This page was nominated for deletion on 20 July 2023. The result of the discussion was keep.

This page should not be speedily deleted because this page would be helpful to identify future socks easily. This is not WP:DENY. -- Poyekhali ( talk) 02:25, 5 July 2017 (UTC) reply

I would also like to note that DENY is only an essay, not a policy or guideline. Poyekhali ( talk) 02:26, 5 July 2017 (UTC) reply

Hmm, I see why. This page was created by a sock. But still, a LTA page would help admins to catch future socks easily. The LTA engages in a "good hand, bad hand" behaviour, and without that information, Prince Klyde (for example) would not be blocked. Poyekhali ( talk) 02:30, 5 July 2017 (UTC) reply

Normally I'd be inclined to agree with you but I think the IP editor makes a good point - this was almost entirely created by him (and largely some of my work) but a lot of the content in here is stuff that he said he will do that the sock hasn't demonstrated and I think that's really where DENY should come in. CHRISSYMAD ❯❯❯ ¯\_(ツ)_/¯ 02:31, 5 July 2017 (UTC) reply

I also think the IP has a good point. Maybe we should nuke this page and start over? I really think that this page would be of value, considering that we have one user which we thought was a good vandal fighter (and even has RIGHTS), but turned out to be a sock. Poyekhali ( talk) 02:39, 5 July 2017 (UTC) reply

Poyekhali feel free to add here User:Chrissymad/Sock drawer/Spearton so at least it's not indexed (which I believe wikispace is) CHRISSYMAD ❯❯❯ ¯\_(ツ)_/¯ 02:53, 5 July 2017 (UTC) reply

Any LTA/SPI pages and their talk pages are automatically noindexed, see MediaWiki:Robots.txt –  Train2104 ( t •  c) 12:32, 6 July 2017 (UTC) reply

Usernamekiran The IP you reverted who tagged it (and I agree with the tag) is not the LTA. CHRISSYMAD ❯❯❯ ¯\_(ツ)_/¯ 03:16, 5 July 2017 (UTC) reply

• I've no objection to a Nuke and Pave, we need the information to be accurate. But the LTA page should exist by all means, if it is a LTA case. L3X1 (distænt write) )evidence( 12:44, 6 July 2017 (UTC) reply

Will, there is still have another user which was also created the LTA page by a sock of himself, so I think this page just leave it there alone. SA 13 Bro ( talk) 12:52, 6 July 2017 (UTC) reply

Good evening (here in the Philippines time). I would like to raise an issue regarding a repetitive vandalism of Tagalog Wikipedia by way of creating patent nonsense or attack pages like: tl:Prince Amul, tl:Ybarro, ‎ tl:Spearton‎, and tl:Enlightened of Ybarro‎, presumably by suspected sockpuppets of this blocked user My Royal Young, like (Tagagamit: is Tagalog for User:) tl:Tagagamit:Abuse Land, tl:Tagagamit:Plane Busters, tl:Tagagamit:Eco Flash Memory. Several of those pages are now protected, albeit temporarily, in order to prevent recreation. The behavior is by constantly creating pages with contents like: #Redirect Tagagamit:Fortuna Imperatrix Mundi'''Bold text'''''Italic text''<big>Big text</big><small>Small text</small><math>Insert formula here</math>^{Superscript text}, or using usernames of rule-abiding users like: #Redirect Tagagamit:Chrissymad'''Bold text'''''Italic text''<big>Big text</big><small>Small text</small><math>Insert formula here</math>^{Superscript text}. The titles of some of those pages raise suspicion in my part, especially with the name "Ybarro".

Intially, until sometime in June, I regarded Prinsipe Ybarro as a legitimate user who constantly reverts vandalism by IP users on tlwiki, stating "Reverting to non-vandalism page…" in the edit summary. When I noticed that he/she became blocked via a global lock, I visited this link from a global deletion template posted on Prinsipe Ybarro's tlwiki userpage. This made me realize that he/she only does "fighting vandalism" on tlwiki is only a some sort of coverup to hide his/her murkier side. My suspicion becomes stronger when a number of trash, nonsense pages with little or no content (if little, with purely vandalised material) were created on August 5. One of these, tl:Spearton, was previously deleted in late July. Though deleted by User:WayKurat, they were recreated in August 7, this time by bogus usernames such as "Star Forces", "Airplane busters, and even "HSHFSHFSJGFSGIFTUKDUKGAXGULAFKIGFAIGCAUKGCSUTKFSUKGXWFKUTUYFSIKYF". (Pls. see this for more info, although in Tagalog/Filipino discussion). Although these "trashy" pages were deleted, I would like to have an assurance that no nonsense pages would ever be created on tlwiki.

My reason for reporting these here is that vandalism acts by this My Royal Young in tlwiki should be added here. If not, I hope that MRY's destructive acts on tlwiki would have its permanent record, and also to permanently stop MRY's destructve vandalism acts on tlwiki. Thanks. JWilz12345 ( talk) 15:03, 8 August 2017 (UTC) reply

@ JWilz12345: Thanks for the update.
pinging @ Poyekhali, Chrissymad, Bbb23, Fortuna Imperatrix Mundi, Train2104, L3X1, and SA 13 Bro: if you havent watchlisted this. Sorry for the mass ping. —usernamekiran (talk) 19:32, 8 August 2017 (UTC) reply

Yes, I knew it. I cross-wiki at Meta site for patrolling the recent changes are quite frequently, thank you for your ping. SA 13 Bro ( talk) 19:46, 8 August 2017 (UTC) reply

@ Blakegripling ph, WayKurat, and Oripaypaykim: That's this entire mess that attack any users in Tagalog Wikipedia here 38.96.9.224 ( talk) 05:57, 9 August 2017 (UTC) reply

Now, it seems that this wave of suspected sockpuppets adding useless pages in tlwiki have stopped. This is for most part thanks to WayKurat's autoblocking of IP range 112.198.64.0/18 (albeit for 3 months) starting 12:18pm, Aug. 8 (PHL time). I would like to express WayKurat a high gratitude for stopping most of the vandalism. JWilz12345 ( talk) 06:14, 13 August 2017 (UTC) reply

That IP range also even globally blocked by RadiX at Meta site, see here. SA 13 Bro ( talk) 06:40, 13 August 2017 (UTC) reply

I have had a look at all four of the IPv6 contributions (2601:87:4100:A504:CC89:4E90:6F1C:8D84, 2602:302:D186:EB50:F002:27E5:728A:13AA, 2602:306:32F9:30E0:15B5:3ABD:E6E3:DC70 and 2602:306:35FD:E000:7DC8:1446:496F:B12) but I am not sure if that was My Royal Young who did this because Geolocate tells me that they all come from the United States, and the vandalism seen does not look like the behavior of the type done by the user. Iggy ( talk) 11:30, 17 December 2017 (UTC) reply

Not precluded that MRY maybe using an open proxies network to hide their Geo-locate, but those IPs can be certain impostor by other vandals. So any vandalism IPs that is similar behavior, just simply report to AIV and SRG (on cross-wiki abuse only). SA 13 Bro ( talk) 18:14, 18 December 2017 (UTC) reply

This edit request has been answered. Set the |answered= or |ans= parameter to no to reactivate your request.

This user is now banned, can anyone update it with new information about this user is banned?

Link: https://en.wikipedia.org/?title=Wikipedia:Administrators%27_noticeboard&oldid=826878875#WP:CBAN_for_My_Royal_Young 2A02:C7F:963F:BA00:B49F:DAF:EF9A:E2DD ( talk) 15:55, 21 February 2018 (UTC) reply

That change isn't needed. ~Oshwah~ ^{(talk) (contribs)} 18:04, 22 February 2018 (UTC) reply

In the last three weeks there is a string of determined attacks—with both IPs and throw-away accounts—on Wikimedia Commons; see noticeboard and respective investigation. May I update the LTA page for a broader IP range (namely, Special:Contribs/203.87.128.0/17) and modus operandi observed nowadays? Incnis Mrsi ( talk) 10:26, 19 March 2018 (UTC) reply

This seems to be two smaller ranges which are already mentioned: 203.87.156.116/30 and 203.87.171.160/28 (which is labelled as a /24). As these are used for range blocks, and the /17 is a busy range, it's best to keep the as small as possible. -- zzuuzz ^(talk) 10:42, 19 March 2018 (UTC) reply

Definitely more than two. Possibly zzuuzz is right that global block of a /17 is an overkill, but Special:Contribs/203.87.232.0/22 is neither 203.87.156. nor 203.87.171., and is not mentioned altogether. The same for Special:Contribs/203.87.133.128/25. Incnis Mrsi ( talk) 12:07, 19 March 2018 (UTC) reply

@ Incnis Mrsi: I don't see any MRY vandalism from those ranges on meta, commons, or this wiki. Can you be more specific? -- zzuuzz ^(talk) 12:17, 19 March 2018 (UTC) reply

Sorry, included a /22 erroneously – but isn’t .133.128/25 MRY? Incnis Mrsi ( talk) 12:22, 19 March 2018 (UTC) reply

It's not (and CU confirms it). I'll ping -revi in case they want to review the block. -- zzuuzz ^(talk) 12:27, 19 March 2018 (UTC) reply

My interaction with this vandal was that the ISP was changing IPs every time they make an request (so when you are 203.87.232.185 when saving page A, you'll become 203.87.232.147 after you save it). Yes, /17 is a big range (32768 IPs), but I'm more inclined to keep the whole ISP down, because of these too-quickly-changing-IP. — regards, Revi 12:37, 19 March 2018 (UTC) reply

When there's only 16 well-defined IPs being used, however quickly, blocking 32,768 IPs does seem like overkill. -- zzuuzz ^(talk) 13:19, 19 March 2018 (UTC) reply

OK zzuuzz, reducing the block to two smaller ranges (above). — regards, Revi 15:41, 19 March 2018 (UTC) reply

For the certain period of time when I monitoring the recent changes at Meta-Wiki site, I noticed that MRY also using an open proxy IP network to engage vandalizing, and trolling other people user talk page as well. Giving this kind of vandal troll the attention they want, it just encourages and feeds the shrines awards for them, FWIW. SA 13 Bro ( talk) 13:16, 19 March 2018 (UTC) reply

This LTA user started to add vandalism on Commons under name "MRYSOCKER2017". Please report any MRY socks into WP:SPI as we have none reported. For commons, it on c:COM:RFCU. Vandalism can damage the wiki. 2A02:C7F:963F:BA00:5D78:603B:76D:8C13 ( talk) 17:28, 21 March 2018 (UTC) reply

Any obvious vandalism disruption on English Wikipedia it should be report at WP:AIV, for Commons site report at c:COM:ANV, and Meta:SRG as well. Not WP:SPI and c:COM:RFCU, useless there is an dubious sleeper accounts, in this circumstances are the appropriate way to report it at WP:SPI or c:COM:RFCU. The else, it won't be the merit to open the case at WP:SPI or c:COM:RFCU. SA 13 Bro ( talk) 19:39, 21 March 2018 (UTC) reply

Many page protections later and this sock has run out of pages to vandalise. The MRY sock has stopped at last, but not for long... 2A02:C7F:963F:BA00:C9AB:1D0A:F284:1E2A ( talk) 17:27, 27 March 2018 (UTC) reply

...and it returned! A edit filter is needed to stop My Royal Young socks. 2A02:C7F:963F:BA00:E4DC:A854:6FD3:394 ( talk) 19:54, 31 March 2018 (UTC) reply

Look at https://commons.wikimedia.org/?title=User_talk:Prinsipe_Ybarro&action=history – Cæsey ( talk · contribs · central auth · count · email) edit-wars against the “classical” trademark MRY flooding in the user_talk of Prinsipe Ybarro ( talk · contribs · central auth · count · email) whom this site deems a puppet of My_Royal_Young. It is almost certain that Cæsey is closely related to the vandal; notice the timing of edits. I compared editing style of Cæsey against Prinsipe_Ybarro – they may be the same person, but given observed diversity of behaviour I deem unlikely that “My Royal Young” as understood by en.Wikipedia is actually one human being. Note that persistent changes of IPs greatly complicate reliable identification.

Now the question. I’d go straightly to Meta-wiki to check who is Cæsey—he’s active on Meta while indeffed on both en.Wikipedia and Commons—but Prinsipe_Ybarro is stale. Can anybody recommend some reference sock puppets attributed to Prinsipe_Ybarro and/or My_Royal_Young which were active recently? I know only some vandal-only socks on Commons which were active in March–April, but—except for aforementioned Prinsipe_Ybarro and Cæsey itself—don’t know their accounts playing a legitimate Wikimedian. Incnis Mrsi ( talk) 20:31, 17 May 2018 (UTC) reply

I was responsible for most of the cross-wiki investigation into MRY last year. There are certainly multiple people involved (likely the master and one or multiple friends). Given the geographical location and type of IP ranges used, however, there is little that can be done from a technical side to distinguish between them. -- Ajraddatz ( talk) 20:47, 17 May 2018 (UTC) reply

I can think of a couple of distinguishing features. It's worth mentioning that Cæsey was tampering with a number of different LTAs from their first very day. Having taken a look at the time, I'd say Cæsey almost certainly isn't MRY - you know, that guy who goes around saying BLOBLOB. If I were to be pressed I could think of a couple of possible options, but MRY is not one of them. -- zzuuzz ^(talk) 20:59, 17 May 2018 (UTC) reply

MRY was a lot more complex of a case than just inserting BLOBLOB into articles; there were good hand and bad hand accounts, and continuing abuse intended to draw attention. This page was even started by an MRY sock (which begs the question of why it still exists). That said, I wouldn't say that Caesey is MRY just from a cursory examination. I could look into it more if needed but the account is already locked. -- Ajraddatz ( talk) 01:45, 18 May 2018 (UTC) reply

@ Zzuuzz: Cæsey shoveled MRY’s dung 1 minute 54 seconds after 112.198.68.4 started to edit user_talk:Prinsipe_Ybarro. Cæsey never edited this page before and respective namespace-2 page never existed. Then-current incarnation of the vandal wasn’t active in any other page whichthat could plausibly interest one random Cæsey. How did he become aware of the MRY’s attack? Just looked at recent contribs by a random chance? Incnis Mrsi ( talk) 12:16, 18 May 2018 (UTC) reply

I say this from checkuser information (and Ajraddatz might possibly have an opinion on this), in terms of technical practicalities I find it highly unlikely. -- zzuuzz ^(talk) 12:21, 18 May 2018 (UTC) reply

I doubt zzuuzz may be authoritative for technical data for Cæsey’s edits of mid-day (Asia-Pacific time) on April 17, 2018. Only Commons’s and Meta-wiki check-users, stewards, and MediaWiki system administrators have access to these. On another day Cæsey could edit from another location, even from another country. Moreover, even assuming we certainly know Cæsey was located very far from the Philippines at the time, it doesn’t disprove some kind of affiliation. Cæsey may have a chat or phone session with MRY, or be informed by a third party who observed MRY’s delinquency directly. Incnis Mrsi ( talk) 13:38, 18 May 2018 (UTC) reply

Thanks for information. Do you think that Prinsipe_Ybarro was ejected from Wikimedia rightfully? Was the case against him based on IP intersections with the vandal solely? Incnis Mrsi ( talk) 06:28, 18 May 2018 (UTC) reply

I am also suspected User:Cæsey could be a good hand sock of MRY based on his restored the LGA template at User:Prinsipe Ybarro account on Meta site in previously, but User:Cæsey didn't seem attached to Tagalog Wikipedia (tl.wikipedia.org) record. Although there is no good reason to believe that User:Cæsey is a good hand sock of MRY, but User:Prinsipe Ybarro is confirmed belong to MRY good hand sock account, because they using the same IP addresses when they performed the good hand and bad hand in each other. MRY also used the several kind of VPN proxies to vandalize the projects in the past, have some review on this old revision page commented by Poyekhali and find the "Global IP block exempt for Prinsipe Ybarro" section. SA 13 Bro ( talk) 13:38, 18 May 2018 (UTC) reply

Thanks a lot for the link, Bro. For me the puzzle is virtually solved by now. There are three guys who played with the Prinsipe username pattern on early April, 2017. They are:

• Prinsipe Migo ( talk · contribs · count · logs · email), a.k.a. the vandal My Royal Young proper;
• Prinsipe Joseph ( talk · contribs · count · logs · email), Wikipedia-unworthy but not a vandal, may or may not be identical to Cæsey;
• Prinsipe Ybarro ( talk · contribs · count · logs · email), actually the oldest account in the series and basically a good-faith contributor.

Ybarro and Joseph may be unaware that Migo is a serial vandal or they just didn’t realize the peril of their position. Later, Migo vandal the Young registered more socks with the same prefix, thus ruining reputation of his buddies finally. And we see that en.Wikipedia treats its contributors like shit, not quite surprisingly to me. My proposal—seriously—is to unlock Joseph, Ybarro, and Cæsey, and interrogate them directly on Meta-wiki, at last. @ Ajraddatz:? Incnis Mrsi ( talk) 14:53, 18 May 2018 (UTC) reply

No, that wouldn't accomplish much. All of the Prinsipe users are socks of MRY, confirmed by checkuser and behavioural evidence at the time. Also, Zzuuzz has more than enough local data to give an opinion on whether Caesey is connected to MRY, so I wouldn't dismiss him so quickly. If there are future suspected socks you could report them here at an SPI or on Meta. -- Ajraddatz ( talk) 15:49, 18 May 2018 (UTC) reply

@ Ajraddatz: why do you deem that “certainly multiple people involved” then? If there were accounts even farther from this cluster—on behavioural signs—than the three Prinsipe “brothers” are from each other, then I can’t even imagine how a reasonable admin classified them as MRY. Incnis Mrsi ( talk) 18:29, 18 May 2018 (UTC) reply

I remember that at the time, there was reason to suspect that one other person was involved from the same geographical location. All classifications were made on a combination of behavioural and technical evidence, and other information where available. -- Ajraddatz ( talk) 18:36, 18 May 2018 (UTC) reply

I understand that local check-users are not stupid and have some grasp of dynamic IPs. But the problem is actually another: the buddies can operate from a SOHO-like network (a large-family apartment, computer club, small enterprise, dormitory etc.) which jams all possible IP identification with a source-address NAT. Dynamic nature of their shared Internet connection may add further confusion, such as both Migo and Ybarro jump simultaneously from 198.51.100.5 to 198.51.100.3 when you observe them from Internet. Moreover, in some (although definitely not all) cases these persons can use the same device to edit under different accounts. Incnis Mrsi ( talk) 20:05, 18 May 2018 (UTC) reply

122.2.10.98 ( talk · contribs) should be added to the list of sockpuppets. ~ Dissident93 ^{( talk)} 00:30, 23 September 2018 (UTC) reply

He was very active today, using multiple IPs to first self-identify on the IP-user talk pages with shared-ip and sock/MYR templates, then vandizing numerous articles; US Navy ships, malls & telephone companies in Asia, video games, as well as some user talk pages. IPs include;

• User talk:122.2.10.98
• User talk:124.105.55.175
• User talk:122.54.197.85
• User talk:82.79.83.78
• User talk:2.86.53.134
• User talk:43.252.11.123
• User talk:45.64.122.210
• User talk:112.198.55.35
• User talk:124.105.97.56
• User talk:210.4.97.78

fyi - wolf 23:47, 23 September 2018 (UTC) reply

Same behavior as above, with the following IP;

• User talk:122.3.53.196
• User talk:122.3.169.240

fyi - wolf 04:40, 3 October 2018 (UTC) reply

Hello. This is an important notice that newly suspected vandals of this cross-wiki abuser My Royal Young. He keeply adding his Roblox profile and his continued rubbish and deep hatred acts on other Metawiki admins, local admins, users, stewards, Philippine municipal articles, Ybarro, Dota 2, Mobile Legends and other articles. Here i found the new accounts:

• Colorful motherboard settings - globally locked
• Super flashkiller extreme - globally locked
• Xtreme motherboards - globally locked
• Flashkiller Windows Virue - globally locked

Please inform to contact the WMF Support and Safety Team if this vandalism persists at ca@wikimedia.org -- 2600:6C4E:580:A:C596:AD91:AB84:C8BD ( talk) 00:53, 3 May 2019 (UTC) reply

Randelearcilla ( talk · contribs), who is also a prolific sockpuppeter (see Category:Suspected Wikipedia sockpuppets of Randelearcilla) may be related to this LTA. A MRY IP created the Battle of Bessang Pass article, which has since been edited by multiple Randelearcilla socks, and the same IP range has been frequently used by Randelearcilla for other vandalism of articles on the military history of the Philippines. The Randelearcilla socks common feature is to add fantasy-style material to articles on that topic, for instance greatly inflating the number of soldiers involved in various battles and exaggerating the role of the Philippines in various wars. Very similar vandalism has been going on for something like the last decade from various accounts, which also aligns with the timeframe for MRY. Nick-D ( talk) 11:27, 9 June 2020 (UTC) reply

MRY might be different persons. Maybe just one, or maybe friends. But it is definite that this page was created by a sock. MRY is known to have good hand - bad hand socks, and it looks like they might even know how to bypass the CU. So I hereby request to not to spill beans so that the master wouldnt be able to make improvements in their MO by reading our observations. Or at least, kindly be vague about your observations. Regards, —usernamekiran (talk) 06:09, 28 June 2020 (UTC) reply

I didn't realise that the page was created by a MRY sock. I've been being harassed by various accounts since posting here. Nick-D ( talk) 06:57, 28 June 2020 (UTC) reply

It regularly happens to me, in waves. Since yesterday, my userpage/talkpage is still being vandalised on multiple projects, but I am not sure who is it doing. My biggest doubt is MRY though. —usernamekiran (talk) 08:04, 28 June 2020 (UTC) reply

I should note that I left out some of the key distinguishing features of the likely-related sock account I added per WP:BEANS. Nick-D ( talk) 08:12, 28 June 2020 (UTC) reply

A discussion is taking place to address the redirect Wikipedia:Long-term abuse/Wacky Wars. The discussion will occur at Wikipedia:Redirects for discussion/Log/2020 October 17#Wikipedia:Long-term abuse/Wacky Wars until a consensus is reached, and readers of this page are welcome to contribute to the discussion. 🌸 1.Ayana 🌸 ( talk) 17:47, 17 October 2020 (UTC) reply