User talk:Zzuuzz/Archive 38

What do we do about VPNs?

Can you check if any of my advice here is correct? If somebody uses a VPN which employs a web host that has been rangeblocked due to abuse, in such a way that their VPN appears to be editing Wikipedia from the blocked range, do they get a break because they are using a VPN? The VPN in question is Avira, one that is assumed for the sake of argument to be respectable. Thanks, EdJohnston (talk) 02:44, 14 March 2020 (UTC)

Hi Ed. That seems like an accurate assessment. As your link there shows, there's even an LTA using the range - I don't know much about their reputation but that's got to put it into question. It seems for this user it's a recurring theme. I'm not sure what the dewiki rules are, but Global IPBE was previously granted for a year[1] and if all else checks out I suspect it could be granted again. In my general opinion, people who regularly use VPNs can get a break. Oh and Leaseweb I'd exercise extreme caution about sweeping generalisations - they do a lot of varied stuff. -- zzuuzz ^(talk) 19:45, 14 March 2020 (UTC)

WP:REVDEL Threat

Is it possible to RD this threat? Thanks. NonsensicalSystem^(err0r?)_(.log) 12:38, 16 March 2020 (UTC)

Nevermind; it's been done already. NonsensicalSystem^(err0r?)_(.log) 12:39, 16 March 2020 (UTC)

They did it again...

...four minutes after your clear message. [2] --MrClog (talk) 17:12, 25 March 2020 (UTC)

And you conveniently omit the fact that was an edit conflict, which I corrected soon after. CaradhrasAiguo (leave language) 17:23, 25 March 2020 (UTC)

Orchomen

Per the SPI page, can we get talk page access revoked at User talk:Barrys rabbit? Thanks. Amaury • 08:17, 3 April 2020 (UTC)

 Done. -- zzuuzz ^(talk) 08:31, 3 April 2020 (UTC)

blacklist/archive issue

I'm assuming your edits for "blacklist/archive issue" -- including my talk page -- fixes an issue that involves blacklisting and archiving, so sincere thanks for going out of your way to so, but I'm curious; what exactly is the issue being fixed? Is there a link describing this? I don't want to accidentally re-enable the issue out of ignorance. --A D Monroe III^(talk) 01:43, 4 April 2020 (UTC)

Hi A D Monroe III. Yes, if you were wondering why ClueBot wasn't archiving your talk page, this fixes that. From my perspective, ClueBot was spamming the spam blacklist logs,[3] which are useful for other purposes. The link on the blacklist was the one I disabled in my edit. Why it was blacklisted is something I haven't felt the need to investigate and document, but this is a very rare thing, and I'd even suggest you might never see it happen again. (free ping for Nick Moyes who's having the same problem) -- zzuuzz ^(talk) 06:32, 4 April 2020 (UTC)

Thanks, zzuuzz. I wouldn't have noticed that for ages as I intentionally keep a very long talk page. Think I've fgixed it now. Nick Moyes (talk) 10:04, 4 April 2020 (UTC)

2019 London Bridge stabbing

Not sure why the image of Usman Khan was removed in this edit.--♦IanMacM♦ ^{(talk to me)} 07:01, 4 April 2020 (UTC)

Hi ianmacm. As I tried to mention in the edit summary, I switched the fair rationale on the image description page to apply to the attacker, rather than the attack. I'll admit I'm not a big fan of fair use, and I find the stated fair use rationale really poor, but two things seem obvious to me: Having the image in both articles hardly constitutes fair use, and the article about the attacker is the more appropriate place. What brought this about was the constant removal/replacement of the image from the attacker article (see history). If you want to sort out the rationales, be my guest. -- zzuuzz ^(talk) 07:08, 4 April 2020 (UTC)

A barnstar for you!

	The Anti-Vandalism Barnstar
	Dear zzuuzz manager, although I have a history of editing on Wiki, I don't have a license. Such as the option to protect the page or defend against other annoying users. With respect Goodarz Irani (talk) 07:51, 4 April 2020 (UTC)

Thanks! -- zzuuzz ^(talk) 08:25, 4 April 2020 (UTC)

CU for Serbef Enapk - sock of Highstakes00?

I recall seeing this tactic before:

• Wikipedia:Sockpuppet investigations/Highstakes00/Archive
• Wikipedia:Administrators'_noticeboard/Archive286#Probable_hijacked_dab_page
• Wikipedia:Sockpuppet investigations/Telseria/Archive
• Wikipedia:Administrators'_noticeboard/IncidentArchive944#Hijacked_dab_page_Çağdaş

Did you CU Serbef Enapk? It may be prudent to do so given the history. MER-C 12:34, 7 April 2020 (UTC)

Might want to check these accounts too. I've been racking my brain for weeks trying to figure out a way to filter this as it seems to be happening more and more. Praxidicae (talk) 12:49, 7 April 2020 (UTC)

@MER-C: :None taken :p See also User_talk:Zzuuzz/Archive_37#Gracias. There was much difference with Franko2020 (talk · contribs · block log), FWIW. Previously when I've looked at this there was some distinctive systematic usage of open proxies, and this seems to fit the pattern. I should be able to take a closer at the others later today, but I think we can safely assume it's the same problem. -- zzuuzz ^(talk) 13:27, 7 April 2020 (UTC)

There is a well established way to detect this, but it needs to be calculated offline. MER-C 14:56, 7 April 2020 (UTC)

@MER-C and Praxidicae: Feel free to drop me an email. So it seems Clemenst and Serbef are your archetypal Highstakes socks. Franko2020 gives some weird results. Dr._Fragello looks like a different paid editor, specifically Upwork (coonected or not I couldn't say, and don't ask me why I think that). Wrenvek is CU-stale, but there looks like a right mess to pick over in their deleted article. -- zzuuzz ^(talk) 21:11, 7 April 2020 (UTC)

Found another one and if I had to guess this is also a paid editor as they created teh first iteration of the article. Praxidicae (talk) 12:50, 9 April 2020 (UTC)

Annnnnnd another Praxidicae (talk) 13:51, 9 April 2020 (UTC)

Zeniveas is most likely Sensate8, both fitting the Highstakes pattern. Same with Preawn_Chwi. HenriK hétfő looks like one of those 'normal' contracted editors, a bit like Franko2020. HenriK's article, if you follow the images, is related to Jenenene18 and Klevshinko, but the CU data doesn't support this. -- zzuuzz ^(talk) 15:26, 9 April 2020 (UTC)

I'm not really concerned about CU data at this point since I just assume they're all shitty freelancers. I found a few more too, take a look at this. I'm finding more and more...Praxidicae (talk) 15:36, 9 April 2020 (UTC)

I looked back to February 2019 and found four unblocked accounts, one unreverted hijack and one casualty. As I said, fairly easy to detect programmatically and I will be looking for these every time I run the suspicious article list. They munched an Indian village once, so it's not restricted to Eastern Europe. MER-C 17:08, 10 April 2020 (UTC)

I found a little bit of an easier way to find some historic moves (not going to reveal on wiki, will email if you'd like) but it involved me painstakingly going through several hundred thousand edits of one account on Wikidata to find the bunch I found yesterday. I went through April 3- 2020 to September 25 2019 so far. Praxidicae (talk) 18:25, 10 April 2020 (UTC)

WP:OP/R

Hey Zzuuzz! I previously responded to all open requests at WP:OP/R. Some of them were quite old but it's good practice. Could you review my conclusions (whenever you've the time to do so)? I haven't marked any cases closed because I'm not a verified user, so if you agree with my conclusion, feel free to close them. --MrClog (talk) 19:51, 16 April 2020 (UTC)

Thanks for the reminder, and the responses. I've been meaning to get around to that, and should be able to soon. Things have been a bit busy recently. -- zzuuzz ^(talk) 21:16, 16 April 2020 (UTC)

I see you already reviewed two of them: thanks. I looked at an IP listed at WP:OPD and was able to find a port that was listed on various websites: 187.87.38.28:53281. However, I am unable to connect through this proxy and telnet isn't able to connect either. Do you know if this IP is still an open proxy? --MrClog (talk) 12:22, 20 April 2020 (UTC)

I'm not able to connect at this time. It may have gone, be sleeping, busy, or changed ports. If you look at OPD for any meaningful time you will see both these users again. I usually ignore at least one of them - see this. -- zzuuzz ^(talk) 14:38, 20 April 2020 (UTC)

By the way, how did you discover 218.185.134.10 (talk · contribs · WHOIS) was running openvpn? Here you can see how I confirmed whether an IP was running openvpn, but I'm not an expert on detecting openvpn IPs which seem to hide themselves quite effectively. --MrClog (talk) 18:40, 22 April 2020 (UTC)

Oh, I just realised that if you look at the cached version of vpngate.net, it lists the IP on there. (Though the question about detecting openvpns in general still stands.) --MrClog (talk) 18:44, 22 April 2020 (UTC)

Check out freevpn.gg, and there's a few similar tricks. But also, this IP was used by a LTA who usually uses openvpn. BTW about that other IP. There is openvpn, then there are open vpns, and this is a meaningful distinction in terms of policy. Instead, I would say it probably belongs to PIA, who are notoriously good at hiding their assets, though not perfect - google the whois owner. -- zzuuzz ^(talk) 19:25, 22 April 2020 (UTC)

Zzuuzz, I did google the IP owner and it was indeed very strange, because this LLC was located at what seemed to be some trailer camp. Based on your comment, I googled the LLC's name with "VPN" and found this (not sure how reliable Spur is). --MrClog (talk) 19:51, 22 April 2020 (UTC)

There's some more results if you mix in PIA with the searches. Yes, they're often obscure. Unless you want to wander down rabbit holes, concluding that it's PIA quite often comes down to adding in some second hand information. -- zzuuzz ^(talk) 20:09, 22 April 2020 (UTC)

I'm sorry to bother you again, but that Shingling334 person is mentioned a lot at WP:OP and has more than 100 suspected/confirmed socks. Should someone create an LTA page for them? --MrClog (talk) 13:30, 23 April 2020 (UTC)

I tend to think not, at least I'm not inclined to, as the SPI usually provides adequate information. TLDR; when they're not using colos, they usually edit from Eastern England (Essex, Suffolk, Norfolk) or sometimes Turkey. -- zzuuzz ^(talk) 15:00, 23 April 2020 (UTC)

What do you think about 80.82.77.12 (talk · contribs · WHOIS)? It has a 99 IPQualityScore and http'ing returns an invalid certification from Traefik, which seems to be software to set up a reverse proxy, not a forwarding proxy. --MrClog (talk) 11:08, 25 April 2020 (UTC)

Well, it's a webhost, though I don't recognise the edits, nor how it's accessed. One suspects the hosting network is not too fussy about its customers, and I'm sure it's in the Seychelles and accepting Bitcoin for really good honest moral reasons. Like there's loads of information about their outfit on their website. -- zzuuzz ^(talk) 12:53, 25 April 2020 (UTC)

How do I pronounce your name?

Hi Zzuzz! Why is Zzuzz your username, and how do you pronounce it? --Civilised Gentleman (talk) 18:10, 26 April 2020 (UTC)

Hello. Why does anybody use any name? zzuuzz is a pseudonym which doesn't mean anything. I find it is aesthetically pleasing, symmetric, proportionate, not too tall in any place nor otherwise ungainly, easy to type with one digit on alternating hands, relatively short and memorable (though some people seem to have problems), and long enough to make it relatively easy to click on when hyperlinked. How you pronounce it is up to you. I suppose you could omit repeating letters when uttering it, if you go by the unrelated example of Zzyzx, or if you want some fun you could try saying it in Italian. I'm told there might also be other pronunciations. -- zzuuzz ^(talk) 18:38, 26 April 2020 (UTC)

Unputdownable explaination. Thanks! --Civilised Gentleman (talk) 18:58, 26 April 2020 (UTC)

Request RevDl on Justin Rohrwasser

A user and an IP address by the names of Jscobie and 2a00:23c5:a301:3e00:c1a3:a14a:1273:28e8 added a defamatory comment on something racial on the page on revisions 953339927 and 953343112, so could you please suppress the revisions? NASCARfan0548 ↗ 23:15, 26 April 2020 (UTC)

(talk page stalker) @NASCARfan0548: Libel should be (privately) reported to the Oversight team. See Wikipedia:Requests for oversight. --MrClog (talk) 23:19, 26 April 2020 (UTC)

@MrClog: Thank you for letting me know. I didn't know that was a thing until you replied to me. NASCARfan0548 ↗ 23:21, 26 April 2020 (UTC)

@NASCARfan0548: No problem. Most problematic edits that need to be removed from the public logs can be handeled through RevDel by any administrator. However, these edits can still be viewed by any admin after Revdel, while some edits - like libel - need to be suppressed from the eyes of admins too. That's where the Oversight team jumps in, who are admins that have signed special privacy/non-disclosure agreements and who can hide edits from everyone except Oversighters. See WP:OSPOL to find out when to contact Oversighters instead of regular admins. --MrClog (talk) 23:28, 26 April 2020 (UTC)

This seems resolved, thanks to NASCARfan0548 for spotting this, and thanks to MrClog for responding in my temporary absence (and to the others involved). Since this is my talk page I'm sure you won't mind if I quibble a bit with this interpretation. The first priority for anything potentially libelous is to get it quickly removed from public view with as little publicity as possible, whether by admin or oversight. OS is indeed a relatively reliable way of doing this in a timely manner (this should be stressed). However, potential libel is an extremely broad category, and oversight is not always used. If everything potentially defamatory were to be passed to OS they'd probably be inundated. There is another problem - the definition of OSPOL#2, where OS may be used, is actually qualified, and the word 'need' is not used. Admins still need to see a lot of bad edits because they often must act on them, whether with protection, blocks, filters, watching pages, resolving disputes, or some other remedy. Again, limiting such things to oversighters is not actually a very practical solution. -- zzuuzz ^(talk) 05:54, 27 April 2020 (UTC)

True, it's a weigh-off, indeed. In this case, Bradv chose to use RevDel because the things added in the article are rumours that have spread quite widely (even in RS), though the RS don't say the rumours are true. --MrClog (talk) 09:21, 27 April 2020 (UTC)

USS Oberrender

They previously edited with other IPs in the same page, please revdel those as well. © Tbhotch^™ (en-3). 06:38, 9 May 2020 (UTC)

Hi again. Can you revdel these?. Thanks. Regards. © Tbhotch^™ (en-3). 01:14, 11 May 2020 (UTC)

sock block

Hi zzuuzz, would you mind blocking Shingling334 again? He hopped from Special:Contributions/88.105.87.0 to Special:Contributions/88.105.89.167 a couple of days ago. Thanks... --IamNotU (talk) 20:49, 13 May 2020 (UTC)

Dizengoff TLV

Hello Zzuuzz, was user Dizengoff TLV evading their block/ban, so I can tag their pages accordingly. Thank you. GSS ^💬 15:52, 14 May 2020 (UTC)

Hi, if you can hold off for a bit, it's a bit involved, I'm a bit busy, and I plan on filing some paperwork later. But SPOILER: Wikipedia:Sockpuppet investigations/Çelebicihan @MER-C and Praxidicae: see recent logs. -- zzuuzz ^(talk) 15:59, 14 May 2020 (UTC)

I am s-h-o-c-k-e-d. Just flabbergasted, I tell you.Praxidicae (talk) 16:02, 14 May 2020 (UTC)

Thank you and I guess we'll be able to take care of their pages under G5 soon. GSS ^💬 16:05, 14 May 2020 (UTC)

Another range used by you-know-who

Thanks again for your prompt action! Going through his most recent spree, I came across (and blocked) 88.151.96.0/21. Considering how long it's been active, there may be some socks and sleepers of this or other miscreants lurking. Favonian (talk) 20:54, 14 May 2020 (UTC)

Technically speaking, things before today are less clear. A bit weird in fact. However I find myself with nothing to do. -- zzuuzz ^(talk) 21:11, 14 May 2020 (UTC)

Look...

what's back. Praxidicae (talk) 14:42, 15 May 2020 (UTC)

Open proxy

Hey zzuuzz, could you block 103.81.236.0/22 (talk · contribs · WHOIS)? When connected to 103.81.236.225:28, 103.81.238.251 (talk · contribs · WHOIS) was serving as exit server (which is blocked as OP). 103.81.236.225 (talk · contribs · WHOIS) has itself also edited. Seems to be a group of OPs (although the ISP seems unrelated to the OPs). --MrClog (talk) 20:28, 16 May 2020 (UTC)

Hi. Port 82? I agree there's a few entries and exits, but they seem to all be blocked. I'm not really seeing enough disruption at this time to do a range block - most edits seem to be geo-appropriate. The issue seems recent and I expect the bots will keep it in check while it persists. -- zzuuzz ^(talk) 22:16, 16 May 2020 (UTC)

Yes, I mean 82. I wasn't sure whether it was still being used by legitimate users of the network (as opposed to people using it as OP), although I realise it may be the case where the ISP runs all its traffic through a server and one person/a few people in the network is/are running an OP. By the way, do you have any update w.r.t. the "verified user" thingy? --MrClogBot (talk) 23:13, 16 May 2020 (UTC)

I've been following your career with interest, and seen some strong improvements in both the technical and non-technical aspects. I've actually seen such improvements that I would like the improvements to continue for a bit longer. I'm happy to assist further to that end. I think you currently fall down when it comes to experience. I'm not talking about an encyclopaedic knowledge of LTAs and proxy users, though this can be useful, but some of the nuances of how the open proxy policy works in practice. I'm sure you realise that it's not always as simple as "open proxy, ban it". I have another slight concern which relates to the role as an advisor to admins and CUs. There is a key phrase, "recognise their limitations", where I'm not currently convinced. It is excellent to be right about things, and it's OK to say that you don't know, but getting it wrong in such a context can be the worst. I'm not saying you're getting things wrong, and mistakes can happen, but I think it's important to accurately assess risks and convey levels of certainty. If you haven't read them already, and you need some idea of where I am coming from, take a look at this and this, which I wrote a decade ago. -- zzuuzz ^(talk) 08:33, 17 May 2020 (UTC)

Thanks for your extensive update. I am currently on a wikibreak until the beginning of June (I'm using my bot account that isn't actually running any tasks at the moment because my main account has a Wikibreak Enforcer enabled). However, if you come across any IPs that I could take a look at, including more difficult cases, I would appreciate it if you share them with me so I can take a look at them once I'm back from my break. In addition, once back, I'll continue to monitor WP:OP and WP:OPD. Also, when you say "role as an advisor to admins and CUs", are you referring to the fact that admins (and ACC for that matter) sometimes ask for help at WP:OP? And how does the "CUs" part fit in there (as in, what kind of help do CUs normally require)? By the way, did you find anything interesting w.r.t. to the TFA vandal? --MrClogBot (talk) 10:26, 17 May 2020 (UTC)

Yes, many checkusers probably don't need much help. Others sometimes use the best advice available, and that can include WP:OP. Like other admins, they can seek advice about whether an IP is anonymising in some way and what can or should be done about it. Plus of course they highly value evidence which they may not have immediate access to. They may then choose to factor that into their decisions. The TFA vandal is apparently still going. -- zzuuzz ^(talk) 11:03, 17 May 2020 (UTC)

The template you (may have) wanted

I was very very bored, and came across this block, where you said there wasn't quite a template that fit. I obviously don't know all of the details, but considering the block reason, you may have been thinking of either {{sockpuppeteer|timeblocked|checked=yes|time=1 week}} or {{sockpuppet|MasterNameHere|confirmed|length=1 week}}. (Also, if there's a need for a new template/template modification, I'd be happy to help :) ) Best, --Mdaniels5757 (talk) 00:58, 19 May 2020 (UTC)

Thanks. The template I was looking for is not so much for other users, as those are, but for the user themself - in fact almost identical (or at least similar) to {{Checkuserblock-account}}, but just not indef. We use that template a lot in the block logs, for the benefit of both the user and others, so that would probably also be a desirable feature. I suppose one solution might be a time/temp parameter for that template, but it's probably a super rare situation. I think I've only come across such a situation once before, and frankly at times like these I prefer to leave a personal note. -- zzuuzz ^(talk) 01:11, 19 May 2020 (UTC)

ISIS vandal

Wikipedia:Administrators'_noticeboard/IncidentArchive1009#ISIS_edits_and_socking It looks like this person is back again with the same edits.--♦IanMacM♦ ^{(talk to me)} 07:44, 19 May 2020 (UTC)

Done, thanks. -- zzuuzz ^(talk) 07:51, 19 May 2020 (UTC)

Block of 49.149.102.252

ZZuuzz, back on May 12 you blocked this IP for three months (blocked 49.149.96.0/20 talk with an expiration time of 3 months with the template "checkuserblock-wide"). Today, about an hour before it was blocked for 14 days by ST47ProxyBot, IP 47.187.215.98 (whose first edit was at the beginning of the day, and who had already nominated two bird articles to be Good Articles) reverted 49.149.102.252's own week-old GA nomination of another bird article with an edit summary of idk who is this, but this is highly unlikely to pass.

It seems very possible to me that this new IP is a sock of the old one, and if so, the bot's block should perhaps be lengthened, if the reasoning behind the length of your original block still holds, and the accounts are related. I thought in any case you'd want to know that users with similar interests and methods—editing birds articles and nominating them that same day to be Good Articles—are still active. Thank you for your time. BlueMoonset (talk) 14:27, 19 May 2020 (UTC)

Thanks, this is indeed the same user - a prolific community-banned long-term abuse case. They often do tag-team socking, with WP:GHBH tactics, so you're welcome to treat consecutive edits from IPs or new accounts with great suspicion, even if they're contradictory. The different IPs are very different types of networks, so I'm content with the current block lengths. I'm just going to drop a couple of FYI pings @Casliber and El C:. -- zzuuzz ^(talk) 14:59, 19 May 2020 (UTC)

Today's Wikipedian 10 years ago

Awesome

Ten years!

--Gerda Arendt (talk) 11:56, 24 May 2020 (UTC)

Today's PITA

• This is related to this spate of socking. They're coming in quickly on various IPs. Similar geolocation but too-wide to block ranges.-- Jezebel's Ponyo^{bons mots} 23:42, 1 June 2020 (UTC)

User:Zzoezz

I'm getting confused about this

I see you just reverted User:Zzuuzz on Wikipedia:Articles for deletion/Reveal (rapper) (2nd nomination). Now someone called User:Zzoezz has come along, and tagged himself as a sock on his user page, and reverted your reverts on the AFD. Since you're a CU and already involved, and seem to be logged in, do you want to look at this? Otherwise I will post it at WP:ANI Pi (Talk to me!) 12:24, 2 June 2020 (UTC)

OK, it looks like you and MaterialScientist beat me to it while I was typing Pi (Talk to me!) 12:25, 2 June 2020 (UTC)

Hi. Yes it's just an impersonation troll. Someone obviously let them out of lockdown prematurely. It happens from time to time. In fact if you look up to the previous thread, you'll see more. -- zzuuzz ^(talk) 12:30, 2 June 2020 (UTC)

SmartAs789 (talk) 00:56, 6 June 2020 (UTC)

Regarding this

Another brand new editor has just shown up at Julius Evola, EthanUrban, making the same edit as VeritasVox, Soupsmarx and TurnipGod. Beyond My Ken (talk) 02:14, 6 June 2020 (UTC)

Chatsdike

Mind blocking Chatsdike? See filter log. Thanks. ◊PRAHLAD^balaji (M•T•A•C) This message was left at 16:36, 6 June 2020 (UTC)

Request for Rollback Rights

Hello, I am requesting for roll back rights on the English Wikipedia. I have a lot of experience in vandalism and reverting them as you can see Here. I have been using Twinkle but it has not been much efficient in issuing warning, I want to try out Huggle which needs those rights. Please consider my request. Regards Got a Smart Idea^{tell me about it} 11:05, 7 June 2020 (UTC)

Thanks

Thanks for blocking user 115.69.59.49. He was really giving me a hard time on my talk page Got a smart idea^{Tell me about it📩} 13:34, 9 June 2020 (UTC)

Sockpuppet from the AfD discussion

I've discounted the last comment as their edit history clearly shows it comes from the same place, but they are not formally blocked. Notifying so you could check. Thank you! Juliette Han (talk) 17:33, 10 June 2020 (UTC)

Thanks. I was a bit busy eating some popcorn at the time, as I may be for a little while longer, but the account is now blocked. -- zzuuzz ^(talk) 17:43, 10 June 2020 (UTC)

Lehman Alternative Community School

I don't really know what's going on at Lehman Alternative Community School, but an IP is asking that some old edits be REVDELed as possible OUTING. I see you did that, but then reverted yourself. In an abundance of caution, I've REVDELed the edits again but wanted to inquire with you about it. Am I missing something here? EvergreenFir (talk) 19:02, 10 June 2020 (UTC)

(replied). -- zzuuzz ^(talk) 07:52, 12 June 2020 (UTC)

User:PolandMcDouble

Hello Zzuuzz,

Which LTA was this user you just blocked? I am wondering because I saw this very odd draft created by an IP geolocating to Los Angeles, leading me to believe that a certain user might not be quite as inactive as I thought.

Thank you, Passengerpigeon (talk) 07:34, 12 June 2020 (UTC)

Hi. I'll look into that. I think the page may be unrelated, and that Grawp is not currently doing things like this (not saying they're inactive). Just a word of caution, there's a lot of impersonation around, and I recommend not tagging or other documentation unless confirmed by CU. -- zzuuzz ^(talk) 07:51, 12 June 2020 (UTC)

Thanks for the reply. I know not to tag socks unless advised, and I've seen plenty of impersonation among sockers. Passengerpigeon (talk) 07:58, 12 June 2020 (UTC)

The page might not be unrelated, because it has just been recreated by User:PolandGizzyBellaWhore with actual attack content this time, rather than a test edit. Passengerpigeon (talk) 08:51, 12 June 2020 (UTC)

Regarding WilliamGerlach1

I found another userpage through external link search: User:KayMcFadden/sandbox. Not sure to link the users as sock though. Should they be reported as sock? – robertsky (talk) 17:34, 18 June 2020 (UTC)

 Done, thanks. I wouldn't bother sockreporting - It seems to be a casual spammer so probably won't help much. -- zzuuzz ^(talk) 17:43, 18 June 2020 (UTC)

Thanks! Noted. – robertsky (talk) 17:45, 18 June 2020 (UTC)

Declining Vandal/Blackumbra

Hi, since when do we accept comments like "Fuck off" to other editors ?? https://en.wikipedia.org/enwiki/w/index.php?title=User_talk:Blackumbra&type=revision&diff=963878083&oldid=963877787&diffmode=source CommanderWaterford (talk) 10:39, 22 June 2020 (UTC)

Hi. You spammed their talk page relentlessly. Since when do we do that? I know some admins who if you did that to, they'd add fuck off in your block message. -- zzuuzz ^(talk) 10:41, 22 June 2020 (UTC)

Vandal cluster you might want to look at

Hi, zzuuzz! Here is something you might be able to deal with. I was about to make an SPI report on an identical series of vandalism edits by three different auto-confirmed editors, who have been blocked by three different admins. All three removed content at the articles Fortnite and Tom Clancy's Rainbow Six Siege and replaced it with a large image of Osama bin Laden. I suspected there might be sleepers just waiting to carry on the battle, so I installed temporary ECP at those articles. As I collected evidence for SPI I realized it might be better to consult with you directly, because you may already know who is behind this. I say that because you blocked one of the perpetrators as LTA.[4] The three accounts are:

• User:GuildFloyd blocked by Materialscientist
• User:KillMatters blocked by zzuuzz as LTA
• User:Harshprotestor blocked by Widr

Fortnite is under semi-protection; these trolls established themselves as auto-confirmed by editing their sandboxes or random articles. Thanks for looking into this! -- MelanieN (talk) 17:48, 22 June 2020 (UTC)

Hi Melanie. Yup I've had a look and these are My Royal Young. It's all gone a bit beyond diligent record-keeping, but that's the name. No complaints about the ECP, but you may want to reset the levels before expiry. There's nothing wrong with wasting a few auto-confirmed socks. FYI they may spring up elsewhere, they often impersonate other vandals (as this one tried to do), and usually a global lock is inevitable. -- zzuuzz ^(talk) 18:04, 22 June 2020 (UTC)

Thanks for looking into it. I agree about resetting the indefinite semi-protection before the ECP expires; in fact I suggested at my RFP comment that people ping me or remind me. My main reason for asking you was to see if you might smoke out any sleepers. -- MelanieN (talk) 18:15, 22 June 2020 (UTC)-- MelanieN (talk) 18:15, 22 June 2020 (UTC)

It's always worth a look, especially with this one, so I appreciate the note. Unfortunately it's a bit of a bottomless rabbit hole. -- zzuuzz ^(talk) 18:20, 22 June 2020 (UTC)

IP discount

Hi I'm use to freebasics but Can I get an IP discount?and I'm use VPN HSaurab (talk) 11:54, 26 June 2020 (UTC)

Hello HSaurab. Most people who ask for this have already successfully made some edits. What type of thing do you plan to edit? -- zzuuzz ^(talk) 15:26, 26 June 2020 (UTC)

I like to do this kind of editing and page creation.HSaurab (talk) 16:09, 26 June 2020 (UTC)

That's not entirely specific. You seem to be able to edit at this time, and I'm sure you could probably make some edits on other language wikis as well, so you may want to take this time to build up a track record of good edits, or at least start editing, to make your application more persuasive. -- zzuuzz ^(talk) 16:18, 26 June 2020 (UTC)

zzuuzz I want to take it for better editing HSaurab (talk) 18:33, 26 June 2020 (UTC)

You are currently able to edit without the IP discount. So what I'd really suggest is that you show us what you've got already. -- zzuuzz ^(talk) 18:34, 26 June 2020 (UTC)

Check your email please.This problem happens occasionally. Now this problem has been created again.103.25.248.254 (talk) 18:45, 26 June 2020 (UTC)

zzuuzz Seen link https://drive.google.com/file/d/16C7g--si1jFcId8zRqMseds7kO-rB3Ei/view?usp=drivesdk.

That link doesn't work. So you are still able edit without the IP discount, so I'm not inclined to grant it at this time, that is, until you have satisfactorily demonstrated your response to the following question. Do you plan on writing about anything that isn't about you or your work? -- zzuuzz ^(talk) 19:00, 26 June 2020 (UTC)

zzuuzz No,I want to do better And this rhyme I can't Because I always use VPN network.I am now I'm without a VPN. But that's only until tonight .Then I will use VPN .That's why I'm asking you to give me an IP.You can keep an eye on me with my IP discount if you want.HSaurab (talk) 19:11, 26 June 2020 (UTC)

OK here's the deal. First time, you get two weeks to show that this be useful. Granted. If you don't use it by editing, or your account gets blocked, or you write about anything you have a conflict of interest with, then it will expire. If not, I will consider renewing the discount for longer. -- zzuuzz ^(talk) 19:24, 26 June 2020 (UTC)

Thank you.HSaurab (talk) 19:29, 26 June 2020 (UTC)

See Wikipedia:Sockpuppet investigations/Ooh Saad

Doug Weller talk 17:43, 26 June 2020 (UTC)

@Doug Weller: Thanks. Sigh. Did you mean to also block DirkSnare? -- zzuuzz ^(talk) 18:33, 26 June 2020 (UTC)

I thought I'd just watch it. Or do you think I should go ahead and block? Doug Weller talk 18:40, 26 June 2020 (UTC)

That's up to you and your watching preferences, but I think it's the same user. -- zzuuzz ^(talk) 18:45, 26 June 2020 (UTC)

Article

My Article User:HSaurab/sandbox How to take the main page. and I want to let you know my alternative account named HSaurab1.HSaurab (talk) 05:49, 27 June 2020 (UTC)

Should this blocked range be able to create accounts?

[5] I asked because I blocked a sock using this range. Thanks. Doug Weller talk 11:11, 27 June 2020 (UTC)

It's hardblocked, so absolutely no one can create accounts on that range. What you probably saw was someone editing their talk page. -- zzuuzz ^(talk) 12:08, 27 June 2020 (UTC)

Wiki News and My Royal Young

I'd noticed that you and I have both received the same LTA message on Wiki News. I tried to revert one of the edits on a different user talk page and I was warned about that from blanking by a abuse filter. I then tried to explain to Wikinews: admin action alerts but when I clicked submit, the abuse filter took action and blocked me indefinitely on the site. Unfortunately that edit can't be proven from this Abuse filter log. And here's the block status the filter imposed.

By posting to the administrators notice board, hopefully someone can revert these edits made by the LTA without having trouble from the edit filters. I have never made a single edit on Wikinews so that would be my problem as a new user. Iggy (Swan) (Contribs) 11:48, 27 June 2020 (UTC)

Oops. We could try pinging one of their nice helpful admins like User:Pi zero who's already cleaning up some of it. Please can you unblock? -- zzuuzz ^(talk) 12:08, 27 June 2020 (UTC)

Hi, folks. Sorry about the overly exuberant abuse filter at Wikinews. Unblocked. :-)  --Pi zero (talk) 12:30, 27 June 2020 (UTC)