User:HJ Mitchell/Admin log

This page is intended as a summary of some of the more serious abuse admins deal with and some of the challenges they face. Precise dates and other details are omitted for obvious reasons.

Many admins put a lot of effort into their admin work, but much of that work takes place behind the scenes, out of sight even of most established editors. This page will, I hope, serve to enlighten some people as to what admins do, and why we need more of them.

The examples below are a small sample of my admin work. The main focus is on the more serious or persistent abuse that most people don't see.

October 2014

 * Dealing with yet another prolific sockmaster in the Israel-Palestine conflict. It's only been a few weeks but we're up to 30 accounts!
 * Spent nearly 45 minutes cleaning up after a spree of libellous vandalism. Somebody used three IP addresses to add a claim that a minor celebrity was involved in a sexual abuse scandal to multiple articles. Resulted in over 30 logged actions, mostly deleting the offending revisions but also blocking the IP addresses and protecting the affected articles. That's the kind of thing that makes you question whether we really should allow just anyone to add any claim they like about a living person, given the damage such an allegation can do if it isn't swiftly removed.
 * More cleaning up, this time after somebody using open proxies to post an explicit image a the top of a high-traffic noticeboard. Proxies blocked, page protected, image blacklisted. That should solve the problem for, ooh, a few days at most!
 * Stumbled upon an obscene vandalism spree on another admin's userpage involving a string of grossly offensive usernames. More RevDel, more blocks, and another admin protected the page.
 * Another vandalism spree requiring lots of RevDel—a series of accounts and IPs adding claims that Barack Obama is Osama bin Laden's brother, that a governor of a US state is a paedophile, and that Barney (yes, that one, the big purple dinosaur! Of all the targets for that sort of abuse!) is a drug dealer and sodomises young boys.
 * Came across a sockfarm (15 accounts and a dozen IP addresses that we know of) spamming links to the same few websites on multiple articles. Turns out they've been doing this on other wikis as well. I blocked most of the accounts (some were already blocked by other admins) and the IPs and some of the URLs have been backlisted locally ad globally. I have a feeling we'll be seeing them again, though.

November 2014

 * The month started with a charming spree of vandalism to my userpage. Not sure who I've pissed off but if the trolls aren't happy I like to think I'm doing something right!
 * One of our longest-standing and most prolific sockmasters returned from their very welcome absence to harass an editor with some particularly nasty edit summaries (Since RevDel'd). They returned a few days later, using accounts with obscene usernames to harass another editor.
 * Spent a Sunday morning cleaning up page-move vandalism after somebody moved the article on Prince Philip and another article to offensive titles. Page-move vandalism gets on my nerves; not because of the move itself, but because of the sheer mess it makes and the effort that goes into cleaning it up (in this case, two pages and their talk pages moved to offensive titles = four revisions and eight log entries to be deleted). And that's not to mention moving the pages back and blocking the vandal (in this case was done by another admin) and move-protecting the pages so it can't happen again (you'd be surprised how many times lightening strikes twice—page-move vandals tend to be long-term ban evaders with favourite targets). We could do with a one-click feature (like rollback) to revert page moves.
 * I was repeatedly accused of being a British nationalist by an IP (turned out to be a banned user with a bee in their bonnet about an article I protected). You get used to that sort of nonsense after a while.
 * What is it with articles about children's films? They seem to attract some of our most persistent abuse. I've been making lots of rangeblocks recently trying to deal with a Vietnamese IP-hopper who seems to have been at it for years. One editor has been reverting them for all that time without being able to ask for help. Then all of a sudden they start documenting things, I stumble across it, find a few IPs in the same range and block it. Now the problem doesn't seem so insurmountable. Being able to help a good editor like that is the sort of thing that makes the role worthwhile.
 * Spent a lovely half an hour or so cleaning up some obscene vandalism from a series of sockpuppets on a few articles about British female celebrities. I'd protected the article after their last spree a few weeks ago (and made several larger-than-I'd-normally-be-comfortable-with rangeblocks), but they returned not long after the protection expired. The edits were reverted and the socks blocked by another admin, so all that was left was to RevDel the edits and re-protect the articles. Irritatingly, I suspect I'll be seeing them again before long. And that is one of the most annoying parts of the job...
 * The sockmaster mentioned immediately above returned towards the end of the month with yet more obscene misogyny on the biographies of minor celebrities. After a very messy SPI with input from three CUs and multiple other editors, we finally identified this guy's original account and it turns out he's been at this in one form or another for years. The end result was about a dozen accounts blocked, two moderately sized rangeblocks, and another half an hour or so spent RevDel'ing the abuse (we have got to come up with an easier way to mass RevDel sprees across multiple articles than deleting each edit one by one!). Anyway, they've since taken to to harassing me (you get used to that sort of thing—standard fare for admins, especially those of us who deal with serious abuse) and other editors through open proxies. Oh well, we made life a little bit harder at least...
 * And the month ends with this (apparently I've been editing since 1256; I wonder whether that was supposed to be the 13th century or lunchtime?). I'm almost certain it's the same person mentioned in the previous two posts—their usual ranges are blocked and their favourite articles protected, so they've moved on to this sort of thing.

December 2014

 * Possibly Wikipedia's most prolific sockpuppeteer made his latest unwelcome return. Created a series of accounts to attack an editor he holds a grudge against, then moved onto open proxies to continue his campaign in edit summaries. I blocked the accounts and IP addresses as usual, which prompted a string of abuse on my talk page (hardly unexpected) and then on ANI.
 * The aforementioned returned multiple times throughout December. He started by creating a series of obscene usernames and harassing various editors, before moving on to trolling various articles to do with the Arab-Israeli conflict. Then it was indiscriminate reverts of various editors active on one side of that topic area (with obscene edit summaries, just for good measure). I've been chasing him around for years so I recognised the style immediately, blocked the accounts and the IPs, and deleted the edit summaries. Which, not unexpectedly, prompted (for the second time this month) a series of screeds on my talk page. I remember being quite shocked the first time I got abuse like that (same person, all the way back in 2010), but I've seen it so many times now it's quite boring.
 * Speaking of the Arab-Israeli conflict, the area seem to be infested with sockpuppets (yes, even more so than normal!) at the moment. You wouldn't think that the difference between "barrier" and "wall" would be the source of so much trouble, but there's an editor who got himself indefinitely blocked for edit-warring over precisely that, and has since come back with multiple sockpuppets to make the same edit, citing the same argument. The article is semi-protected, so he's taken to making a handful of edits, waiting to get autoconfirmed, and then revisiting his favourite article, despite the fact that this invariably results in the sockpuppet being blocked, usually within minutes.
 * And I've been chasing yet another sockmaster in the same topic area. I don't generally look to get involved in the Arab-Israeli dispute, but it can be interesting—the Wikipedia articles about the world's intractable geo-political and ethnic conflicts tend to be a microcosm of the conflict itself, none more so than this one. This particular sockpuppeteer again got blocked for edit-warring, and the block was increased and eventually made permanent after he evaded it multiple times to continue the same edit war. I recently discovered that he's been using open proxies to evade the block pretty much since it was placed, and edit-warring across multiple articles.
 * No account of admin work involving serious or persistent abuse would be complete without the Internet controversy of the day, which at the moment is the GamerGate controversy. This lovely little "controversy" area has essentially had two groups declare all-out virtual war on each other; both sides are attempting to use Wikipedia to further their agenda. One long-term sockpuppeteer has returned to harass one of the most prominent editors in the topic area and disrupt the ongoing arbitration case.
 * Sticking with GamerGate, an investigation into the above sockmaster uncovered what appears to be a completely unrelated sockfarm which has also been disrupting the topic area and harassing the same editor, including creating an obvious impersonation account.
 * A few days later an editor bouncing around various IP addresses on the same range was again disrupting the topic area and harassing the same editor mentioned above, but, amazingly, all three appear to be unrelated. Or, at least, different people.
 * While clearing a UAA backlog I stumbled across a series of accounts with usernames created to harass and "out" a long-departed editor who specialised in dealing with sockpuppets and long-term abusers. The result was lots of RevDel and a flurry of emails to oversight.
 * My prolific sockmaster from November returned but seems to have moved back to trolling on Eastern European topics rather than the obscene vandalism that first brought them to my attention.
 * I was pinged to an SPI out of the blue, where it turned out that one of the suspected sockpuppets was somebody I'd recently blocked for edit-warring. When a CheckUser investigated, we ended up with a very complicated investigation. It turned out that we had two sockfarms (one of which involved an individual using multiple accounts to edit-war) and another editor misbehaving with an undisclosed alternate account. And, just for good measure, the filer was also up to no good, but none of those accounts were related to the original alleged sockpuppeteer!

January 2015

 * A long-term community-banned sockmaster resurfaced after an extended absence (or perhaps an extended period of non-detection?), mostly to troll talk pages of articles about American historical events.
 * While handling a backlog of page protection requests, I came across an article that had been the subject of spamming with links to commercial websites, and this appeared to have been going on for several years. It seems nobody had joined up the dots because the IP addresses involved were of ten completely different, but some digging revealed that they were all open proxies geolocating to China or American webhosts. Investigating this and then blacklisting the URLs and rangeblocking the webhost and the Chinese proxies was nearly two hours' work. I suspect spammers this persistent will be back, but hopefully I will have inconvenienced them by more than two hours.
 * Almost by accident I came across a sockfarm created to harass several editors from another wiki. Having apparently been defeated there, they moved over here with attack usernames and obscene personal attacks then promptly began creating accounts to impersonate the admins who blocked the accounts here. After about half an hour of fun and games, all of the accounts ended up globally locked by a steward and the underlying IP address was blocked by a checkuser.
 * Two long-term and very unpleasant sockpuppeteers resurfaced in one day, one uploading images to Commons with spam URLs embedded in the picture and adding the images to articles here, the other causing mayhem on Balkans articles. The latter was mostly editing without logging in, using IP addresses in one /16 range; much to my amazement, there were almost no constructive edits coming from it (there was at least one garden-variety vandal on it who may or may not have been the same person I was after), so I was able to place an unusually lengthy block for such a large range.
 * An editor I had been dealing with since October, using dynamic IP addresses and bouncing between huge ranges, continued his crusade to add libellous accusations about a minor British celebrity to articles, and failing that to administrative noticeboards and editors' talk pages. Cue another half an hour of deleting the revisions and another flurry of emails to oversight. They then returned to harass me on my talk page and repeatedly trigger "password reminder" emails (the intent, presumably, to be to annoy me with the emails rather than to gain access to my account).
 * Yet more sprees of obscene usernames attacking admins, attacking Wikipedia, threatening violence. The astonishing thing is that this guy almost never edits with these accounts—he just creates one obscene username after another in rapid succession! It's only in writing this down that I've started to realise just how often this happens. I guess he wouldn't want us to forget how much he hates us!