The first block was an attempt to block "Ks0s got STUNG due to INCOMPETENCE of CIDR/17 block" instead, with a forward slash instead of a backslash. From the API log file:

2017-12-19 00:47:37 [WjhhqQpAMCIAAE9OseMAAAAU] mw1202 enwiki 1.31.0-wmf.12 api INFO: API POST Oshwah [redacted] T=49ms action=block format=json user=Ks0s%20got%20STUNG%20due%20to%20INCOMPETENCE%20of%20CIDR/17%20block reason=%5B%5BWP:SOCK%7Csock%20puppetry%5D%5D nocreate=true autoblock=true noemail=true token=[redacted]

The API rejects usernames that are valid but refer to nonexistent users and usernames that are valid but unusable. It does not, however, reject usernames that are invalid, including IP addresses and names with forward slashes in them. Instead, it passes them to the backend code in SpecialBlock, which gets into Block::parseTarget() to determine the actual target. And that strips anything after a forward slash with a comment referring to T31797.

OK, thank you for figuring that out :) I +2'd https://gerrit.wikimedia.org/r/#/c/399190/ and I'd like to backport that if it cherry-picks cleanly. If there's no security issue I think we can make this task public?

I don't see any need for this task to be private.

@Legoktm: Are you still planning to backport, or should we close this?

@Legoktm: ping - could you answer the last question please? TIA