Viewing abuse filter 2: Common vandal phrases

Filter parameters

Filter ID:	2
Description: (publicly viewable)
Statistics:	Of the last 47 actions, this filter has matched 0 (0%). On average, its run time is 0.55 ms, and it consumes 0.4 conditions of the condition limit.
Conditions:	user_editcount < 22 & edit_delta < 3000 & ( regexstring:= "\b(MAS+IVE\|ENORMUS\|HUMO+NGO?US\|HUGE\|TINY\|SUCK(ED\|ING\|S)?\|MY\|MAH\|HIS) ((KAW\|CO)[CK]+\|DICK\|PRICK\|BAL+S\|[A@][S$Z][S$Z]+)\b\|WIKIPEDIA (BLOW\|SUCK)\|(DICK\|COCK) IN( THE)? (ASS+\|BU[TM]+\|MOUTH)\|\b(ASS+\|BU(TT+\|M+))[- ]?(R(APE\|AEP)\|(PH\|F)UCK)\|ASS+[ \-]HAT\b\|OH ?SHI-\|AUSFAILIA\|HAHAHAHA\|HUE HUE HUE\|HUEHUEHUE\|▄▄█▀▀\|I LIKE (PIE\|CHEESE)\|\bMY SEMEN\|BUTTPEE\|YAMAL AO2\|NJOTRANS\|GENERISK\|ION (DETOXIFY\|CLEANSE)\|DETOX FOOT SPA\|NATIO(N\|NAL) DEBT RELIEF\|YOUR ANONYMOUS VPN\|LSGLASSES\.COM\|MEEBO BAR WAS LAUNCHED\|FUCKING KILL\|SHAVED MY BALLS\|CAT EYES 2OO7\|CORY JUDE\|CLEM WASHINGTON\|THE BROTHER ZEN\|SHREK IS LOVE\|STUPID BITCH\|U MAD BRO\|YOLOSWAG\|NIGGA\W\|\bNIGGER\|CENSORS THE TRUTH\|NIGGAH\|PORNSTAR\|GNAA\b\|EA8O7778EAG\|9GSOO7EGS8\|I[- ]?8(OO[- ]?(98G[- ]?AS2O\|87O[- ]?7AI2)\|77[- ]?929[- ]?EE7E)\|DIFF=82(SI88EG8\|GII9SGO)\b\|OLDID=82(SSE78OE\|GII9A82)\b\|USER:BONADEA_AND_USER:FAVONIAN_ARE_SOCKS\|RICHARD MADENFORT\|RICK MARTY\|REGGIE BRADLEY\|FALCIFICATION fake document exposed FADRICATED\|78ESOAIEOI\|[FV]UERD\|DREU[FV]\|\bROYER\d\|CRUI?Z[IE]?[DR]\|DISUSEKID}\|HPHELPNUMBER\|PE[MN]JS\|CRUI[SZ]IR\|TASLIMSON\|\bLIGMA\b"; ccnorm(added_lines) rlike regexstring & !(ccnorm(removed_lines) rlike regexstring) & !(lcase(new_wikitext) rlike "category:.(bands\|musical groups\|albums\|songs)") & !(count('"', added_lines) > count('"', removed_lines)) & page_id != 26204397 & /* [[WP:EF/FP]] */ !(contains_any ( lcase(page_title), "slur", "agatha christie", user_name, "sandbox" ) ) ) user_editcount < 22 & edit_delta < 3000 & ( regexstring:= "\b(MAS+IVE\|ENORMUS\|HUMO+NGO?US\|HUGE\|TINY\|SUCK(ED\|ING\|S)?\|MY\|MAH\|HIS) ((KAW\|CO)[CK]+\|DICK\|PRICK\|BAL+S\|[A@][S$Z][S$Z]+)\b\|WIKIPEDIA (BLOW\|SUCK)\|(DICK\|COCK) IN( THE)? (ASS+\|BU[TM]+\|MOUTH)\|\b(ASS+\|BU(TT+\|M+))[- ]?(R(APE\|AEP)\|(PH\|F)UCK)\|ASS+[ \-]HAT\b\|OH ?SHI-\|AUSFAILIA\|HAHAHAHA\|HUE HUE HUE\|HUEHUEHUE\|▄▄█▀▀\|I LIKE (PIE\|CHEESE)\|\bMY SEMEN\|BUTTPEE\|YAMAL AO2\|NJOTRANS\|GENERISK\|ION (DETOXIFY\|CLEANSE)\|DETOX FOOT SPA\|NATIO(N\|NAL) DEBT RELIEF\|YOUR ANONYMOUS VPN\|LSGLASSES\.COM\|MEEBO BAR WAS LAUNCHED\|FUCKING KILL\|SHAVED MY BALLS\|CAT EYES 2OO7\|CORY JUDE\|CLEM WASHINGTON\|THE BROTHER ZEN\|SHREK IS LOVE\|STUPID BITCH\|U MAD BRO\|YOLOSWAG\|NIGGA\W\|\bNIGGER\|CENSORS THE TRUTH\|NIGGAH\|PORNSTAR\|GNAA\b\|EA8O7778EAG\|9GSOO7EGS8\|I[- ]?8(OO[- ]?(98G[- ]?AS2O\|87O[- ]?7AI2)\|77[- ]?929[- ]?EE7E)\|DIFF=82(SI88EG8\|GII9SGO)\b\|OLDID=82(SSE78OE\|GII9A82)\b\|USER:BONADEA_AND_USER:FAVONIAN_ARE_SOCKS\|RICHARD MADENFORT\|RICK MARTY\|REGGIE BRADLEY\|FALCIFICATION fake document exposed FADRICATED\|78ESOAIEOI\|[FV]UERD\|DREU[FV]\|\bROYER\d\|CRUI?Z[IE]?[DR]\|DISUSEKID}\|HPHELPNUMBER\|PE[MN]JS\|CRUI[SZ]IR\|TASLIMSON\|\bLIGMA\b"; ccnorm(added_lines) rlike regexstring & !(ccnorm(removed_lines) rlike regexstring) & !(lcase(new_wikitext) rlike "category:.(bands\|musical groups\|albums\|songs)") & !(count('"', added_lines) > count('"', removed_lines)) & page_id != 26204397 & / [[WP:EF/FP]] / !(contains_any ( lcase(page_title), "slur", "agatha christie", user_name, "sandbox" ) ) )
Notes:	Splitting off from Filter 58, to distinguish vandals that should be blocked on site from those that should be warned. - Someguy1221 Add variants. --NW 11/9 +1, current attacks. --NW 11/12 +1 -- NW 11/12 +2 -- NW 11/15 +1 -- NW 11/16 Fix -- NW 11/16 +1, tested. --NW 11/17 +1, tested. --NW 11/18 +1 more, tested. --NW 11/18 +2, tested. --NW 11/21 +1, tested. --Nw 11/23 -1, false-positive on an unblock request. Sorry. Reinstate if really needed. -v-_-v +1, tested. --NW 11/27 Tweaking, +1, tested. --NW 12/2 +1 --NW 12/4 +1 --NW 12/4 +1 --NW 12/5 Updating --NW 12/8 Updating --NW 12/14 Updating and pruning. --NW 12/21 +1 --NW 12/22 +2, -2 --NW 12/23 +1 --NW 12/24 +1 --NW 12/28 Add one from #52. --NW 2/23 +1, page-blackout vandalism --NW 2/23 Removed. That's handled by 139, and could be used legitimately in other places. -- Shirik 2/23 +1 --NW 2/27 +1, -2 --NW 3/12 removed 'Bundy' -- Soap +2 -2 old --NW 3/21 -1, now covered elsewhere. --NW 3/21 +1 --NW 3/23 Update - NW 3/29 rm "Scatman", many legitimate uses -- Shirik 1 Apr 2010 Added a check that the phrase are not contained in the removed lines. - Ruslik Moved a couple from filter 58. Someguy1221 +1 --NW 4/21 +6 from filter 320. - Someguy1221 Reverted changes by Tim1357 due to high rate of false positives. Looking into what happened. -- Shirik 26 Apr 2010 Fixed what I did yesterday. Should work now, but I will make it log-only for a bit just in case. --Tim1357 Turned on "prevent from making action" option --Tim Added OH SHI To regexes. - Tim Fix false positive -Tim +1, requested to deal with long-term tennis article vandal. --NW 4/27 :Move regex to constant, so it is not copied twice in the code, log only to make sure it works. -- Tim 4/27 Change back to disallwo. Tim +1 --NW 4/28 Im considering adding "I like pie" to the list, any objections? -- Tim 4/28 + I like pie. Tim add a space ... can we use \b in here or not? -- Soap are the S's on purpose? No, they aren't. Changed to 5's and added regex for "Dont trust this/wikipedia" --Tim 4/28 ^ Also, changed the space to \b. -- Tim 4/28 Moved that big list to the regex. Log only till I know nothing will blow up. --Tim 4/29 Back to disallow -- Tim 4/29 Added "I like cheese" --Tim 5/9 Move "your mom" entries back to filter 320 to give it its own false-positive checks. - Someguy1221 Adding one from filter 58. - Someguy1221 + 1NC1 51KE, from filter 340 --zzuuzz adding \b after C0CK, since 'tiny cockpit' was setting it off. Likely a one time problem, can disable later. -- Soap Moving some to 58. --NW 8/13 +1, "SUCK @$$" -- Shirik 10 Sep 2010 hm things causing false pos, this neads to be cleared out -P Exclude "sandbox" in title and exlude the username in title (see http://en.wikipedia.org/wiki/Special:AbuseLog/5326638). -Sole Soul Add 1 more recent one from Yourname which looks like something others may try. -Od Mishehu Update with "my dick". --Reaper 2012-02-21 Moved one here from #58. --NW 4/9 And another. --NW 4/13 Removed 9GAG for a bizarre false positive (catching the number 9646, contained in a legit URL). Undo if this is a real problem. - Someguy1221 Removing LTA pieces. This filter should catch common vandal phrases, and most likely the abusers have moved on to other choice terms. Move them to filter 58 if they are being used by LTAs. --Reaper 2012-05-09 Updating. --Reaper 2012-08-21 Make an exception for FPs reporting page. -Sole Soul Exempt edits which add quotation marks. We'll be letting some edits through, but I think worth the tradeoff for reducing FP rate. - KoH Exempt all music-related pages, which often have profanity as part of the title of songs and albums. - KoH Move "5TUP1D B1TCH" from 58. - KoH Add "Shrek is love", repeated vandalism (Internet meme?) --NW "Niggah" and "nigger", which through a test filer 6 (0.022%) of 267 hits were marginally possible* false positives, the rest blatant vandalism ~MA Clean layout and reduce condition count. -DF Exempt "Talk:List of ethnic slurs" and other slurs pages -RF 20150604 Exempt pages with "Agatha Christiee" in the title, per "Ten Little Niggers" false positives. RF 20150802 +"pornstar", moving from #58. --NW 9/21/15 Update regex for https://phabricator.wikimedia.org/T29987 and removed some old clauses that are unlikely to have hits anymore ~MA 2016.08.18 Public per [[Special:Permalink/784131724#Privacy of general vandalism filters]] and the guideline ~MA +GNAA due to recent template abuse -Crow 21/7/17 ccnorm("34807778346") = "EA8O7778EAG" ccnorm("9650073658") = "9GSOO7EGS8" ccnorm("1800 986 4520") \| ccnorm("1800-870-7412") \| ccnorm("1-877-929-3373") = "I[- ]?8(OO[- ]?(98G[- ]?AS2O\|87O[- ]?7AI2)\|77[- ]?929[- ]?EE7E)" ccnorm("diff=825188368") = "DIFF=82SI88EG8" – not sure if this is the right filter for this, feel free to move elsewhere and/or delete -Cyp 2017-02-14 ccnorm("oldid=825537803") = "OLDID=82SSE78OE" +Richard Madenfort, Rick Marty, Reggie Bradley per req at EFR. -C 28Feb “FALCIFICATION fake document exposed FADRICATED” taken from random part of [[Special:Diff/829037762]]. Added "78ESOAIEOI", the norm(7835041301), phone number spammer. -C Add Fuerdi vandal. -C Cleanup ~MA 30Nov18: +Transmania and Taslimson per a slew of vandalism, no valid occurrences of the term as of this date -C -Transmania as covered in filter 614 -Galo
Flags:	Hide details of this filter from public view ပိုတ်ႇၸႂ်ႉ တူဝ်ထွင်ဢၼ်ၼႆႉ Mark as deleted
Filter last modified:	17:10, 20 ၸူႇလၢႆႇ 2019 by Ninjastrikers (ဢုပ်ႇ \| ၸွႆႈသၢင်ႈ)
History:	View this filter's history
Tools:	Export this filter to another wiki {"data":{"rules":"user_editcount \u003C 22 \u0026\r\nedit_delta \u003C 3000 \u0026 (\r\n regexstring:= \"\\b(MAS+IVE\|ENORMUS\|HUMO+NGO?US\|HUGE\|TINY\|SUCK(ED\|ING\|S)?\|MY\|MAH\|HIS) ((KAW\|CO)[CK]+\|DICK\|PRICK\|BAL+S\|[A@][S$Z][S$Z]+)\\b\|WIKIPEDIA (BLOW\|SUCK)\|(DICK\|COCK) IN( THE)? (ASS+\|BU[TM]+\|MOUTH)\|\\b(ASS+\|BU(TT+\|M+))[- ]?(R(APE\|AEP)\|(PH\|F)UCK)\|ASS+[ \\-]HAT\\b\|OH ?SHI-\|AUSFAILIA\|HAHAHAHA\|HUE HUE HUE\|HUEHUEHUE\|\u2584\u2584\u2588\u2580\u2580\|I LIKE (PIE\|CHEESE)\|\\bMY SEMEN\|BUTTPEE\|YAMAL AO2\|NJOTRANS\|GENERISK\|ION (DETOXIFY\|CLEANSE)\|DETOX FOOT SPA\|NATIO(N\|NAL) DEBT RELIEF\|YOUR ANONYMOUS VPN\|LSGLASSES\\.COM\|MEEBO BAR WAS LAUNCHED\|FUCKING KILL\|SHAVED MY BALLS\|CAT EYES 2OO7\|CORY JUDE\|CLEM WASHINGTON\|THE BROTHER ZEN\|SHREK IS LOVE\|STUPID BITCH\|U MAD BRO\|YOLOSWAG\|NIGGA\\W\|\\bNIGGER\|CENSORS THE TRUTH\|NIGGAH\|PORNSTAR\|GNAA\\b\|EA8O7778EAG\|9GSOO7EGS8\|I[- ]?8(OO[- ]?(98G[- ]?AS2O\|87O[- ]?7AI2)\|77[- ]?929[- ]?EE7E)\|DIFF=82(SI88EG8\|GII9SGO)\\b\|OLDID=82(SSE78OE\|GII9A82)\\b\|USER:BONADEA_AND_USER:FAVONIAN_ARE_SOCKS\|RICHARD MADENFORT\|RICK MARTY\|REGGIE BRADLEY\|FALCIFICATION fake document exposed FADRICATED\|78ESOAIEOI\|[FV]UERD\|DREU[FV]\|\\bROYER\\d\|CRUI?Z[IE]?[DR]\|DISUSEKID}\|HPHELPNUMBER\|PE[MN]JS\|CRUI[SZ]IR\|TASLIMSON\|\\bLIGMA\\b\";\r\n\r\n ccnorm(added_lines) rlike regexstring \u0026\r\n !(ccnorm(removed_lines) rlike regexstring) \u0026\r\n !(lcase(new_wikitext) rlike \"category:.(bands\|musical groups\|albums\|songs)\") \u0026\r\n !(count('\"', added_lines) \u003E count('\"', removed_lines)) \u0026 \r\n page_id != 26204397 \u0026 /* [[WP:EF/FP]] */\r\n !(contains_any ( lcase(page_title), \"slur\", \"agatha christie\", user_name, \"sandbox\" ) )\r\n)","name":"Common vandal phrases","comments":"Splitting off from Filter 58, to distinguish vandals that should be blocked on site from those that should be warned. - Someguy1221\r\n\r\nAdd variants. --NW 11/9\r\n\r\n+1, current attacks. --NW 11/12\r\n+1 -- NW 11/12\r\n+2 -- NW 11/15\r\n+1 -- NW 11/16\r\nFix -- NW 11/16\r\n+1, tested. --NW 11/17\r\n+1, tested. --NW 11/18\r\n+1 more, tested. --NW 11/18\r\n+2, tested. --NW 11/21\r\n+1, tested. --Nw 11/23\r\n-1, false-positive on an unblock request. Sorry. Reinstate if really needed. -v-_-v\r\n+1, tested. --NW 11/27\r\n\r\nTweaking, +1, tested. --NW 12/2\r\n+1 --NW 12/4\r\n+1 --NW 12/4\r\n+1 --NW 12/5\r\nUpdating --NW 12/8\r\nUpdating --NW 12/14\r\nUpdating and pruning. --NW 12/21\r\n+1 --NW 12/22\r\n+2, -2 --NW 12/23\r\n+1 --NW 12/24\r\n+1 --NW 12/28\r\nAdd one from #52. --NW 2/23\r\n+1, page-blackout vandalism --NW 2/23\r\nRemoved. That's handled by 139, and could be used legitimately in other places. -- Shirik 2/23\r\n+1 --NW 2/27\r\n+1, -2 --NW 3/12\r\nremoved 'Bundy' -- Soap\r\n+2 -2 old --NW 3/21\r\n-1, now covered elsewhere. --NW 3/21\r\n+1 --NW 3/23\r\nUpdate - NW 3/29\r\nrm \"Scatman\", many legitimate uses -- Shirik 1 Apr 2010\r\nAdded a check that the phrase are not contained in the removed lines. - Ruslik\r\n\r\nMoved a couple from filter 58. Someguy1221\r\n+1 --NW 4/21\r\n\r\n+6 from filter 320. - Someguy1221\r\nReverted changes by Tim1357 due to high rate of false positives. Looking into what happened. -- Shirik 26 Apr 2010\r\nFixed what I did yesterday. Should work now, but I will make it log-only for a bit just in case. --Tim1357\r\nTurned on \"prevent from making action\" option --Tim\r\nAdded OH SHI To regexes. - Tim\r\nFix false positive -Tim\r\n+1, requested to deal with long-term tennis article vandal. --NW 4/27\r\n:Move regex to constant, so it is not copied twice in the code, log only to make sure it works. -- Tim 4/27\r\nChange back to disallwo. Tim\r\n+1 --NW 4/28\r\nIm considering adding \"I like pie\" to the list, any objections? -- Tim 4/28\r\n+ I like pie. Tim\r\nadd a space ... can we use \\b in here or not? -- Soap\r\nare the S's on purpose?\r\nNo, they aren't. Changed to 5's and added regex for \"Dont trust this/wikipedia\" --Tim 4/28\r\n^ Also, changed the space to \\b. -- Tim 4/28\r\nMoved that big list to the regex. Log only till I know nothing will blow up. --Tim 4/29\r\nBack to disallow -- Tim 4/29\r\nAdded \"I like cheese\" --Tim 5/9\r\n\r\nMove \"your mom\" entries back to filter 320 to give it its own false-positive checks. - Someguy1221\r\n\r\nAdding one from filter 58. - Someguy1221\r\n+ 1NC1 51KE, from filter 340 --zzuuzz\r\nadding \\b after C0CK, since 'tiny cockpit' was setting it off. Likely a one time problem, can disable later. -- Soap\r\nMoving some to 58. --NW 8/13\r\n+1, \"SUCK @$$\" -- Shirik 10 Sep 2010\r\nhm things causing false pos, this neads to be cleared out -P\r\n\r\nExclude \"sandbox\" in title and exlude the username in title (see http://en.wikipedia.org/wiki/Special:AbuseLog/5326638). -Sole Soul\r\n\r\nAdd 1 more recent one from Yourname which looks like something others may try. -Od Mishehu\r\n\r\nUpdate with \"my dick\". --Reaper 2012-02-21\r\n\r\nMoved one here from #58. --NW 4/9\r\nAnd another. --NW 4/13\r\n\r\nRemoved 9GAG for a bizarre false positive (catching the number 9646, contained in a legit URL). Undo if this is a real problem. - Someguy1221\r\n\r\nRemoving LTA pieces. This filter should catch common vandal phrases, and most likely the abusers have moved on to other choice terms. Move them to filter 58 if they are being used by LTAs. --Reaper 2012-05-09\r\n\r\nUpdating. --Reaper 2012-08-21\r\n\r\nMake an exception for FPs reporting page. -Sole Soul\r\n\r\nExempt edits which add quotation marks. We'll be letting some edits through, but I think worth the tradeoff for reducing FP rate. - KoH\r\n\r\nExempt all music-related pages, which often have profanity as part of the title of songs and albums. - KoH\r\n\r\nMove \"5TUP1D B1TCH\" from 58. - KoH\r\n\r\nAdd \"Shrek is love\", repeated vandalism (Internet meme?) --NW\r\n\r\n\"Niggah\" and \"nigger\", which through a test filer 6 (0.022%) of 267 hits were marginally possible false positives, the rest blatant vandalism ~MA\r\n\r\nClean layout and reduce condition count. -DF\r\nExempt \"Talk:List of ethnic slurs\" and other slurs pages -RF 20150604\r\nExempt pages with \"Agatha Christiee\" in the title, per \"Ten Little Niggers\" false positives. RF 20150802\r\n\r\n+\"pornstar\", moving from #58. --NW 9/21/15\r\n\r\nUpdate regex for https://phabricator.wikimedia.org/T29987 and removed some old clauses that are unlikely to have hits anymore ~MA 2016.08.18\r\n\r\nPublic per [[Special:Permalink/784131724#Privacy of general vandalism filters]] and the guideline ~MA\r\n\r\n+GNAA due to recent template abuse -Crow 21/7/17\r\n\r\nccnorm(\"34807778346\") = \"EA8O7778EAG\"\r\nccnorm(\"9650073658\") = \"9GSOO7EGS8\"\r\nccnorm(\"1800 986 4520\") \| ccnorm(\"1800-870-7412\") \| ccnorm(\"1-877-929-3373\") = \"I[- ]?8(OO[- ]?(98G[- ]?AS2O\|87O[- ]?7AI2)\|77[- ]?929[- ]?EE7E)\"\r\n\r\nccnorm(\"diff=825188368\") = \"DIFF=82SI88EG8\" \u2013 not sure if this is the right filter for this, feel free to move elsewhere and/or delete -Cyp 2017-02-14\r\nccnorm(\"oldid=825537803\") = \"OLDID=82SSE78OE\"\r\n\r\n+Richard Madenfort, Rick Marty, Reggie Bradley per req at EFR. -C 28Feb\r\n\r\n\u201cFALCIFICATION fake document exposed FADRICATED\u201d taken from random part of [[Special:Diff/829037762]].\r\n\r\nAdded \"78ESOAIEOI\", the norm(7835041301), phone number spammer. -C\r\nAdd Fuerdi vandal. -C\r\n\r\nCleanup ~MA\r\n\r\n30Nov18: +Transmania and Taslimson per a slew of vandalism, no valid occurrences of the term as of this date -C\r\n\r\n-Transmania as covered in filter 614 -Galo","group":"default","actions":{"disallow":["abusefilter-disallowed"]},"enabled":true,"deleted":false,"privacylevel":0,"global":false},"actions":{"disallow":["abusefilter-disallowed"]}}

Actions to take when matched

Trigger actions only if the user trips a rate limit

Number of actions to allow:

Period of time (in seconds):

Group throttle by:

user

See the documentation on mediawiki.org.

Trigger these actions after giving the user a warning

System message to use for warning:

Page name of other message:

(without "MediaWiki:" prefix)

Prevent the user from performing the action in question

System message to use for disallowing:

Page name of other message:

(without "MediaWiki:" prefix)

Revoke the user's autoconfirmed status

Tag the edit for further review

Tags to apply:

Require the user to complete a CAPTCHA in order to proceed with the action. Users with permission to skip a CAPTCHA are exempt.