Wikipedia:Edit filter/Requested

From Wikipedia, the free encyclopedia
Jump to: navigation, search

This page is for people without the abusefilter-modify permission or people without sufficient knowledge about the coding involved to make requests to enact Abuse filters. Please add a new section at the top of current requests using the following format:

===Filter name===
*'''Task''': What is the filter supposed to do? To what pages and editors does it apply?
*'''Reason''': Why is the filter needed.
- ~~~~

Bear the following in mind:

  • Filters are applied to all edits. Therefore, problematic changes that apply to a single page are likely not suitable for an abuse filter.
  • Each filter takes time to run, making editing (and to some extent other things) slightly slower. The time is only a few milliseconds per filter, but with enough filters that adds up. When the system is near its limit, adding a new filter may require removing another filter in order to keep the system within its limits.
  • There is a limit to what filters can check for. More complex, non-essential tasks, such as those that need to perform a more in-depth check of the page or fetch information that the filter system does not have access to, are better served by separate software, run by an individual user on their own machine or dedicated server such as Tool Labs, rather than those used to actually host Wikipedia.
  • It used to be called the abuse filter for a reason. Contributors are not expected to have read all 200+ policies, guidelines and style pages. Trivial formatting mistakes and edits that at first glance look fine but go against some obscure style guideline or arbitration ruling are not suitable candidates for an abuse filter -- quite apart from performance concerns, if it doesn't harm the project, it is best not to hassle new contributors because of it.
  • To prevent the creation of pages with certain names, MediaWiki:Titleblacklist is usually a better way to handle the problem - see MediaWiki talk:Titleblacklist for details.
  • To prevent the addition of problematic external links, please make your request at the spam blacklist.

Current requests[edit]

Persistent sockpuppetry involving a name[edit]

  • Task: Disallow the creation of usernames involving variations of the words "smooth" and "aashu". If that is not possible for technical reasons, prevent IPs and new accounts from adding content involving such words.
  • Reason: Please see this SPI for reference. This indeffed user keeps recreating similar promotional accounts involving his stage name Smoothest Aashu.

- De728631 (talk) 18:41, 15 May 2015 (UTC)

@De728631: Created, log only for now at Special:AbuseFilter/690. Sam Walton (talk) 11:19, 25 May 2015 (UTC)

Changing owner field in infoboxes[edit]

  • Task: Disallow non-autoconfirmed editors from changing the |owner= field in certain infoboxes, such as {{Infobox NHL team}} (but likely useful to apply to most sports infoboxes)
  • Reason: Periodic vandalism of articles like this, this and this has been going on for years, but seems to be increasing in frequency lately, perhaps in part because media has taken to writing lazy "someone vandalized Wikipedia hyuk hyuk" articles as of late (e.g.: CSN Chicago). I have no recent examples since I don't follow many articles for other sports teams, but I have seen these types of vandal edits on baseball, basketball and football team pages in the past. I could put together a list of templates if this is doable and desirable.

- Resolute 00:08, 15 May 2015 (UTC)

Sigh... Again and again. Resolute 16:58, 15 May 2015 (UTC)
@Resolute: A list of templates to monitor would be useful. Tracking all |owner= changes will be too broad I think. Sam Walton (talk) 11:22, 25 May 2015 (UTC)

Kenny Loggins hoaxes[edit]

  • Task: Disallow a range of IPs from editing any article containing the surname Loggins, and disallow the IPs from adding Loggins to an article.
  • Reason: See Wikipedia:Long-term abuse/Kenny Loggins vandal. For a couple of weeks now, IP6s have been brought to bear on various Kenny Loggins-related pages. All of the IP6s start with 2602:306:BD7E:CAA0, so this string could be filtered along with the surname Loggins. Or a rangeblock can be set, but there will be collateral damage to others who are innocent.

- Binksternet (talk) 16:32, 10 May 2015 (UTC)

X mark.svg Not done It seems a rangeblock has been placed. Please re-request if this doesn't solve the problem. Sam Walton (talk) 11:24, 25 May 2015 (UTC)

Fixed typo[edit]

  • Task: Pick up anonymous edits that have inaccurate formulaic edit summaries like "Fixed typo", "Fixed grammar" or "Added links", often in combination.
  • Reason: We are getting one heckuva lot of them these days, often concealing petty vandalism that ClueBot NG is simply not picking up. Examples: [1] [2]

- Redrose64 (talk) 19:31, 8 May 2015 (UTC)

We already have the "canned edit summary" thing for that. --TL22 (talk) 01:01, 9 May 2015 (UTC)
I've seen that tag elsewhere, but it's not on these examples. --Redrose64 (talk) 07:44, 9 May 2015 (UTC)

shadow youtube spam[edit]

- JacktheHarry (talk) 22:21, 22 April 2015 (UTC)

Ref desk troll[edit]

  • Task: Prevent IP addresses and new accounts (not yet autoconfirmed) from blanking sections of the Ref Desk. Recommend "disallow and report" so we can quickly block accounts.
  • Reason: See Wikipedia:Sockpuppet investigations/CapriSon33333 for some background. A few weeks ago, a regular ref desk troll, who had been gone for some time, was blocked again for his trolling questions. He took exception to this, and started massive DDOS-like attacks against the Ref Desks by rapidly and repeatedly blanking large sections of them as soon as they aren't semi-protected. He has a massive sock puppet farm and apparently nothing better to do, because within minutes of being unprotected, he starts his rapid attacks which are impossible to control. We don't want the ref-desks to be indefinitely semiprotected, but that's all we've been able to do to contain him. A report at ANI caught the attention of a checkuser, who said he had a rangeblock he thought would work. Apparently, it didn't. The next step seems to be to try an edit filter. I'm not so good on the technical aspects of writing an edit filter, but this doesn't seem like too hard of a filter to code for, just prevent any removal of text from the reference desks from non-autoconfirmed accounts and IPs, and report any accounts or IP addresses that repeatedly attempt to do so. Thanks again for your prompt attention to this!

- Jayron32 21:03, 17 April 2015 (UTC)

Actually, there is also the action "block", though it is very rarely used. --TL22 (talk) 01:20, 18 April 2015 (UTC)
The abuse filter extension supports a "block" action, but that action is not presently enabled on enwiki. Dragons flight (talk) 23:14, 18 April 2015 (UTC)
I'm fine with manually blocking when it comes up, human eyes would cut down on false-positives anyways. But we need some means of shutting this guy down so we can re-open the ref-desks to IPs with legitimate questions. --Jayron32 01:24, 19 April 2015 (UTC)
Testing as filter 683. עוד מישהו Od Mishehu 18:07, 23 April 2015 (UTC)

David Beals[edit]

  • Task: Block all edits with summaries that start with "", maybe report the user, too?
  • Reason: Sockpuppets of LTA David Beals has been using this tactic to spam videos of ceiling fans.

- Ian.thomson (talk) 23:29, 16 April 2015 (UTC)

Still going. This is the sort of thing edit filters were made for, right? Ian.thomson (talk) 23:00, 28 April 2015 (UTC)
X mark.svg Not done David Beals regularly evades the edit filter. Reaper Eternal (talk) 19:17, 29 April 2015 (UTC)


  • Task: Due to an OTRS ticket, I noticed that in this edit, Template:Copyviocore was added by an anonymous user, blanking the article for six months for anyone who wanted to read it, and was not noticed by any users.
  • Reason: This filter would allow for the monitoring of the placement of this template by non-autoconfirmed users (or users who normally do not add it, maybe those with less than 1,000 edits or something) to prevent vandalism, as it could be easily used to cover over articles that vandals may not like, with no quick consequences.

- Kevin Rutherford (talk) 22:17, 13 April 2015 (UTC)

Navbox directly added[edit]

  • Task: Check whether {{navbox}} was directly added in article namespace like [3], [4], [5].
  • Reason: To replace with the correct template. It messes code for good by adding wrong categories, noinclude tags, etc.

- Magioladitis (talk) 07:52, 13 April 2015 (UTC)


  • Task: Filter should detect anonymous edits which add emoji and prevent the edits. Filter should add a tag and/or warn for similar edits from logged in users. (They could be legitimately used on talk pages.)
  • Reason: Anonymous editing on mobile devices has been turned on,[6] and we are now seeing vandalism that uses emoji.[7]

- Kaldari (talk) 00:01, 8 April 2015 (UTC)

Emoji has long lists of unicode blocks. Should all of those be checked or only some of them? (A specific list of code ranges would be useful here.) Do any of these have legitimate uses? For my part, my browser fails to render most of those symbols. Dragons flight (talk) 00:55, 8 April 2015 (UTC)
Five main ranges from emoji: U+1F300..U+1F5FF, U+1F600..U+1F64F, U+1F680..U+1F6FF, U+2600..U+26FF, U+2700..U+27BF Dragons flight (talk) 17:02, 8 April 2015 (UTC)
Testing as Special:AbuseFilter/680. Dragons flight (talk) 17:48, 8 April 2015 (UTC)
What a cute regex: [🌀-🙏🚀-🛳☀-➿] :) Kaldari (talk) 17:53, 8 April 2015 (UTC)
For me that displays as "unprintable square"-"unprintable square", "unprintable square"-"unprintable square", "sun icon"-"unprintable square". You don't happen to know what fonts actually include these things? I'm a little impressed to see 50 hits in the log during only the first 8 hours. Dragons flight (talk) 02:42, 9 April 2015 (UTC)
I've added a warning now. So far, the only edit I've noticed that might be considered legitimate was [8] where ★ was used in an album name. Dragons flight (talk) 18:55, 9 April 2015 (UTC)
I've removed ★ and ☆ which seems to be getting a number of false positives, mostly from stylized music titles in Asian languages (e.g. Japanese), but don't seem to be used for vandalism in the current sample set. Dragons flight (talk) 18:00, 13 April 2015 (UTC)

IP MOS vandalism filter - culry quotes, decapitalization[edit]

Diff examples:
Ping me if more explanation or diffs are needed. Thank you!

- EvergreenFir (talk) Please {{re}} 21:43, 4 April 2015 (UTC)

Hi EvergreenFir, do you know if this has happened with more IPs? Edit filters aren't used for enforcing the MOS but if this is a long-term issue with more than just these three IPs then I could set one up. Sam Walton (talk) 16:47, 5 April 2015 (UTC)
For future reference the filter currently in my sandbox should be able to detect the curly quote and logical quote changes. Capitals would be impossible to check as far as I know. Sam Walton (talk) 16:58, 5 April 2015 (UTC)
@Samwalton9: I found two more in the 68.98.155.* range: (talk · contribs · deleted contribs · logs · edit filter log · block user · block log) (from late 2014) and (talk · contribs · deleted contribs · logs · edit filter log · block user · block log) (currently active). They use the same "punctuative corrections" edit summary.
I honestly am not too sure how the edit filters work, so I'll take your word for it on the capitalization stuff. Their primary MO seems to be (1) "punctuative" in the edit summary and (2) the curly quotes.
I'll look in some other IP ranges under 68.98.*.* now that I learned how to get the user contribs to show IP ranges. Cheers! EvergreenFir (talk) Please {{re}} 16:32, 6 April 2015 (UTC)
Found another from April - December 2013: (talk · contribs · deleted contribs · logs · edit filter log · block user · block log) EvergreenFir (talk) Please {{re}} 16:58, 6 April 2015 (UTC)
And some more:
@Samwalton9: Thank you very much! Is there anything I should do when the filter catches them other than revert (and possible warn)? EvergreenFir (talk) Please {{re}} 20:06, 7 April 2015 (UTC)
@EvergreenFir: Not for now. I'll be keeping an eye on the filter too and after a while of having the filter in log only mode we'll see if its useful and how to proceed (perhaps disallowing the edits). Sam Walton (talk) 20:34, 7 April 2015 (UTC)
@Samwalton9: Sounds great! Thank you! EvergreenFir (talk) Please {{re}} 20:36, 7 April 2015 (UTC)

Draft being moved to mainspace before review[edit]

  • Task: This filter should be able to detect whether an editor attempts to move a draft before review (technically, before the draft has been sumbitted for review (not counting declined reviews) or if the draft has been moved by the draft creator) and warn the moving editor with a friendly notice (since people who do that tend to not know how drafts work and are doing it in good faith).
  • Reason: People who create drafts tend to move their drafts to the mainspace before sumbitting them for review, which can be bad because the article can have some problems that could normally be detected by a draft reviewer, and can lead it to a(n) PROD/CSD/AFD tag on the article.

- TL22 (talk) 18:20, 27 March 2015 (UTC)

Since I'm not receiving any response; User:Samwalton9? --TL22 (talk) 23:53, 13 April 2015 (UTC)

Removing Template:Dead link[edit]

  • Task: Mark removal of {{dead link}}, as well as the removal of all templates that redirect to it. Just tag; don't warn or prevent the user from making the edit
  • Reason: See WP:AN#SEO spam attack. We've discovered people whose idea of spamming is to remove broken links and replace them with spam. There's no way to track when comparatively new accounts do this on the most random articles (e.g. Special:Contributions/Tomofm2 did this at Eyepiece, Excise tax in the United States, Camp Tarawa, and Kona Pacific Public Charter School, all with deceptive edit summaries), so it would be easiest if we could just look through a log of all actions in which dead links were removed. Of course, a lot of these URL replacements (most, perhaps?) will be valid; that's why we just need to tag them, so that a human can look through them. - Nyttend (talk) 20:53, 5 December 2014 (UTC) PS, are there any bots that remove these links? If so, the filter might be instructed to exclude edits by flagged bots, since they're not going to be spamming. Nyttend (talk) 21:50, 5 December 2014 (UTC)
An additional flag might be the inclusion of 'dead link' in the edit summary. User Tomofm2 wrote it in one and the newly noticed user Divine4778 also wrote it in some of their edit summaries. Sam Walton (talk) 17:58, 9 December 2014 (UTC)
Would it also be possible to track changes to the url that precedes a {{dead link}} template? If we start monitoring the use of this template the SEO people might just leave it in the articles and replace the broken links anyway. So a possible marker should also detect changes to links that have been flagged with [dead link]. De728631 (talk) 01:00, 10 December 2014 (UTC)
If we detect "dead link" in removed_lines and completely ignore whether it occurs in added_lines, it will accomplish that. Jackmcbarn (talk) 05:45, 28 December 2014 (UTC)
See the recently created WP:DEADLINKSPAM for an overview. Sam Walton (talk) 16:52, 24 December 2014 (UTC)

Redirects to badimages[edit]

To deal with socks of 1abacada (talk · contribs) who have discovered that they can redirect pages to files on the bad images list, a filter is needed to prevent this, at least for autoconfirmed users (though I can't see a reason for anyone short of an admin to do this). Acroterion (talk) 02:51, 4 May 2014 (UTC)

@Acroterion: I've created a filter definition that will stop this behavior and emailed it to you. To enable it here, first add yourself to the abusefilter group at Special:UserRights/Acroterion. Then, go to Special:AbuseFilter/import, paste it, click "Import data", then click "Save filter". Jackmcbarn (talk) 00:50, 13 May 2014 (UTC)
Acroterion did this filer get set up? Sam Walton (talk) 21:57, 21 January 2015 (UTC)
Not that I'm aware of: I don't have the technical expertise to review it, and since I'd b e responsible for its effects, I didn't make myself an abuse filter editor, etc. Acroterion (talk) 21:54, 24 January 2015 (UTC)

Replacing text with repeating characters vandalism[edit]

  • Task: To disallow editors that not only add repeating characters to an article but also remove content.
  • Reason: I did a check on the recent changes page that all of the most recent edits that remove content under the "repeating characters" tag filter are vandalism.

- Minima© (talk) 22:06, 17 February 2014 (UTC)

John Galea[edit]

  • Task: Prevent creation of pages using the text of the deleted page John Galea. I'd suggest filtering on anything containing the name "John Galea" (although he's not been averse to mis-spelling his own name in order to get around create protection).
  • Reason: The page has been repeatedly recreated under multiple alternate titles by a veritable army of socks. Salting and rangeblocking are not effective measures against this user.

- Yunshui  15:19, 17 February 2014 (UTC)

Yunshui, could you list some of the other article titles? And do you know if this is still an issue? Sam Walton (talk) 00:03, 17 January 2015 (UTC)
@Samwalton9: Sure - some of the other titles were: John Galea (Singer), John Galea (singer), John- Paul Galea, John Galea!, John Galea (musican), John_Galeaa, John Galeea, John Galea (Paul), Do it my way, (Singer) John Galea, John Galea (performer), John Galea ( the musican ), J.Galea, John Galea (artist)... Not an exhaustive list by any means, but it gives you an idea of the problem. He was still apparently socking as recently as last week (albeit after a hiatus of several months), so I'd say the problem is still ongoing. Thanks for taking a look. Yunshui  10:12, 5 February 2015 (UTC)


@Sjones23: I imagine the reason for this filter having not been made yet is the lack of anything obvious to search for. Can you suggest anything we could search for in edits that would pinpoint this user? Perhaps something relatively unique they tend to write in edit summaries or edits. Sam Walton (talk) 20:36, 8 April 2015 (UTC)
Well, I'll see what can be done about it. Lord Sjones23 (talk - contributions) 20:53, 8 April 2015 (UTC)

Joshua Hawkins fakearticling[edit]

  • Task: Block edits from adding "Joshua Hawkins"/"Josh Hawkins"+"Motorsports" or "Joshua Hawkins"/"Josh Hawkins"+"MedIevil"/"Medievil" or "Joshua Hawkins"/"Josh Hawkins"+"IndyCar"
  • Reason: This is a serial sockmaster; see Category:Wikipedia sockpuppets of MrJoshThehawk. All of these accounts are "throwaways" that appear, create a user talk page with a WP:HOAX/WP:FAKEARTICLE team chart for NASCAR or, in one case, IndyCar that has "Joshua Hawkins Motorsports" with "Josh Hawkins" as a star driver (and before it was salted creating a hoax bio at Joshua Hawkins with articlespace links to same), and then vanish before, a month or two later, popping up under a new account to do the exact same thing. Given the serial nature here blocks are useless; therefore I believe an edit filter is appropriate for putting a stop to this the next time they try. - The Bushranger One ping only 11:35, 1 October 2013 (UTC)
@The Bushranger: If this is still happening, remove the stale tag. PhantomTech (talk) 06:06, 20 March 2015 (UTC)

Inexperienced users removing amboxes[edit]

  • Task: Sometimes, inexperienced users try to remove article maintenance tags (amboxes) from articles. Every time an IP or unconfirmed user removes a {{notability}}, {{news release}}, or {{COI}} ambox from any article, please tag the edit.
  • Reason: This filter will help us to notice edits such as these.[22][23][24][25][26][27][28][29][30][31][32][33][34][35][36][37] It's happened many times on Wikipedia that COI users have wrongly removed such amboxes. Often, they use a blank edit summary, making the damage hard to catch. Tagging the edits will make it easier for us to notice and undo the damage.

(Dear Wikipedians: Please freely edit and improve this filter request.)

Thank you. —Unforgettableid (talk) 00:43, 18 September 2013 (UTC)

Not done. Detecting each and every tag that gets removed would put a severe strain on the server resources. Reaper Eternal (talk) 13:13, 16 November 2013 (UTC)
I thank you for your reply.
  1. OK, we could watch only for the removal of {{notability}} (perhaps the most important ambox) and ignore all other ambox removals.
  2. Let me suggest some non-obvious optimizations (besides the obvious "look at user groups first"). For one thing, we could only look at edits where edit_delta is between -10 and -100. This is an imperfect heuristic, but would save time. Next, we could look only at edits where the edit summary is blank: if there's an edit summary, then this is probably either a section edit or some other non-tag-removal edit. Okay; by now we've already eliminated a huge proportion of edits. Next, we could look at the first byte of either old_wikitext or removed_lines: if it's not '{', we can stop now. Finally, we could search through the contents of removed_lines. We could use contains "otability": a literal search is probably faster than a glob or regexp search. Would such a filter still be too CPU-intensive? And if so: which condition would be the biggest problem?
  3. This filter is non-crucial and non-private. If the client has JavaScript on, we could theoretically design the infrastructure to offload all non-crucial, non-private filtering work to the client; if the client has JavaScript off, we could just skip those filters.
Unforgettableid (talk) 07:53, 27 November 2013 (UTC)

Page deleted, then identically-named page created[edit]

  • Task: Say a page has been deleted, then a non-sysop with an editcount under 5,000 later creates another page with the same title. If this happens, please silently tag the page-creating edit with a tag. The tag should say that a page with that name has already been deleted X number of times.
  • Reason: This will help Wikipedians to more easily notice when a formerly-deleted page has been recreated. This will help make it more obvious to them when they should nominate "new" pages for deletion. It will also make it more obvious when a page title should be SALTed.

Thank you, —Unforgettableid (talk) 08:38, 30 August 2013 (UTC)

Unless I'm mistaken, the edit filter can't see the deletion log for a page being edited, so this isn't technically possible. A bot would be better for this. Jackmcbarn (talk) 13:51, 30 August 2013 (UTC)
Thank you for your reply. AnomieBOT (talk · contribs) runs a task called NewArticleAFDTagger, which tags recreated AfD-deleted pages with {{old AfD multi}}. AFAIK there is no bot which tags recreated PROD-deleted pages or recreated speedily-deleted pages. Where is the best place for me to request that someone provide that functionality? (In vaguely-related news: bugzilla:10331, which requests a page-creation log, is still unfixed despite five years and one patch.) Cheers, —Unforgettableid (talk) 06:03, 2 September 2013 (UTC)
That would be Wikipedia:Bot requests. Jackmcbarn (talk) 16:37, 3 September 2013 (UTC)
OK, thank you. So it's best that I go there instead of contacting User:Anomie directly? —Unforgettableid (talk) 19:14, 4 September 2013 (UTC)
Can do both. Wifione Message 19:34, 4 September 2013 (UTC)
I requested a {{old prod full}} tagger bot at Wikipedia:Bot requests/Archive 57#Bot to tag "PROD Survivors" and "Recreated Articles", and put a {{talkback}} template at User talk:AnomieBOT, but (despite one empty promise I got) nobody coded anything. Many have thought about writing such a bot, but nobody has ever written a practical one; I explained the matter further in my request there. I didn't create a bot request to tag recreations of CSD-deleted pages, but someone else is welcome to do so if they like. —Unforgettableid (talk) 07:53, 27 November 2013 (UTC)
Hmm, I just had an idea for how this can be implemented:

(action = "delete") | (action = "edit" & old_size = 0)

with a per-page throttle.
However whether this might be worth it or better suited for a bot is another question. Triplestop (talk) 03:53, 21 September 2013 (UTC)
That's an interesting solution. I hadn't thought of using the rate limiter like that. It looks like it would work, but it seems a bit hacky and would have a few FPs and oddities, such as tagging the deletion of a newly-created page, and tagging undoing of page blanking. Jackmcbarn (talk) 12:45, 21 September 2013 (UTC)
User:ThePhantomBot is currently logging this type of behavior and I plan to make it do more than that after it has been approved. PhantomTech (talk) 06:47, 25 March 2015 (UTC)

Plot summary copyvios[edit]

  • This could be narrowed down to large edit_deltas of non-autoconfirmed editors to plot/synopsis sections, and as such I can see some merit to the proposal. Sam Walton (talk) 15:21, 18 January 2015 (UTC)
  • @MER-C: Would you mind taking a look through the past few days of diffs to see if sufficient numbers are copyvios for this filter to be worth it? Sam Walton (talk) 17:22, 22 January 2015 (UTC)
  • I had a look and found nothing. However, you've set the size threshold too high -- my experience is that the copyvio plot summaries are usually only one paragraph (3-7 lines) long. I've changed it to 400 bytes. You are also missing the very important scenario when a plot section is added without there being an existing section and an edit summary -- you'll want to search for the addition of a level 2 header like [Pp]lot|[Ss]ynopsis as the trigger. MER-C 12:04, 23 January 2015 (UTC)
  • That's fair, and yes I hadn't thought of that, added a flag for that too. Sam Walton (talk) 20:03, 23 January 2015 (UTC)
  • Disabled for now because I've run out of ideas on how to narrow this. Plot/synopsis/summary is far too vague a search term to be useful. Sam Walton (talk) 19:54, 28 January 2015 (UTC)
MusikAnimal has improved the filter a bit so we'll see how it goes. Narrowed to adding a new section rather than checking for any largeish plot/summary edit to existing ones. Sam Walton (talk) 19:20, 7 April 2015 (UTC)

Lions at Cat Creek[edit]

  • Task: This filter would disallow all edits that add the words "Lion"/"Lions"+"Cat Creek" to any article, and disallowing any addition of the word "lion" that is not "mountain lion" to Cat Creek, Montana. Disallowing edit summaries including "ROOOOOAAARR" in varying levels of capitalisation and number of letters would also be good but might be more difficult.
  • Reason: The saga can be seen at Wikipedia:Sockpuppet investigations/Catcreekcitycouncil/Archive. Basically, it appears some students at a California high school (as this article is also a target of different vandalism by the same group of socks) are determined to add the fact "there are lions in Cat Creek, Montana" to the article of the community in question. They were engaged, claimed one book 'of which only a few copies exist' was their source (and that all American naturalists were wrong, and that no, it wasn't the archaric useage of "lion" for "mountain lion"), and it finally resulted in a massive sockfarm being unearthed and the article full-protected...and over the last year has seen the article full-protected several times again as these trolls repeatedly game the system for autoconfirmation. The final straw came today, when, with the Cat Creek article locked, they started adding the "there are lions in Cat Creek, Montana" 'fact' to several other articles. Given this behavior it's clear that an edit filter is needed to curb this particular group of sockvandtrolls. - The Bushranger One ping only 08:50, 11 February 2013 (UTC)
  • @King of Hearts: @Reaper Eternal: They're back, and once again gaming the system to get around semiprotection. The edit filter really is needed unless we're going to permamently lock down every article related to lions, Montana, or "cat creek". - The Bushranger One ping only 22:28, 12 May 2014 (UTC)
@The Bushranger: Are they still active? PhantomTech (talk) 06:06, 20 March 2015 (UTC)
@PhantomTech: I've seen a few socks of this user recently, but not as many as in the past. Ping me if you need me to reply EvergreenFir (talk) Please {{re}} 21:26, 23 April 2015 (UTC)

Language speaker data[edit]

  • Task: Filter the 'speakers' parameter of {{Infobox language}} for changes, similarly to how changes to height and weight in bio boxes are tagged. (If possible, filter 'date' and 'ref' under the same tag: these are all elements of the population figure.) Should apply to editors without advanced permissions.
  • Reason: Population inflation is a chronic problem with our language articles, and isn't easy to detect if you don't see it happen. Although this wouldn't catch changes to the text, vandals and POV warriors normally change the info box as well. This isn't just a problem with IPs, but often with signed-in POV editors. The date may be changed to make the data look recent. If 'date' and 'ref' can be covered without increasing server load significantly, please include them; otherwise 'speakers' is the main problem.

kwami (talk) 00:28, 2 November 2012 (UTC)

XSS Filter detect[edit]

  • Task: Block Internet Explorer 8+ users from saving edits that triggered the XSS Filter (Bug 32013). The XSS Filter transforms periods, bracket, and parentheses to the Number sign. One simple implementation might be ##[^{|}<\n>[\];:*]{5,255}?##
  • Reason: Because IE is extremely sneaky doing this after show change displays everything correctly and devs refuse to send the header to stop the filter. We've had many complaints about this.

Dispenser 06:11, 27 August 2012 (UTC)

Dispenser, do you know if this is still an issue? Sam Walton (talk) 09:07, 19 January 2015 (UTC)
Yes, its still an issue 29 months later. This will continue as computers running Internet Explorer 7/8 (End of Life 12 Jan 2016) and have commendable market share. Windows XP has an 18% market share or 1 out of every 6 computers and the highest version of Internet Explorer is 8. Of course WMF could increase interoperability, but they're too distracted by the Web Design Hipsters. — Dispenser 19:52, 19 January 2015 (UTC)
You could match lines removed with \[\[([a-z ]{1,50}\|)?[a-z ]{1,25}]] and lines added with ##([a-z ]{1,50}\|)?[a-z ]{1,25}## to identify the changing links. PhantomTech (talk) 07:33, 21 March 2015 (UTC)

Russian Beatles copyvio[edit]

  • Task:A highly dynamic IP and an occasional named sock account (FreedomRome (talk · contribs) is the latest sock of the master Crazy1980 (talk · contribs)) has been plaguing the OTRS noticeboard and other pages with spurious statements of permission to upload Beatles songs or to link to a Russian copyright-violating host. Typically includes a link to, which I'd rather not have blacklisted the usual way, and statements like "Team of the volunteers of the British Council gives the permission to use these materials", "The Beatles for Cultural Diversity" and all IPs are from Russian ranges. See [40], [41], [42], [43], [44] and so on.
  • Reason: Obviously Apple Records, Paul McCartney, Ringo Starr and the estates of George Harrison and John Lennon will disagree with the idea that somebody at the British Council has given permission to Russians to upload Beatles songs to WP or to link to Russian copyvio sites, and given the incredible persistence of this user, a filter might be helpful - it's been going on for months. No actual uploads that I know of, but the spurious permissions are becoming tiresome. I believe the copyvio host has long since been blacklisted.

- Acroterion (talk) 01:58, 31 May 2012 (UTC)

@Acroterion: Is this still needed? — This, that and the other (talk) 12:58, 18 July 2013 (UTC)
I haven't seen any activity of this kind in the past few months, so I'd let it drop unless they start up again. Acroterion (talk) 13:35, 18 July 2013 (UTC)
Update: they're back, Russian IPs on Jimbo's talkpage, so I'd like to pursue this again. See [45], [46] and [47] and User:Music1245's contributions. Acroterion (talk) 00:43, 15 August 2013 (UTC)
@Acroterion: Marking stale, if the vandal is still active remove the tag. PhantomTech (talk) 06:06, 20 March 2015 (UTC)

This is not a talk page. Please add new requests at the top of this section, not here at the bottom. Thank you!

Completed requests[edit]

Ankur Mazumder filters[edit]

  • Task: This filter should be able to catch the prolific sockpuppeteer Ankur Mazumder (talk · contribs) who persistently creates autobiographies about himself (example of such a page) in both userpages of his socks (usually) and in the article space (not as often; deleted examples Ankur Mazumder,, and Computer Field Of Ankur). In addition, another filter should be added to detect additions of his mention into articles like Hooghly Collegiate School by IP socks of this sockmaster.
  • Reason: Adding these filters and setting them up to just log such actions would greatly assist us in finding and blocking socks of this user. Currently, one needs to do a lot of searching to come across socks, and in some cases it may take long before the sock is discovered.

- Gparyani (talk) 05:07, 18 March 2015 (UTC)

@Gparyani: Are all pages exactly the same? If not could you provide a few more samples so I can find similarities, I'm not an admin so I can't see the deleted pages. PhantomTech (talk) 22:49, 20 March 2015 (UTC)
@PhantomTech: Unfortunately, most of the pages he's created have been deleted. However, there may be another one laying around in old revisions of the userpages of the sockpuppets. It would be great if an admin could see this request. Gparyani (talk) 23:17, 20 March 2015 (UTC)
I've pasted some deleted userpages here: User:Anna Frodesiak/Blue sandbox. They are the last few socks and the original master userpage. Anna Frodesiak (talk) 23:33, 20 March 2015 (UTC)
Thanks, ThePhantomBot is being setup to detect the page creations and will begin logging them in the next few days, whenever it is running. PhantomTech (talk) 00:07, 21 March 2015 (UTC)
What about the other part? Did you read my last sentence in the task section? Gparyani (talk) 00:13, 21 March 2015 (UTC)
I missed the last part but I'll add that too. PhantomTech (talk) 00:40, 21 March 2015 (UTC)
@PhantomTech: As an edit filter, or to your bot? Gparyani (talk) 00:46, 21 March 2015 (UTC)
@Gparyani: To the bot, I don't have the permission for edit filters and I'm not sure that this is frequent enough to have an edit filter made. PhantomTech (talk) 00:58, 21 March 2015 (UTC)
Created at Special:AbuseFilter/673 as log only for now. Sam Walton (talk) 21:46, 29 March 2015 (UTC)
@Samwalton9: You may also want it to check for userpage creations, which is more important. Gparyani (talk) 02:50, 3 April 2015 (UTC)
Wasn't aware, thanks, now checking user space too. Sam Walton (talk) 09:06, 4 April 2015 (UTC)
Yes check.svg Done Seems to be working fine so I've switched it to disallow the edits. Editors who attempt to make the edits should still be double checked. Sam Walton (talk) 22:20, 18 May 2015 (UTC)

"<User X> IS A PROSTITUTE" sockpuppets[edit]

  • Task: Disallow creation of accounts containing the string "IS A PROSTITUTE" in their usernames
  • Reason: See Wikipedia:Sockpuppet investigations/Gabucho181. This user has created 4 accounts with this string; 3 pointed at me and 1 pointed at User:Geraldo Perez. This could be added to the GP disruption filter if you wish.

- TL22 (talk) 18:31, 17 May 2015 (UTC)

Make that 9, 6 pointed at me, 1 at User:Geraldo Perez, another one at User:EvergreenFir and another one at User:Joseph2302. --TL22 (talk) 22:54, 17 May 2015 (UTC)
Already done by Callanecc. See the SPI I linked above. Self-closing request. --TL22 (talk) 10:41, 18 May 2015 (UTC)

Long term abuse case[edit]

Black Kite (talk) 10:45, 14 February 2015 (UTC)

Log only for now at Special:AbuseFilter/663. Sam Walton (talk) 11:37, 14 February 2015 (UTC)
Altered to only check for additions, other flagged edits seem to be correct. Give it another week. Sam Walton (talk) 13:28, 14 March 2015 (UTC)
@Black Kite: Can you check whether edits made since 14 March are all indicative of this user and are disruptive enough for the filter to be set to disallow? Or is log only sufficient? Sam Walton (talk) 00:14, 21 March 2015 (UTC)
@Samwalton9:; as far as I can see every one of those is abuse and very typical of the IP editor (works in bursts, targets particular articles). I would set the filter to disallow as it seems to be working properly. Black Kite (talk) 21:48, 7 April 2015 (UTC)
@Black Kite and Binksternet: I'll consolidate the conversation here but note that Binksternet has provided a great analysis of the hits thus far at User talk:Binksternet#Edit filter. Given the feedback from you both I think it's definitely a good idea to switch to disallow. As for the edits we missed, I'm not sure I'm confident enough to broaden the filter by much. We're already covering a large number of IPs and I worry that including more common words like house and disco will throw up false positives, which we really want to avoid when disallowing. As long as we're disallowing some edits and able to catch the IPs for reverting missed edits and/or blocking then I think this filter is working well. Per the directions at the LTA page I've set this filter to report IPs to AIV. Sam Walton (talk) 22:04, 7 April 2015 (UTC)
I agree that trying to enact "disallow" from words such as house and disco will rack up too many false positives. At the same time, I would like to see a "no action" filter logging any edits from those IP ranges if there is the word techno in the article. Can we have two filters, a narrow one set to disallow techno additions and a wider one set for only logging? Binksternet (talk) 00:13, 8 April 2015 (UTC)
  • @Samwalton9:,@MusikAnimal:; any reason why the filter has been set back to log-only? I only noticed it had been tripped today because Z-Bot flagged it up. Black Kite (talk) 13:46, 20 April 2015 (UTC)
I did some tweaking and wanted to make sure it worked as intended first. I see that we've got an accurate hit on 19 April, so I've set it back to disallow. Best MusikAnimal talk 14:50, 20 April 2015 (UTC)
OK, thanks! Black Kite (talk) 10:40, 2 May 2015 (UTC)

Brian Thompson vandal[edit]

  • Task: Prevent a set of names being added to articles
  • Reason: There is an IP vandal (usually on a blackberry address) who keeps changing CEOs on various articles to...
    • Brian T. Thompson
    • Brian Touche Thompson
    • Brian Toussaint Thompson
    • Brian Thompson Vice Chairman
    • Brian To us saint Thompson
  • It was brought to my attention by User:Bahooka at AIV (but there are others watching out for him) - see also User_talk:Bahooka#Rangeblock. I did find the following item - User_talk:NawlinWiki/Archive_89#.22Brian_T._Thompson.22_vandal - but it does not seem to have resulted in any edit filter (or if it did, it's not working).

- Ronhjones  (Talk) 20:35, 4 March 2015 (UTC)

@Ronhjones: User:ThePhantomBot has been setup to detect this user. Currently this report is linked to as the evidence of long term abuse, is there an LTA case? PhantomTech (talk) 00:46, 26 March 2015 (UTC)
@PhantomTech: No idea. I arrived rather late on the scene - I suspect User:Bahooka could give you more information Ronhjones  (Talk) 20:54, 26 March 2015 (UTC)
@Ronhjones: Created log only for now at Special:AbuseFilter/674. Will probably need some tweaking with the range of middle names used. Sam Walton (talk) 22:05, 29 March 2015 (UTC)
@Ronhjones: Besides a brief period of false flags (I made a bad change and didn't notice for a few hours), the filter seems to be working well. What do you think would be the best thing to do now, disallow edits entirely or report to AIV? Sam Walton (talk) 09:09, 4 April 2015 (UTC)
@Samwalton9: It's a dynamic IP, he'll keep switching addresses - just disallow edits, I think Ronhjones  (Talk) 14:57, 5 April 2015 (UTC)
Alrighty, Yes check.svg Done. Lets see how that goes, please help me keep an eye on IPs caught in the log in case any edits slip through. Sam Walton (talk) 15:00, 5 April 2015 (UTC)

Aas Mohamad Ali Khan Abbasi[edit]

  • Task: Find variants of a name and log. Userspace, new articles that get quickly deleted, existing articles.
  • Reason: User creating many socks: User:Anna Frodesiak/Orange sandbox. He drops his name either as a username, userpage content at a userpage (often an unrelated username), in fake or promo articles, and sometimes as a minor cast member in bollywood articles. An idea of the variants can be seen in the Orange sandbox. Many thanks for your consideration. Anna Frodesiak (talk) 11:18, 21 February 2015 (UTC)
I can probably find all with searches, so feel free to decline this one. Anna Frodesiak (talk) 11:24, 21 February 2015 (UTC)
@Anna Frodesiak: are you sure? This wouldn't be too hard a filter to set up. Sam Walton (talk) 20:08, 25 February 2015 (UTC)
Hi, Sam! :) Do you mean a few minutes of effort? Would it make the servers glow orange and catch fire or even slow things down a teensy bit? If yes and no, then yes please. :) Anna Frodesiak (talk) 20:12, 25 February 2015 (UTC)
Well, I was going to say that there would be no fire in sight, but given that I just created the filter at Special:AbuseFilter/666 I can't make any promises. Log only for now! Sam Walton (talk) 23:09, 1 March 2015 (UTC)
Yes check.svg Done Working fine. Sam Walton (talk) 13:18, 14 March 2015 (UTC)

Denied requests[edit]


  • Task: Filter redirects to pages like Mental retardation.
  • Reason: Very likely an attack page.

- FrankDev (talk) 02:41, 16 January 2013 (UTC)

Hmm, I think this could be a good filter, but could cover more than just this term. I'd propose writing up a list of pages that would be offensive if redirected to and go from there. Sam Walton (talk) 19:23, 22 January 2015 (UTC)
Not sure how useful this is going to be but trialling at Special:AbuseFilter/679. Sam Walton (talk) 22:47, 7 April 2015 (UTC)
Not very useful apparently, so X mark.svg Not done. Sam Walton (talk) 21:57, 18 May 2015 (UTC)

Import filter from test wiki[edit]

  • Task: Tag all removal of references by editors who aren't autoconfirmed and have less than 10 edits.
  • Reason: Already seen this problem categorized with general vandalism, this is more specific. Often removal of references are done in good faith, so applying a different tag would subject it to a different kind of verification of authenticity. It would prevent majority of the good faith ref removal from being rapidly rollbacked by editors who do quick patrolling. Link at TestWiki EthicallyYours! 17:39, 28 February 2015 (UTC)
@Ethically Yours: This seems like a sensible filter, can I ask what the use of "& (action == 'edit')" is? It seems redundant since- the user has to edit to remove lines, but I'm relatively new to edit filters so I could be mistaken. Sam Walton (talk) 23:19, 1 March 2015 (UTC)
It doesn't really hold much significance. I was testing in my own usual way, so typed in that. EthicallyYours! 07:46, 2 March 2015 (UTC)
@Ethically Yours: Created at Special:AbuseFilter/670, log only for now. Sam Walton (talk) 13:25, 14 March 2015 (UTC)
@Samwalton9: It seems to have gathered 650+ hits, so it's working good. Just asking, but on your discretion, wouldn't it have been better to tag such edits? EthicallyYours! 06:08, 15 March 2015 (UTC)
@Ethically Yours: From what I understand, all new edit filters are ran log only to check for issues. PhantomTech (talk) 19:07, 15 March 2015 (UTC)
Indeed. And so far I'm not convinced this is a filter worth continuing. A large number of edits are general edits by unconfirmed users, many uncontroversial, and many of the vandalism edits flagged by the filter were flagged by other filters (like general vandalism or BLP issues). Sam Walton (talk) 00:07, 16 March 2015 (UTC)
@Ethically Yours: I don't have much time at the moment for this, but could you take a look through a good chunk of the filter log to see if the filter is worth it? That would be saying that more than 50% or so of edits are vandalism that isn't caught by Cluebot or another vandalism filter. Thanks, Sam Walton (talk) 15:30, 17 March 2015 (UTC)


Some random samples: 1, 2, 3, 4. If you need more samples ping me. EthicallyYours! 16:06, 17 March 2015 (UTC)
I think this is far too broad. The vandalism rate in the caught edits is comparatively small and the number of edits caught is huge. As such I don't think this is a useful filter, but I'm going to get some other opinions or see if we could narrow it. Sam Walton (talk) 17:47, 7 April 2015 (UTC)
As it turns out we have the much more useful Special:AbuseFilter/636. I think 670 would be an unnecessary duplication of efforts; the reference removals with an edit summary are less likely to be vandalism and it catches far too many edits to be useful. Sam Walton (talk) 17:53, 7 April 2015 (UTC)

DOI Citations[edit]

  • Task: Tag when the doi= paramater changes in Templates {{Cite journal}} and {{Cite doi}} in the main namespace.
  • Reason: As part of a reimplementing User:Citation bot, for Sginalling Open Access Project, whenever an Open Access reference is cited, we want to import the article to Wikisource, and give the Citation a special badge. Right now that is done by polling these templates for changes, so the reaction time is about 30-60 minutes. With this tag, we could make it happen almost instantly.

- Maximilianklein (talk) 19:20, 17 June 2014 (UTC)

Maximilianklein is this still needed? If so I'll look into making a filter. Sam Walton (talk) 20:10, 23 January 2015 (UTC)
Given the lack of response despite a ping and a talkback I'm marking this X mark.svg Not done. Sam Walton (talk) 22:18, 7 April 2015 (UTC)

Twin City vandalism[edit]

  • Task: The filter should identify all edits by anonymous users form certain IP ranges in the main name space where the edit summary contains "Twin cities", "Sister cities" and the like. Eventually, I'd like these kinds of edits to be forbidden, but for starters, logging them would be OK. The most recently active IP ranges were, and, for a full list see the documentation page below. FYI: A similar filter is in place in the German wikipedia as well as the French (private) and Italian ones.
  • Reason: See documentation page: meta:user:Controlling/Twin City Vandal.

Thanks, - Controlling (talk) 16:30, 31 May 2014 (UTC)

Has this been a problem on English Wikipedia? עוד מישהו Od Mishehu 07:31, 3 September 2014 (UTC)
Yes, for examples the the contribs of this IP or this one or see my edits, which are almost exclusively rollbacks of this sort of vandalism. --Null Drei Nullformerly Controllingtalk 14:15, 3 September 2014 (UTC)
I checked it with my test filter; not one hit since I did it - and the current version dates back to Sep. 4th. עוד מישהו Od Mishehu 12:40, 7 September 2014 (UTC)
First, thanks for your help. While the vandalism has been quite persistent, it's not a daily occurrence and it has indeed become less frequent recently. Again, see my edits for an estimate on the frequency ('though I probably don't catch all of them). If that's not enough for an edit filter, then I guess I'll have to keep trying to ctach it manually. --Null Drei Nullformerly Controllingtalk 15:53, 7 September 2014 (UTC)
X mark.svg Not done per the above. Sam Walton (talk) 13:31, 2 April 2015 (UTC)

Deny posting of "anonymous philippines"[edit]

Stale: Sockmaster changed behavior, filter no longer useful. PhantomTech (talk) 20:54, 20 March 2015 (UTC)
  • See [48] (admin only unless you beat the delete) for today's example. Edit summary was "screw Wikipedia long live anonymous Philippines". CrowCaw 19:12, 30 November 2014 (UTC)
CambridgeBayWeather, Crow, is this still an issue? I'll look into creating a filter if so. Sam Walton (talk) 12:19, 18 January 2015 (UTC)
I don't think so but I can't be sure. CambridgeBayWeather, Uqaqtuq (talk), Sunasuttuq 12:42, 18 January 2015 (UTC)
  • Not at this time, though the sockmaster is still active. He's currently back to his original M.O. of posting questionable organized crime articles. CrowCaw 16:15, 18 January 2015 (UTC)