User:Jebcubed/Vandal notes

Timing

 * Very little vandalism around 0800 EST (1200 UTC), mainly increases around 0830-ish EST (1230 UTC).
 * Likely indicates that the majority of vandals are students in school

Vandals

 * Most vandalism originates from IP accounts, equally distributed between IPv4 and IPv6 addresses
 * Vandals generally ignore warnings to stop, making the warn process a formality
 * Vandals rarely make personal attacks.
 * Rarely, vandals will claim to be trying to "show that WP is unreliable".

Vandal Edit Summaries

 * Most vandalism have edit summaries along the lines of "Added content" or "fixed it", emoji generally a good indicator of vandalism. Similarly, a gibberish edit summary usually indicates that the edit consists of keyboard-mashing, and not a constructive addition.

Vandal usernames

 * Most vandal usernames will include current memes.
 * Common threads are the number "69", or, more rarely, "420".
 * Otherwise, no commonalities between vandal usernames.
 * Usernames that are extremely similar might be a sign of a sockpuppet

General

 * Most promotion occurs in sandbox pages
 * Common words indicating promotional material include: "providing...", "For over...", "Award-winning...", "leading...", and more.

Naming

 * Accounts that engage in promotion generally are named for the thing they promote.

Behavior

 * Generally create a promotional article by copying it into their sandbox
 * When their page is nominated for CSD, will generally not appeal.
 * When appealing a CSD, generally try to justify the article as being "factual".