Editing abuse filter

Filter parameters

Filter ID:	28
Description: (publicly viewable)
Conditions:	(action == "createaccount" ) & !('override-antispoof' in user_rights) & ( lcase(accountname) rlike "[bcdfghjklmnpqrstvwxz]{9}" \| lcase(accountname) rlike "[0-9]{12}" \| lcase(accountname) rlike "[-bcdfghjklmnpqrstvwxz!@£$%^&()_+=0-9]{15}" \| accountname rlike "[\!\@\£\€\¥\₽\₹\$\%\^\&\\-\_\+\=\;\:\'\"\\|\\\?\<\>\,\.\/\[\]\`\~\±\§\{\}]{4}" ) (action == "createaccount" ) & !('override-antispoof' in user_rights) & ( lcase(accountname) rlike "[bcdfghjklmnpqrstvwxz]{9}" \| lcase(accountname) rlike "[0-9]{12}" \| lcase(accountname) rlike "[-bcdfghjklmnpqrstvwxz!@£$%^&()_+=0-9]{15}" \| accountname rlike "[\!\@\£\€\¥\₽\₹\$\%\^\&\\-\_\+\=\;\:\'\"\\|\\\?\<\>\,\.\/\[\]\`\~\±\§\{\}]{4}" )
Notes:	Exploratory filter; looks for new accounts containing strings with NINE consecutive consonants. Just intended for logging at the moment, to see how common these names are, and to what extent it is a good detector of bad usernames. So far, it's looking pretty good, even at 8 characters. Upgrading threshold to 9 to make it even more selective.-- The Anome, 12 May 2018 More investigation: now looks at only first edits for these accounts. -- The Anome, 18 May 2018 Performance improvements -- checking user_editcount will cancel out more actions in this case, so it should come first; similarly reordering other conditions to cancel out more actions; user_editcount < 2 will also be true for blank or false values, so removing !user_editcount to save a condition, and using contains_any for checking multiple actions to save a condition ~MA Removed all the filtering on event type and edit count. This is fascinating: the lack of output from the previous suggests that people are creating these random-typing accounts, but never using them... -- The Anome, 19 May 2018 Adding a dependency on wikitext, to see if that lets this filter see edits. Adding test to exclude highly repetitive usernames which would already have been caught by the repetition filter -- The Anome, 13 June 2018 Added a few running-finger-down-the-keyboard patterns. -- The Anome, 25 October 2018 Fixed implementation error which had the reverse effect of that intended above -- The Anome, 31 October 2018 Added alphabetical-progression patterns. -- The Anome, 2 November 2018 Backed off alphabet/keyboard progression patterns, following feedback. -- The Anome, 3 November 2018 Removed filter that prevented overlap with repetition filter: won't actually increase blocking, just more reporting will be evident here. -- The Anome, 7 December 2018 Fix warn/disallow messages; disallow was from filter 887 --SoY 4 Mar 2019 Allow anyone with override-antispoof rights to bypass the filter. Presently, user_rights is undefined for new users, so checking ('override-antispoof' in user_rights) will cause the filter to fail. One [[phab:T230256]] is implemented, user_rights will be null instead. So use a conditional expression that will work in either case. Also allowing ALL autocreations, since that was the behavior before the most recent change. Setting to log-only for a bit in case things go totally haywire. --Soy 18 October 2019 Disallowing --SoY 19 October 2019 Now adding 12 or more successive digits as "random typing" -- The Anome, 6 December 2021 Adding a new version which requires a longer match-string, but allows for top-keyboard-row punctuation characters to catch things like "H&5d&j^db7dH76dgy6f8F876tfg76ETF" -- The Anome, 21 December 2021 Handling autocreateaccount as well as createaccount - The Anome, 24 August 2022 Reverting. - The Anome, 24 August 2022 Rm T230256 workaround. --Suffusion of Yellow 00:07 4 Dec 2022 Now detects four or more consecutive punctuation characters, including pound sterling, euro and other currency signs to allow for international keyboards. -- The Anome, 28 April 2023
Flags:	Hide details of this filter from public view Enable this filter Mark as deleted
Filter last modified:	18:28, 27 May 2024 by Mausterio (talk \| contribs)
History:	View this filter's history
Tools:	Export this filter to another wiki {"data":{"rules":"(action == \"createaccount\" ) \u0026\r\n!('override-antispoof' in user_rights) \u0026\r\n(\r\n lcase(accountname) rlike \"[bcdfghjklmnpqrstvwxz]{9}\" \|\r\n lcase(accountname) rlike \"[0-9]{12}\" \|\r\n lcase(accountname) rlike \"[-bcdfghjklmnpqrstvwxz!@\u00a3$%^\u0026()_+=0-9]{15}\" \|\r\n accountname rlike \"[\\!\\@\\\u00a3\\\u20ac\\\u00a5\\\u20bd\\\u20b9\\$\\%\\^\\\u0026\\\$\$\\-\\_\\+\\=\\;\\:\\'\\\"\\\|\\\\\\?\\\u003C\\\u003E\\,\\.\\/\\[\\]\\`\\~\\\u00b1\\\u00a7\\{\\}]{4}\"\r\n)","name":"Random typing in username","comments":"Exploratory filter; looks for new accounts containing strings with NINE consecutive consonants. Just intended for logging at the moment, to see how common these names are, and to what extent it is a good detector of bad usernames.\r\n\r\nSo far, it's looking pretty good, even at 8 characters. Upgrading threshold to 9 to make it even more selective.-- The Anome, 12 May 2018\r\n\r\nMore investigation: now looks at only first edits for these accounts. -- The Anome, 18 May 2018\r\n\r\nPerformance improvements -- checking user_editcount will cancel out more actions in this case, so it should come first; similarly reordering other conditions to cancel out more actions; user_editcount \u003C 2 will also be true for blank or false values, so removing !user_editcount to save a condition, and using contains_any for checking multiple actions to save a condition ~MA\r\n\r\nRemoved all the filtering on event type and edit count. This is fascinating: the lack of output from the previous suggests that people are creating these random-typing accounts, but never using them... -- The Anome, 19 May 2018\r\n\r\nAdding a dependency on wikitext, to see if that lets this filter see edits.\r\n\r\nAdding test to exclude highly repetitive usernames which would already have been caught by the repetition filter -- The Anome, 13 June 2018\r\n\r\nAdded a few running-finger-down-the-keyboard patterns. -- The Anome, 25 October 2018\r\nFixed implementation error which had the reverse effect of that intended above -- The Anome, 31 October 2018\r\n\r\nAdded alphabetical-progression patterns. -- The Anome, 2 November 2018\r\n\r\nBacked off alphabet/keyboard progression patterns, following feedback. -- The Anome, 3 November 2018\r\n\r\nRemoved filter that prevented overlap with repetition filter: won't actually increase blocking, just more reporting will be evident here. -- The Anome, 7 December 2018\r\n\r\nFix warn/disallow messages; disallow was from filter 887 --SoY 4 Mar 2019\r\n\r\nAllow anyone with override-antispoof rights to bypass the filter. Presently, user_rights is undefined for new users, so checking ('override-antispoof' in user_rights) will cause the filter to fail. One [[phab:T230256]] is implemented, user_rights will be null instead. So use a conditional expression that will work in either case. Also allowing ALL autocreations, since that was the behavior before the most recent change. Setting to log-only for a bit in case things go totally haywire. --Soy 18 October 2019\r\nDisallowing --SoY 19 October 2019\r\n\r\nNow adding 12 or more successive digits as \"random typing\" -- The Anome, 6 December 2021\r\n\r\nAdding a new version which requires a longer match-string, but allows for top-keyboard-row punctuation characters to catch things like \"H\u00265d\u0026j^db7dH76dgy6f8F876tfg76ETF\" -- The Anome, 21 December 2021\r\n\r\nHandling autocreateaccount as well as createaccount - The Anome, 24 August 2022\r\n\r\nReverting. - The Anome, 24 August 2022\r\n\r\nRm T230256 workaround. --Suffusion of Yellow 00:07 4 Dec 2022\r\n\r\nNow detects four or more consecutive punctuation characters, including pound sterling, euro and other currency signs to allow for international keyboards. -- The Anome, 28 April 2023","group":"default","actions":{"disallow":["abusefilter-disallowed-random-typing-username"]},"enabled":true,"deleted":false,"hidden":false,"global":false},"actions":{"disallow":["abusefilter-disallowed-random-typing-username"]}}

Actions to take when matched

Trigger actions only if the user trips a rate limit

Number of actions to allow:

Period of time (in seconds):

Group throttle by:

user

See the documentation on mediawiki.org.

Trigger these actions after giving the user a warning

System message to use for warning:

Page name of other message:

(without "MediaWiki:" prefix)

Prevent the user from performing the action in question

System message to use for disallowing:

Page name of other message:

(without "MediaWiki:" prefix)

Revoke the user's autoconfirmed status

Block the user and/or IP address from editing

Block the user and/or IP address from editing their own talk page

Block duration for non-registered users:

Block duration for registered users:

Tag the edit for further review

Tags to apply: