Viewing filter 860: Ryan Ross vandalism

Filter parameters

Filter ID:	860
Description: (publicly viewable)
Filter hits:	3,834 hits
Conditions: (documentation)	!("confirmed" in user_groups) & (page_namespace == 0 \| page_id == 1299860) & ( match_words := "RYANROS\|BRENDONURIE\|RYDENISREAL\|BRENDONANDRYAN\|RYANANDBRENDAN\|RYANWASKNELINGIN\|WHENRYANHESIT"; norm(added_lines) rlike match_words & !(norm(removed_lines) irlike match_words) & !(old_wikitext contains "Panic! at the Disco") ) !("confirmed" in user_groups) & (page_namespace == 0 \| page_id == 1299860) & ( match_words := "RYANROS\|BRENDONURIE\|RYDENISREAL\|BRENDONANDRYAN\|RYANANDBRENDAN\|RYANWASKNELINGIN\|WHENRYANHESIT"; norm(added_lines) rlike match_words & !(norm(removed_lines) irlike match_words) & !(old_wikitext contains "Panic! at the Disco") )
Notes:	Persistent vandalism targeted against many different article by IP's and newly registered VOA's. Set to disallow 2017-06-18T14:15 following monitoring period. Warning-only has not sufficiently dissuaded vandals. -Xaosflux -Pattern updated for CamelCase - Xaos * Adding "Brendon Urie" to edit filter, as these both involve the same mass attack and are part of this type of vandalism. Considering adding "Ryden" as well, but I'm afraid that might generate false positives. I'll consider it. -Oshwah Performance tweaks / cleanup. Also remove warning since this is disallow (shouldn't tell them they can hit Save again) ~MA :Renabled warn, due to high volume we are identifying VOA accounts with this, if they stop after a single warning they are getting a pass-see EFN discussion - X ::Changing back to disallow only, calmed down a little bit -X -Updated pattern for repeated letters 05JUL2017 - X There's some social media interest in this filter/vandalism, so given DatBot is now reporting it to AIV I've changed the name to something a tiny bit less obvious --TNT 6/7/17 Add a string that's a hashtag for this, that's been added to Ryden and others. -Crow 8/2/17 Temporarily also checking [[Talk:Cheez Whiz]] ~MA Doesn't need to be private ~MA Check for "Panic!" (Brendon Urie is a member) in old_wikitext per [[Special:Permalink/868264437#202.80.213.225]] ~MA Lowering to tag-only - catching a decent bit of vandalism but far too many false positives. Special:AbuseLog/22831634, Special:AbuseLog/22839931, Special:AbuseLog/22959222, Special:AbuseLog/22699713 etc. -Galo 2019.01.21 Disable; last true positive was on 26 August. --Suffusion of Yellow 02:54 22 Oct 2022
Flags:	Hide details of this filter from public view Enable this filter Enable the use of [https://www.mediawiki.org/wiki/Special:MyLanguage/Extension:AbuseFilter/Rules_format#Protected_variables protected variables] in this filter Mark as deleted
Filter last modified:	02:54, 22 October 2022 by Suffusion of Yellow (talk \| contribs)
History:	View this filter's history
Tools:	Export this filter to another wiki {"data":{"rules":"!(\"confirmed\" in user_groups) \u0026\r\n(page_namespace == 0 \| page_id == 1299860) \u0026 (\r\n match_words := \"RYANROS\|BRENDONURIE\|RYDENISREAL\|BRENDONANDRYAN\|RYANANDBRENDAN\|RYANWASKNELINGIN\|WHENRYANHESIT\";\r\n\r\n norm(added_lines) rlike match_words \u0026\r\n !(norm(removed_lines) irlike match_words) \u0026\r\n !(old_wikitext contains \"Panic! at the Disco\")\r\n)","name":"Ryan Ross vandalism","comments":"Persistent vandalism targeted against many different article by IP's and newly registered VOA's. Set to disallow 2017-06-18T14:15 following monitoring period. Warning-only has not sufficiently dissuaded vandals. -Xaosflux\r\n\r\n-Pattern updated for CamelCase - Xaos\r\n\r\n* Adding \"Brendon Urie\" to edit filter, as these both involve the same mass attack and are part of this type of vandalism. Considering adding \"Ryden\" as well, but I'm afraid that might generate false positives. I'll consider it. -Oshwah\r\n\r\nPerformance tweaks / cleanup. Also remove warning since this is disallow (shouldn't tell them they can hit Save again) ~MA\r\n\r\n:Renabled warn, due to high volume we are identifying VOA accounts with this, if they stop after a single warning they are getting a pass-see EFN discussion - X\r\n::Changing back to disallow only, calmed down a little bit -X\r\n\r\n-Updated pattern for repeated letters 05JUL2017 - X\r\n\r\nThere's some social media interest in this filter/vandalism, so given DatBot is now reporting it to AIV I've changed the name to something a tiny bit less obvious --TNT 6/7/17\r\n\r\nAdd a string that's a hashtag for this, that's been added to Ryden and others. -Crow 8/2/17\r\n\r\nTemporarily also checking [[Talk:Cheez Whiz]] ~MA\r\n\r\nDoesn't need to be private ~MA\r\n\r\nCheck for \"Panic!\" (Brendon Urie is a member) in old_wikitext per [[Special:Permalink/868264437#202.80.213.225]] ~MA\r\n\r\nLowering to tag-only - catching a decent bit of vandalism but far too many false positives. Special:AbuseLog/22831634, Special:AbuseLog/22839931, Special:AbuseLog/22959222, Special:AbuseLog/22699713 etc. -Galo 2019.01.21\r\n\r\nDisable; last true positive was on 26 August. --Suffusion of Yellow 02:54 22 Oct 2022","group":"default","actions":{"tag":["possible vandalism"]},"enabled":false,"deleted":false,"privacylevel":0,"global":false},"actions":{"tag":["possible vandalism"]}}

Actions to take when matched

Trigger actions only if the user trips a rate limit

Number of actions to allow:

Period of time (in seconds):

Group throttle by:

user

See the documentation on mediawiki.org.

Trigger these actions after giving the user a warning

System message to use for warning:

Page name of other message:

(without "MediaWiki:" prefix)

Prevent the user from performing the action in question

System message to use for disallowing:

Page name of other message:

(without "MediaWiki:" prefix)

Revoke the user's autoconfirmed status

Tag the edit in contributions lists and page histories

Tags to apply:

(see Wikipedia:Tags for use and formatting)

(please don't rename a tag here, see link above)

(one per line, no commas, publicly visible)

possible vandalism

Require the user to complete a CAPTCHA in order to proceed with the action. Users with permission to skip a CAPTCHA are exempt.