| Original name(s) | Image flag vandal |
|---|---|
| Wikilifespan | 2016–present |
| ISP | Mostly China Telecom; occasionally also China Unicom |
| Physical location | Fujian, China |
| Sockpuppet investigations | Szm020730 |
| Instructions | Admins: Revert the edits and block the IP addresses or named accounts without waiting for any user warnings. Do not decline AIV report because it looks "stale". Non-admins: Revert the edits, no need to warn the vandal. Suspected named socks may be reported to sockpuppet investigations for confirmation. Ongoing disruptions should be reported to AIV with a link to this long-term abuse report to allow more efficient AIV processing by admins. All: When an IP address or named account has been blocked and confirmed, consider reporting them to meta at m:SRG for global blocks or locks, as this vandal abuses multiple projects. |
| Status | Active |
Basic information[edit]
Szm020730 (talk · contribs · block log · arb · SPI confirmed suspected)
- CentralAuth (meta)
Comprehensive edits analysis
Cross-wiki vandal that adds incorrect flags to articles of places (city/county/district/etc.), primarily editing with IP addresses from China Telecom Fujian. Also known as image flag vandal, or simply the flag vandal. An edit filter is also set up for this vandal.
Their IP addresses, if reported to AIV, should never be considered as stale, as they may resume editing with same or different IP's after stopping for a while. Admins should try to find appropriate rangeblocks as needed.
When reporting disruptions to AIV, please link this LTA page so admins will be able to process the reports more efficiently. Since this involves cross-wiki abuse, consider checking their edits in other projects and reporting disrupting IP's and accounts to meta at Steward requests/Global, so stewards can place global blocks for IP addresses/ranges and global locks for named accounts.
Targeted areas, pages, themes[edit]
Any article of a place, which may be a city, county, district or else. Primarily targets Chinese places, but also vandalizes non-Chinese places. Example pages:
- Xuanwu District, Beijing (diff)
- Chongwen District (diff)
- Kecheng District (diff)
- Lushi County (diff)
- Zhangye (diff)
- Xingyang (diff)
- Guangxi (diff)
- Baga, Borno (diff)
- Omaruru, Namibia (diff)
Habitual behavior[edit]
Inserts hoax flags into targeted pages, misleading readers to think a certain flag is used by the targeted city/county/district/etc. This can be the addition of a flag image completely irrelevant to the page -
- with text below stating "flag of <page name>" in an image box (e.g. [1], [2], usually when the page didn't have an infobox),
- or to the flag field of an infobox (e.g. [3], [4], [5], [6], [7]).
Since January 2018, the vandal has begun to upload fake flag images named after the targeted places to Commons, before adding those images to the articles, making it less obvious that vandalism is occurring.
An edit session may target multiple pages at a time, and may last for several hours even though there may be relatively long pauses between edits. For example, this IP's first edit and last edit were 12 hours apart ([8], [9]), and they had been active during this time frame, albeit with a 4-hour break ([10], [11]) as well as another 2-hour break ([12], [13]). As a result, AIV reports may look stale but in fact they are not.
Edits in English Wikipedia are mostly by IP's, although there are registered accounts too ([14]). Most frequently hoax additions are made to pages of Chinese places, although other places get vandalized as well – African places are another common target.
This vandal abuses with the same behavior on multiple Wikimedia projects, including but not limited to English, Japanese ([15]), Spanish ([16]), Russian Wikipedia ([17]) and many more, as well as Wikimedia Commons ([18]).
Cases[edit]
Other notes[edit]
Confirmed and suspected accounts[edit]
Sockpuppet categories[edit]
- Sockpuppet category (if any): Category:Wikipedia sockpuppets of Szm020730
- Suspected sockpuppet category (if any): Category:Suspected Wikipedia sockpuppets of Szm020730
- Sockpuppets (including IP addresses) listed at Wikimedia Commons: Category:Sockpuppets of Szm020730
IP addresses[edit]
121.205.49.126 223.104.45.102 219.133.46.12 219.133.46.78 219.133.46.9 219.133.46.8 219.133.46.7 223.104.45.100 223.104.45.104 223.104.45.99 223.104.45.97 219.133.46.74 219.133.46.75 219.133.46.73 219.133.46.70 121.207.74.55 117.24.123.12 120.42.184.160 120.33.101.78
China Unicom[edit]
- 36.250.0.0/16
China Telecom[edit]
- 27.151.0.0/16
- 59.57.28.0/22
- 110.81.160.0/19
- 117.24.0.0/17
- 120.37.0.0/16
- 120.42.0.0/16
- 120.43.0.0/16
- 120.42.186.95
- 121.207.64.0/19
- 124.72.153.0/24
- 124.72.154.0/24
- 125.78.0.0/17
- 220.162.0.0/17
- 222.77.0.0/16
- 222.79.0.0/16