Wikipedia:Long term abuse/Roitr

From Wikipedia, the free encyclopedia

Shortcut:
WP:LTA/Roitr
Roitr
Original name(s): Roitr
Wikilifespan: August 27, 2005 — present
ISP: Bezeq International
Known IPs: Dynamic (see #Anonymous IPs)
Known hostmasks: 212.179.0.0/16, 81.218.0.0/16, 82.80.0.0/15, 84.108.0.0/14, 88.152.0.0/14, 79.178.0.0/16, 79.179.0.0/16
Physical location: Israel
Severity: High
Requests for comment:
Requests for arbitration:
Instructions: Block on sight, revert any changes, delete POV forks

Roitr is a permanently banned vandal and sockpuppeteer who attempts to falsify information about military ranks (Usually Russian ones) Olympic Games iterations (Particularly the winter ones) and other topics. He has been blocked indefinitely for edit warring and violating of the three revert rule, but is using sockpuppet accounts and anonymous IP addresses to circumvent the ban.

Status: Active

Contents

[edit] Modus operandi

Vandalism
Dealing with vandalism
Obvious vandalism
Long term abuse
Open proxies
Resources & assistance
Counter-vandalism tools
Cleaning up vandalism
Counter-vandalism unit
IP WHOIS tools
Further information
Blocking IP addresses
Vandalism studies
ISP contact information
Do not provoke vandals
 v • d • e 

Roitr will usually try to insert controversial, unverified or totally fraudulent information and "source" them with links to various Russian websites and claims that he's right because he knows Russian and his opponents do not. These sources typically don't even confirm his view, so they are given just to provide an image of well-established research, and many fluent Russian speakers have confirmed that his "sources" do not back up his claims. He will also upload equally questionable or fraudulent images, possibly with known false license tags on them; these should be deleted. He would also remove any speedy deletion tags or OrphanBot messages from these pages.

If stymied at Wikipedia, he will upload images at Commons with various sockpuppet accounts. He will then use IPs at Wikipedia to insert these images into target articles.

His attacks to a page generally start with minor edits, then expand to uploading self-made images and copying text from other articles or external sources to make an impression of legitimate edit. When people question or oppose him, he revert wars by restoring the content to his POV version, often using sockpuppets and IPs in an attempt to evade the 3RR or semi-protection. Originally, these accounts would create a false persona and diligently claim that they were not Roitr. When presented with CheckUser or other clear evidence that the account was a sockpuppet, the account would claim that the identification was a mistake or that some other person was to blame. Recently, however, sockpuppet accounts rarely (if ever) defend themselves in this fashion and usually launch directly into massive reverts and bogus edits, most often as quickly as possible before the account is blocked.

Disputed versions are probably restored from files on his hard drive, as evident from recreation of deleted articles and images with the exact same content. When editing articles he often uses deceptive or false edit summaries, such as "reverts vandal Roitr" or "makes minor changes" when vandalising or making major edits. He will occasionally create usernames that impersonate legitimate users by adding a period to the end of the legitimate user names (EG. "User:Legit" > "User:Legit.").

He uses very basic English, using constructs typical for a native Russian speaker. He generally can't support long discussion in English and will switch to Russian if the other party can read it. His Russian is fluent but some mistakes, especially in new words and phrases, shows he has not spoken Russian in everyday life for a considerable time.

He has also degenerated into making threats against long standing users who have helped clean up the messes he's caused. Typical threats include: vandalization of user pages, mass reversion of all the user's edits, and claims that he will swamp Wikipedia with hundreds of sockpuppets.

[edit] Sockpuppets

[edit] Maintenance

1. Report sockpuppets and their actions to WP:AIV and revert any changes introduced (in accord with the banning policy). It is always a good idea to make a summary in the #Activity reports section.

When reverting him, provide a link to this page in the edit summary to help explain your actions:

 rv [[User:Roitr/sockpuppeter]]

2. Suspected sockpuppet accounts and anonymous IPs should be tagged on their User: page with:

{{sockpuppet|Roitr|evidence=[[Wikipedia:Long term abuse/Roitr]]}}

3. When the account is blocked, replace the above template with

{{Subst:sockpuppet|Roitr|confirmed|evidence=[[Wikipedia:Long term abuse/Roitr]] and [[Wikipedia:Requests for checkuser/Case/Roitr]]}}

[edit] Identified

These users have been identified enough to be blocked indefinitely:

[edit] Suspected

(as of January 6, 2008)

(as of March 31, 2008)

[edit] Anonymous IPs

Here's a incomplete list of various IPs used to insert bogus facts and/or circuimvent 3RR. Note that it is rather a historical one, because the user has no permanent IP address due to his provider relying on PPPoE protocol (see Wikipedia:Requests for checkuser/Case/Roitr).

See also: Archive (October 2005 - July 2007), Category:Suspected Wikipedia sockpuppets of Roitr

[edit] October 2007

88.154.194.112 (talk • contribs • deleted contribs • WHOIS • RDNS • trace • RBLs • http • block user • block log)
79.178.32.35 (talk • contribs • deleted contribs • WHOIS • RDNS • trace • RBLs • http • block user • block log)
79.179.183.7 (talk • contribs • deleted contribs • WHOIS • RDNS • trace • RBLs • http • block user • block log)
79.179.150.170 (talk • contribs • deleted contribs • WHOIS • RDNS • trace • RBLs • http • block user • block log)
79.179.108.136 (talk • contribs • deleted contribs • WHOIS • RDNS • trace • RBLs • http • block user • block log)
88.152.96.162 (talk • contribs • deleted contribs • WHOIS • RDNS • trace • RBLs • http • block user • block log)
88.155.204.147 (talk • contribs • deleted contribs • WHOIS • RDNS • trace • RBLs • http • block user • block log)
79.182.115.5 (talk • contribs • deleted contribs • WHOIS • RDNS • trace • RBLs • http • block user • block log)
88.152.110.50 (talk • contribs • deleted contribs • WHOIS • RDNS • trace • RBLs • http • block user • block log)
79.178.59.129 (talk • contribs • deleted contribs • WHOIS • RDNS • trace • RBLs • http • block user • block log)

[edit] November 2007

79.178.20.26 (talk • contribs • deleted contribs • WHOIS • RDNS • trace • RBLs • http • block user • block log)


[edit] Host masks

According to RIPE, all affected IP ranges are assigned to Bezeq International:

CIDR range IP range
212.179.0.0/16
81.218.0.0/16
82.80.0.0/15
84.108.0.0/14
88.152.0.0/14
79.178.0.0/16
79.179.0.0/16
212.179.0.0 — 212.179.255.255
81.218.0.0 — 81.218.255.255
82.80.0.0 — 82.81.255.255
84.108.0.0 — 84.111.255.255
88.152.0.0 — 88.155.255.255
79.178.0.0 — 79.178.255.255
79.179.0.0 — 79.179.255.255

[edit] Activity reports

See also Archive of activity reports (March 2006 - December 2006)

[edit] January - March 2007

  • Revert warring over articles on military ranks
  • Restoring already deleted images
  • Removing tags that question the validity of sources or call for a speedy deletion

[edit] April 2007

  • Inserting unsourced/incorrect material and revert warring on figure skating articles such as Axel jump
  • Revert warring over articles on military ranks

[edit] June 2007

[edit] January 2008

[edit] March 2008

(especially at 31 of March)

[edit] Vandalized entries

Frequently vandalized articles and typical activities are listed below in a rough order of change rate. Some pages have to be deleted or semi/fully protected due to the persistent vandalism actions.

[edit] Military ranks

[edit] Comparative

[edit] Russia and Soviet Union

[edit] Italy

[edit] Israel

[edit] Nazi Germany

[edit] China

[edit] France

[edit] Korea

[edit] United Kingdom

[edit] United States

[edit] Government

[edit] Olympics

[edit] Metro

[edit] Animals