 (UTC)
@Ktr101: Disabled due to lack of hits. Sam Walton (talk) 16:29, 9 June 2015 (UTC)

IP disruption from multiple /8s

  • Task: Block the addition of � to user talk pages, coming from the IP Ranges 81.0.0.0/8 84.0.0.0/8, 86.0.0.0/8 (Maybe even broader than specific /8s)
  • Reason: Prolific IP vandal is spamming a number of user talk pages, amongst other things using that character. At least a dozen direct blocks, some semi-protections and at least one small range block have failed to prove effective.

- Monty845 23:57, 30 May 2015 (UTC)

@Monty845: Seems reasonable, could you provide some IPs which have been doing this for testing purposes? Sam Walton (talk) 23:59, 30 May 2015 (UTC)
Could start with 86.142.21.50, 86.131.23.71, 81.131.77.180, 86.131.23.67 Monty845 00:06, 31 May 2015 (UTC)
I can't find the 84. one, so perhaps start with 81. and 86. Monty845 00:14, 31 May 2015 (UTC)
The vandalism seems to be coming from IPs from BT Total Broadband (UK), maybe an abuse report to the ISP may suffice Already sent one. Esquivalience t 00:40, 31 May 2015 (UTC)
They have already started changing their behavior, so my initial request wont stop them. New AN thread on the topic at was started by someone else at WP:AN#Rangeblock?. Monty845 17:32, 31 May 2015 (UTC)

no Declined. Way too broad—that's most of the UK. Reaper Eternal (talk) 03:40, 2 June 2015 (UTC)

Itailevi00 socks

- Esquivalience t 14:43, 30 May 2015 (UTC)

@Esquivalience: I don't see blocking usernames being useful (They'll just use a different string and be harder to track), but it's not an edit filter option anyway, you'd want the username blacklist. We could, however, track edits from users with that string in their username, would that be helpful? Sam Walton (talk) 00:00, 31 May 2015 (UTC)
@Samwalton9: A hidden, log-only filter that tracks account creations and edits from the Itailevi family of sockpuppets would be useful. Esquivalience t 00:06, 31 May 2015 (UTC)

no Declined. Just use Special:ListUsers/Itailevi. Reaper Eternal (talk) 03:43, 2 June 2015 (UTC)

John Galea

  • Task: Prevent creation of pages using the text of the deleted page John Galea. I'd suggest filtering on anything containing the name "John Galea" (although he's not been averse to mis-spelling his own name in order to get around create protection).
  • Reason: The page has been repeatedly recreated under multiple alternate titles by a veritable army of socks. Salting and rangeblocking are not effective measures against this user.

- Yunshui 雲‍水 15:19, 17 February 2014 (UTC)

Yunshui, could you list some of the other article titles? And do you know if this is still an issue? Sam Walton (talk) 00:03, 17 January 2015 (UTC)
@Samwalton9: Sure - some of the other titles were: John Galea (Singer), John Galea (singer), John- Paul Galea, John Galea!, John Galea (musican), John_Galeaa, John Galeea, John Galea (Paul), Do it my way, (Singer) John Galea, John Galea (performer), John Galea ( the musican ), J.Galea, John Galea (artist)... Not an exhaustive list by any means, but it gives you an idea of the problem. He was still apparently socking as recently as last week (albeit after a hiatus of several months), so I'd say the problem is still ongoing. Thanks for taking a look. Yunshui 雲水 10:12, 5 February 2015 (UTC)
@Samwalton9: He's still at it... Yunshui 雲水 08:17, 4 September 2015 (UTC)
@Yunshui: Sorry for the delay. Log only at Special:AbuseFilter/724 for now. Sam Walton (talk) 11:18, 4 September 2015 (UTC)
Excellent, thanks Sam. Yunshui 雲水 11:23, 4 September 2015 (UTC)
@Yunshui: The filter hasn't been tripped at all, do you know if there have been any recent accounts? Sam Walton (talk) 22:32, 27 September 2015 (UTC)
Nothing since the start of this month that I'm aware of, but on past form he tends to take breaks of several months at a time before reappearing - I'd say it's probably best to leave the filter in place unless it's messing up something else. Yunshui 雲水 07:04, 28 September 2015 (UTC)
@Yunshui: Given the limited capacity we have for edit filters I've disabled this since it wasn't receiving any hits. A search for John Galea or some other text from the article periodically is probably the best bet. Sam Walton (talk) 00:21, 24 November 2015 (UTC)

Archive.is

(Apologies if this is not formatted correctly, I was referred to here from the whitelist). – Zumoarirodoka(talk)(email) 11:26, 1 September 2015 (UTC)

I'm not familiar with this filter or the relevant RfC, so pinging Kww who appears to have been involved in both. To me it looks like we shouldn't be allowing any archive.is links, but if it's the only archive I'm not sure if we should make an exception. Sam Walton (talk) 12:03, 1 September 2015 (UTC)
No exceptions are warranted under these circumstances. Why on earth would we include an unlicensed archive copy of an unlicensed copy when a fully referenced archive exists? —Kww(talk) 15:34, 1 September 2015 (UTC)
Ah, thank you. I've added that link into the article now. – Zumoarirodoka(talk)(email) 15:58, 1 September 2015 (UTC)

AfC Participants

  • Task: Prevent any users with accounts less than 90 days old and less than 500 undeleted mainspace contributions from editing the Wikipedia:WikiProject Articles for creation/Participants page.
  • Reason: This list can be edited by any autoconfirmed editor. While any editor can remove editors that do not meet the criteria from the page, in practice this is often not done. Using an edit filter would be the most effective method to solve this problem. I understand that such restrictions for individual pages may be better served by page protection, but page protection does not allow setting a custom limit for account age and edit count. More specifically, I want a filter similar to the one currently used on the Gamergate controversy article. Can this be done, or is there a better solution for this? (There was another proposal a few months ago: Wikipedia:WikiProject Articles for creation/RfC to physically restrict access to the Helper Script, but that resulted in no consensus.)

- sst✈ 04:11, 10 October 2015 (UTC)

@SSTflyer: Given the lack of consensus at that RfC for physical restrictions, I'm not sure I would be comfortable with this filter, especially given that the guideline RfC which looks soon to pass prohibits good-faith-edit filters from disallowing edits without a consensus. Sam Walton (talk) 15:02, 10 October 2015 (UTC)
Thanks anyway. Perhaps I should start a discussion at WPRFC first to gain consensus. You may deny my request. sst✈ 15:05, 10 October 2015 (UTC)
Logging such additions would make management of the list easier. Esquivalience t 01:12, 12 October 2015 (UTC)

Amiibo

  • Task: Keep IP users from "correcting" the word "Amiibo" to "amiibo".
  • Reason: A certain IP user keeps violating MOS:TMRULES by changing the above uppercase word to lowercase. Examples of this can be found on my Contributions page since I am the one who has usually reverted them. Despite multiple warnings, they have continued their practice. The latest page I know of that they've changed is The Legend of Zelda (2017 video game). I've tried requesting page protection, but there isn't enough disruptive editing to protect it. A filter would (hopefully) stop the IP user from doing this to other articles. His IP address changes quite a bit, so I do not believe a block on the IP would be sufficient.

- Gestrid (talk) 18:23, 9 June 2016 (UTC)

@Gestrid: How long have they been doing this? How many edits (roughly) do you think this filter would help prevent? I only ask because this may not be suited to "spending" edit filter cycles on, but could be better dealt with by page protection or just manual reverting -- samtar talk or stalk 19:22, 9 June 2016 (UTC)
@Samtar: I'm not entirely sure when they first started doing it. I first noticed it when I got a watchlist email about their edit to the page here. They then moved on to Kirby: Planet Robobot to do the exact same thing there. I requested and got page protection there as a result. As for requesting page protection for The Legend of Zelda (2017 video game), see Wikipedia:Requests_for_page_protection/Rolling_archive#09_June_2016 under "The Legend of Zelda (2017 video game)". That's why I came here. I'm honestly getting tired of reverting their edits, and I feel an IP block won't work because of the changing IP. -- Gestrid (talk) 19:35, 9 June 2016 (UTC)
Well considering they are only changing one letter (A -> a), just matching against (\[\[)?amiibo(\]\])? in added_lines should catch it -- samtar talk or stalk 20:02, 9 June 2016 (UTC)
I'm sorry, I'm not familiar with what you're talking about. I'm not even sure if I have the correct user rights to add a filter. How would I add the filter? -- Gestrid (talk) 20:08, 9 June 2016 (UTC)
Sorry - that was more aimed at one of the EFMs who will have a look at this and actually add the filter -- samtar talk or stalk 20:10, 9 June 2016 (UTC)
Oh, ok. Thank you for your help! -- Gestrid (talk) 20:12, 9 June 2016 (UTC)
(←) @Gestrid: Alright, after some investigation, I'm convinced the issue is widespread. However I don't think they are all from the same user, and that being said these look like good-faith edits; The subject after all is stylized as "amiibo". A warn/tag filter might be appropriate but I don't think we'll want to disallow these edits. I've created a test filter for further evaluation — MusikAnimal talk 06:46, 15 June 2016 (UTC)
@MusikAnimal: looks like I way over-complicated that.. -- samtar talk or stalk 08:02, 15 June 2016 (UTC)
 Denied Nearly a week and no hits. The filter first ensures "amiibo" is not already in the article to reduce false positives. If I removed this we might get some hits, but the edit might say "amiibo, as it is stylized in the logo", etc. Overall these edits are only mildly disruptive and not worth the expense of an edit filter. All we would be able to do is tag the edits anyway; blocking good-faith edits via a filter is very much frowned upon. Sorry I couldn't be of help :/ — MusikAnimal talk 16:26, 21 June 2016 (UTC)

User Name filter/ "BlueUndigo" troll

- RickinBaltimore (talk) 20:34, 23 February 2016 (UTC)

  • @RickinBaltimore: I don't think this is the right way to deal with this. One: having similar usernames helps identify the troll more quickly, and they would probably mutate to overcome a restriction. Two: if you do wish to prevent the registration of these usernames, the global title blacklist can do this and it would prevent the scenario of the troll registering on (say) Commons and then SULing over here. BethNaught (talk) 10:15, 3 April 2016 (UTC)
  •  Denied: with BethNaught on this one, the blacklist has the ability to use regex restrictions. I would recommend adding something similar to BlueUndigo\w+ -- samtar talk or stalk 19:46, 28 June 2016 (UTC)

Broken Ref Filter

  • Task: Catch broken ref tags and alert editor
  • Reason: I help on #wikipedia-en-help and have run across a number of helpees who are confused why references are repeated on the articles they are working on. In my cases, this is caused by improperly closed ref tags. It's extremely confusing to the inexperienced editors and I'm wondering if we shouldn't have an edit filter to catch these and alert the editor. An example is: Epoxyeicosatetraenoic Acid diff. The last ref tag on the page isn't closed properly.

- Chrisw80 (talk) 16:16, 23 March 2016 (UTC)

Would [^<]\/ref>|<ref[^>] catch many of these common issues? I think a bot could (does?) do this though -- samtar talk or stalk 12:26, 1 June 2016 (UTC)
My guess is this doesn't happen very much, and with the advent of VisualEditor it's going to continually become less of a problem. For the regex, we'd also need to account for re-used references, as with <ref name='nytimes' />, and even still we're only targeting one way of breaking references. There's other ways for users to get confused, and I'm not sure throwing a warning while preventing them from saving is the best way for them to learn — MusikAnimal talk 15:05, 13 June 2016 (UTC)
Very true, and I agree that the VE will help ease a lot of newer editors into the syntax, reducing this issue massively. On another note, good to see that other filter got a couple of hits :) -- samtar talk or stalk 15:09, 13 June 2016 (UTC)
 Denied: given MusikAnimal's comments above, I agree that this would probably cause more issues than it could solve. This could however be a great task for a bot to do, perhaps fixing the most common errors and leaving the new user a message explaining/providing information about where to get further help? -- samtar talk or stalk 19:52, 28 June 2016 (UTC)

MM refspam

  • Task: Prevent a certain editor from adding citations to his own work, or at least flag his additions so they can be reverted quickly. (Name not given here so as not to alert him if he does a search.)
  • Reason: Over more than three years, this editor has made more than 700 edits using 50 different IPs; each edit added (or modified an already-added) citation to his own work. The frequency of his edits is irregular; he may go months between sessions. The particulars of this case can be found at this page.

He invariably uses his full name, which consists of three given names and one family name. He places the family name either last or first in the citation, but always spells out the three given names in full. Other editors who wish to cite him (and he is a genuine academic) can use his first name only, first three initials only, or first name and middle initials only, along with his family name. I have found only four instances in hundreds of articles he's edited where another editor cited his work.

It was at the latest ANI discussion that an edit filter was suggested. I didn't know anything about edit filters, but perhaps it could work. Please {{ping}} or email me with questions. Thanks. — Gorthian (talk) 21:57, 23 May 2016 (UTC)

I've recently written a filter which would take care of this, with some help from Samtar (thanks!). Since this filter would have to be private, to disallow the user-in-question from getting around it, I've sent an email to the edit filter managers mailing list regarding this along with the conditions. Omni Flames (talk) 11:38, 27 June 2016 (UTC)
If there are legitimate reasons to cite this academic, it's unlikely we'll be able to disallow the edits. Will Special:Search not suffice for finding them (exmaple)? The other concern is if they were to catch on to the filter, they'd simply reword it, perhaps to the acceptable format that we see with legitimate use — MusikAnimal talk 16:01, 27 June 2016 (UTC)
I have been doing a similar search every so often, and have indeed caught one insertion (which I'm leaving alone for the moment), but I'm more concerned about three or nine months down the line, when I've fallen out of the habit of running that search. The more I've thought about this, the more I think some sort of notification (to me or a small group of editors) would be better than disallowing the edit. He would be much less likely to "catch on" about the filter this way, and the occasional legit citation would be left alone. A notification seems more desirable than a tag. Is this doable? — Gorthian (talk) 16:50, 27 June 2016 (UTC)
There is currently no way to issue some form of notification when an edit filter has been triggered, but I have been thinking about this for some time and have a bot idea of my own. For now anyway, I think simply searching for the edits is your best bet, and of course without the added expense. You have to remember the edit filter run tests against every single edit made (in some way), so we really need strong justification to use it — MusikAnimal talk 16:58, 27 June 2016 (UTC)
To editor MusikAnimal:: In the heat of the struggle, when I and several other editors were working for days to track down his hundreds of edits and clean them up, I kept thinking "Never again!" But realizing that a filter would have to address every edit for what may be months with no hits...well. It seems less urgent now. I will keep on with my searches, and retire this request. I may come back if he gets out of hand again.
Do expand your bot idea; it could make some of these filters more effective. Thanks for your help and advice. — Gorthian (talk) 20:04, 28 June 2016 (UTC)
Thank you! Closing this request as  Denied, but certainly feel free to come back with inquiries moving forward — MusikAnimal talk 21:18, 28 June 2016 (UTC)

Blocked user message text

  • Task: Prevent editors from posting the "you cannot edit Wikipedia" message like this in the user/user talk space.
  • Reason: Persistent editing from LTA user.

- –Fredddie™ 02:39, 16 February 2016 (UTC)

@Fredddie: is this LTA still active? -- samtar talk or stalk 19:40, 28 June 2016 (UTC)
@Samtar:: not in the last couple of months, but the corner of the wiki this LTA likes to crap all over has had page protection that's about to expire. So right now all is quiet. –Fredddie™ 21:48, 28 June 2016 (UTC)
@Fredddie: okay, would it be alright with you to close this request? If they start up again by all means submit a new one, that way we can get the most up to date examples/IP ranges - hopefully they've found a different hobby! -- samtar talk or stalk 06:36, 29 June 2016 (UTC)
Sure thing. –Fredddie™ 12:17, 29 June 2016 (UTC)

Ted Cruz

  • Task: Intercept the Ted Cruz/Zodiac killer meme.
  • Reason: We're probably stuck with this until the Republican convention, or beyond. This should be easy to control via one of the vandalism filters, and would allow several articles to be un-protected. See deleted edits [64] and [65]. Acroterion (talk) 13:15, 29 February 2016 (UTC)
Same as above. I second this request. EvergreenFir (talk) Please {{re}} 07:12, 31 March 2016 (UTC)
@Acroterion: @EvergreenFir: Is this still a problem now that the Cruz campaign has been suspended? Omni Flames (talk) 12:05, 26 June 2016 (UTC)
It's still going, but at a much lower level, so I think regular patrolling can intercept it nowadays unless something comes up in the campaign again. Acroterion (talk) 14:45, 26 June 2016 (UTC)
 Denied for now Do keep us updated if there's a sudden surge in these edits again, I've got a workable regex saved up! -- samtar talk or stalk 18:47, 29 June 2016 (UTC)

Orion

  • Task: Disallow any insertion containing "Osiris-Orion", "Orion son of Ra", and "(Christ the Logos)" (with brackets). Such a filter should be applied to all pages (alternatively, just to the pages linked in this index).
  • Reason: As an effort to stop the persistent Wikipedia:Long-term abuse/Ararat arev who keeps inserting sentences always containing the pseudoreligious/scientific combinations above. For a recent example, see here.
This abuser wastes the time of a number of editors and creates situations where pages are protected that wouldn't need protection otherwise. Doug Weller talk 21:45, 4 March 2016 (UTC)
@Doug Weller: Would something like this work? The LTA seems to be editing mostly by IP now, so it would probably be best limited to autoconfirmed users.


!("autoconfirmed" in USER_GROUPS) & ( 
  article_namespace == 0 & (   
    string :="(Osiris-Orion|Orion son of Ra|\(Christ the Logos\))";
    added_lines irlike string & (
      ! removed_lines irlike string
    )
  )
)
Omni Flames (talk) 01:07, 27 June 2016 (UTC)
Almost Omni Flames - regex would need to be more like (\[?\[?Osiris\]?\]?-\[?\[?Orion|Orion\]?\]? son of \[?\[?Ra|\(Christ the \[?\[?Logos\]?\]?\)) to capture the wikilink syntax - tested against given example -- samtar talk or stalk 07:52, 27 June 2016 (UTC)
Also, missing parenthesis on line 5? -  !(removed_lines irlike string) -- samtar talk or stalk 07:54, 27 June 2016 (UTC)
Ah, thanks for that Samtar, admittedly I hadn't looked at the edits very well. As for your second concern, are the parentheses necessary? I could be wrong, as I'm fairly new to edit filters, but AFAIK the filter would work just fine without them. Omni Flames (talk) 08:51, 27 June 2016 (UTC)
@Omni Flames: It's more of a code style thing, but it looks like you are correct - it would function (or at least, the syntax checker didn't throw). You would however need to change the string to another variable name, as "string" is a reserved function -- samtar talk or stalk 09:22, 27 June 2016 (UTC)
@Samtar: Ah, you're correct. I didn't think of that. Omni Flames (talk) 09:25, 27 June 2016 (UTC)
No worries, feel free to ping if you ever have any questions - I idle on IRC a lot as myrcx. The Test Wiki has the AbuseFilter extension enabled that you can use for testing -- samtar talk or stalk 09:30, 27 June 2016 (UTC)
@Omni Flames and Samtar:Thanks all, this would be great. Doug Weller talk 10:08, 27 June 2016 (UTC)

@Doug Weller: would you like me to put this into a filter for you, or will you? -- samtar talk or stalk 19:48, 28 June 2016 (UTC)

@Samtar: I'd appreciate it if you did, this isn't something I feel confident with. Thanks. Doug Weller talk 19:56, 28 June 2016 (UTC)
@Doug Weller: No worries - currently in testing at private filter 771 -- samtar talk or stalk 20:07, 28 June 2016 (UTC)
@Doug Weller: Are there more recent examples of this abuse that you could share? — MusikAnimal talk 20:26, 28 June 2016 (UTC)
See also Special:AbuseFilter/737, which may be ineffective now — MusikAnimal talk 20:43, 28 June 2016 (UTC)
He hasn't edited since this request. My experience with him over the years is that there are fairly long times when he doesn't edit, then periods where he edits extremely frequently. At one point he even offered not to edit without my approval, oddly enough. I think yours would work, I don't think the 737 is adequate. Doug Weller talk 14:03, 29 June 2016 (UTC)
 Denied (for now). I've copied the new filter back to 737 for historical purposes. @Doug Weller: When the disruption resumes let one of us know; we'll have some ready — MusikAnimal talk 15:44, 1 July 2016 (UTC)
That's fine, thanks. Doug Weller talk 05:52, 2 July 2016 (UTC)

TV date changes vandalism

  • Task: Flag multiple changes to date and date ranges, primarily on cartoon related pages and lists of episodes.
  • Reason: IP hopper has been vandalizing cartoon-related pages and UK TV station pages for months. MO is to change airdates and date ranges on articles. Often they change multiple dates at once. Rangebolock seems out of the question given the range of IPs used. Most IPs geolocate to England and use Sky Broadband for their ISP. This vandal seems to have a few favorite pages to target, but they have a wide range of pages. Below is a list of IPs I have found that fit the pattern for this vandalism:
  • 151.227.193.95 - 4-14 January 2016 (143 edits)
  • 151.227.161.131 - 15-18 January 2016 (57 edits)
  • 31.119.105.49 - 18 January 2016 (20 edits)
  • 188.221.240.137 - 19-21 January 2016 (38 edits)
  • 151.228.21.202 - 2-11 February + 16 March 2016 (74 edits)
  • 86.135.109.181 - 11 February 2016 (5 edits)
  • 94.10.140.221 - 9-13 March 2016 (3 edits)
  • 2600:1001:B012:5964:0:19:1CF0:9E01 - 15 March 2016 (1 edit)
  • 2A02:C7D:362E:D900:DC5C:2485:9447:70A6 - 19 March 2016 (9 edits)
  • 213.205.252.111 - 22 March 2016 (1 edit; different ISP)
  • 80.249.56.77 - 27 March 2016 (24 edits)
  • 151.227.163.140 - 30-31 March 2016 (ongoing)

Some example edits (chosen at random): [66], [67], [68], [69], [70], [71]

MO isn't always the same for every edit (e.g., [72], [73]), but they seem to inevitably change dates even if they make changes to things like the broadcast network. They often change/update the dates on the maintenance tags as well (e.g., [74] which makes me wonder if this is a script of some sort...)

I am not sure if this edit filter request is feasible but thought it best to ask. It would be helpful in identifying sneaky vandalism of this nature in general. Ping me if you reply or have questions please.

- EvergreenFir (talk) Please {{re}} 07:04, 31 March 2016 (UTC)

@EvergreenFir: We could potentially do something like this, which would detect the changing of a year by an IP.
!("user" in user_groups) & (
  article_namespace == 0 & (
    date_change_vandalism :="(([0123456789]|present){4})";
    added_lines irlike date_change_vandalism & (
      removed_lines irlike date_change_vandalism
    )
  )
)
Omni Flames (talk) 09:56, 28 June 2016 (UTC)
@Omni Flames: wouldn't that catch a heck of a lot of false positives? Some IPs might be making good faith year updates, should these all be logged/tagged? :) -- samtar talk or stalk 10:23, 28 June 2016 (UTC)
@Samtar: It definitely would catch a massive number of false positives, I must agree. It goes without saying that this filter is going to be tag-only. One thing we could check is that the edit has no summary, as this IP never seems to use them. Thoughts? Omni Flames (talk) 10:27, 28 June 2016 (UTC)
@Samtar: We could also check the edit_delta to see if it's reasonably low, as the IP doesn't seem to make any major changes when vandalizing. Omni Flames (talk) 10:07, 29 June 2016 (UTC)
 Denied I don't think we'll be able to target this vandal in particular, but we can look into tracking date changes in general, like the request above — MusikAnimal talk 15:34, 1 July 2016 (UTC)

False Flag

  • Task: It would be used to detect the introduction/replacement of a (usually) European flag.svg into a non-European place infobox.
  • Reason: An odd vandal, quite an LTA one, does this to many articles, suddenly en masse, and it would be good if we could stop him somehow. Examples: [75][76]

- Anna Frodesiak (talk) 04:29, 4 May 2016 (UTC)

Probably could match against an IP adding .svg files/a regex match against something simple like /ag.svg/ig(seeing as most of these edits are *ag.svg)? -- samtar talk or stalk 08:30, 2 June 2016 (UTC)
@Samtar: I think a better regex would be something along the lines of \{\{Infobox[\S\s]*flag.*\.svg[\S\s]*\}\}, because many of the flags seem to follow the format of "Flag of [place].svg", and because by checking that the insertion is in an infobox, we can minimize false positives and increase performance. However, the main problem here is checking whether or not the article is on a European place, and whether or not the image is a European flag. That won't be so easy. @Anna Frodesiak: Any ideas on how to deal with this? Omni Flames (talk) 05:48, 28 June 2016 (UTC)
No ideas on how to deal with that. Maybe this lta is gone. I haven't seen him in a quite a while. Anna Frodesiak (talk) 05:52, 28 June 2016 (UTC)
Thank you for the regex Omni, much better than my suggestion! I do agree it would be neigh on impossible to check that the article's subject is about a European country (in a manner which wouldn't make the filter overly 'expensive'). I'd say this request can probably be closed for the time being if the LTA has gone off the radar, Anna Frodesiak? -- samtar talk or stalk 19:56, 28 June 2016 (UTC)
I agree. Thanks for looking into it, folks, and sorry for all the fuss. Anna Frodesiak (talk) 20:43, 28 June 2016 (UTC)

 Denied per above -- samtar talk or stalk 09:45, 3 July 2016 (UTC)

Crosses for deceased people

  • Task: Disallow insertion by anonymous and non-autoconfirmed editors of crosses (and plusses) to (wikilinked) names of deceased people. Eg turning Robin Gibb into Robin Gibb†, or perhaps Robin Gibb+
  • Reason: Against editing guidelines, but some anonymous user with changing IPs seems to have turned doing this into a hobby—or mission.
Example:
and likely this is not the first time.

- DVdm (talk) 09:43, 16 March 2016 (UTC)

I second this. Disruptive editors with dynamic IP addresses can be a real pain in the ass. -- ChamithN (talk) 12:58, 16 March 2016 (UTC)
Thirded. Peter Sam Fan 14:55, 28 April 2016 (UTC)
Testing: @DVdm: currently in testing at filter 772 -- samtar talk or stalk 20:52, 28 June 2016 (UTC)
@Samtar: Thanks! - DVdm (talk) 07:06, 29 June 2016 (UTC)
 Denied five days and no hits, it doesn't look like this is active as I thought - I'll delete the filter but keep the regex stored should we need it in the future -- samtar talk or stalk 09:48, 3 July 2016 (UTC)

Cruz Zodiac

  • Task: Block or tag mainspace edits containing both "Cruz" and "Zodiac". If possible also catch edits containing "Cruz" to articles with "Zodiac" in the title, and edits containing "Zodiac" to articles with "Cruz" in the title. It should probably include "Zodiak" as an obvious filter-evasion equivalent of "Zodiac".
  • Reason: Apparently there is a meme floating around claiming US Presidential candidate Ted Cruz is the Zodiac Killer. I'm not sure how common the problem is, but I've caught it being added to several article and disambig pages. I am unable to provide diffs because they get oversighted as severely defamatory BLP violations. For what it's worth you can see Special:Contributions/Tyarne15 with five oversighted edits to Calgary, Rafael Bienvenido Cruz, Zodiac Killer in popular culture, and Zodiac killer. A typical problem edit would be one adding "father of the Zodiac Killer" to article Rafael Bienvenido Cruz. That example demonstrates why the article title needs to be considered.
The filter can probably be removed when Ted Cruz either drops out of the Republican nomination race, when he loses the general election, or when his presidential term expires.

- Alsee (talk) 14:03, 29 February 2016 (UTC)

I second this. I've send WP:OS far too many emails about this... EvergreenFir (talk) Please {{re}} 07:11, 31 March 2016 (UTC)
@Samtar: Shouldn't this request be denied seeing as you denied the other one about the same thing? Omni Flames (talk) 08:45, 2 July 2016 (UTC)
 Denied @Omni Flames: good spot there denying this one for the same reason, as always if the issue flares up again let us know! -- samtar talk or stalk 09:50, 3 July 2016 (UTC)

Userpage spambots

  • Task: This filter will check for the characteristic behaviors that most Wikipedia spambots exhibit. Most of them involve creating a page containing a couple of sentences, followed by "my website" or "my site", which is itself followed by a spam link that is labeled (e.g. "Watch movies online free"). This is usually created at the main user page, but I've also seen it done at user talk pages. Deleted examples: User:EvelyneMain2, User:VicenteJensen, User:BettyLyjqf, User:Heidieveret, User talk:Vlolitz, User talk:Jouphabe, and other users listed at Special:BlockList blocked with the reason "spambot". Notice how nearly all of them involve two names put together, without spaces, with only the names capitalized to distinguish between them.
  • Reason: For obvious reasons, to block spambots. Most spambots exhibit this particular behavior, and an edit filter that disallows this (log only for now, of course) would help stop them.

- Gparyani (talk) 04:58, 24 August 2015 (UTC)

All but one of the pages you list were caught by Special:AbuseFilter/499 already. One was also caught by Special:AbuseFilter/466. Both of these filters are currently hidden. Disallow didn't work because of false positives. Someguy1221 (talk) 05:22, 24 August 2015 (UTC)
@Someguy1221: What happens if you change them to warn? Does that hinder the spambots in any way? Oh, and are there too many false positives that a tag can't be used? Gparyani (talk) 23:18, 24 August 2015 (UTC)
466 is set to warn and seems to deter no one. 499's false positive rate could be as high as 50%. Mr.Zbot already reports all 466 hits to AIV for administrator review. Not sure if anyone or anything is monitoring 499's hit log. Someguy1221 (talk) 23:22, 24 August 2015 (UTC)
@Someguy1221: If it's set to tag, would many users complain? Or can anything else be done about it that can reduce the false positive rate? Gparyani (talk) 23:34, 24 August 2015 (UTC)
499 is very accurate in what it's tagging, just not in identifying edits as spam. I suppose a tag that's fairly literal to what the filter actually catches would not be offensive at all. Maybe bring it up at WT:EF for more thoughts? Someguy1221 (talk) 23:46, 24 August 2015 (UTC)

 Denied, closing as stale -- samtar talk or stalk 09:53, 3 July 2016 (UTC)

Retrieved from "https://en.wikipedia.org/w/index.php?title=Wikipedia:Edit_filter/Requested/Archive_7&oldid=1138446903"