Page MenuHomePhabricator
Create Task
Maniphest T237282

Topviews Analysis of the Hungarian Wikipedia is flooded with spam
Closed, ResolvedPublic
Actions

Description

Since October, due some kind of spam, sex and narcotic-related articles are the most viewed articles of the Hungarian Wikipedia. For background, here you can read about the scandal.

Today as an example:
Home page 28k+
Cannabis 13k+
Oral sex 12k+

As you can see, the numbers of these articles are constant and almost the same.

pageviews-20191001-20191102.png (434×869 px, 58 KB)

https://tools.wmflabs.org/pageviews/?project=hu.wikipedia.org&platform=all-access&agent=user&start=2019-10-01&end=2019-11-02&pages=Or%C3%A1lis_szex|Metil%C3%A9ndioxi-metamfetamin|Kannabisz|Kokain|Szifilisz|H%C3%ADmvessz%C5%91%7CAn%C3%A1lis_szex|LSD|Hepatitis_C|Kank%C3%B3

Related Objects
Search...

Event Timeline

Bencemac created this task.Nov 4 2019, 5:27 PM
Restricted Application added subscribers: MusikAnimal, Aklapper. · View Herald TranscriptNov 4 2019, 5:27 PM
Bencemac updated the task description. (Show Details)Nov 4 2019, 5:28 PM
Tacsipacsi subscribed.Nov 6 2019, 10:05 AM
• Nuria subscribed.Nov 6 2019, 7:06 PM

This is a bot, see patterns that are symmetric per UA (just looked at Orális_szex page)

+---+-------------+-------------------+------------------------------------------------------------+

cipgeocoded_data[city]ua

+---+-------------+-------------------+------------------------------------------------------------+

309167.xFrankfurt am MainMozilla/5.0 (Linux; Android 7.0; SM-G930V Build/NRD90M) Appl
300167.xFrankfurt am MainMozilla/5.0 (iPhone; CPU iPhone OS 10_3_1 like Mac OS X) App
275167.xFrankfurt am MainMozilla/5.0 (Linux; U; Android 4.4.2; en-us; SCH-I535 Build/
267167.xFrankfurt am MainMozilla/5.0 (Android 7.0; Mobile; rv:54.0) Gecko/54.0 Firefo
1661167.xFrankfurt am MainMozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/201
1641167.xFrankfurt am MainMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
159167.xFrankfurt am MainMozilla/5.0 (Windows NT 10.0; Win64; x64; rv:70.0) Gecko/201
144167.xFrankfurt am MainMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
102167.xFrankfurt am MainMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
86167.xFrankfurt am MainMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36

+---+-------------+-------------------+------------------------------------------------------------+

• Nuria added a comment.Nov 6 2019, 7:07 PM

This is a bot, see patterns that are symmetric per UA (just looked at Orális_szex page)

+---+-------------+-------------------+------------------------------------------------------------+

cipgeocoded_data[city]ua

+---+-------------+-------------------+------------------------------------------------------------+

309167.xFrankfurt am MainMozilla/5.0 (Linux; Android 7.0; SM-G930V Build/NRD90M) Appl
300167.xFrankfurt am MainMozilla/5.0 (iPhone; CPU iPhone OS 10_3_1 like Mac OS X) App
275167.xFrankfurt am MainMozilla/5.0 (Linux; U; Android 4.4.2; en-us; SCH-I535 Build/
267167.xFrankfurt am MainMozilla/5.0 (Android 7.0; Mobile; rv:54.0) Gecko/54.0 Firefo
1661167.xFrankfurt am MainMozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/201
1641167.xFrankfurt am MainMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
159167.xFrankfurt am MainMozilla/5.0 (Windows NT 10.0; Win64; x64; rv:70.0) Gecko/201
144167.xFrankfurt am MainMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
102167.xFrankfurt am MainMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
86167.xFrankfurt am MainMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36

+---+-------------+-------------------+------------------------------------------------------------+

• Nuria added a parent task: T138207: [Open question] Improve bot identification at scale.Nov 6 2019, 7:08 PM
• Nuria added a comment.Nov 6 2019, 7:20 PM

Numbers above are just for 1 hour.

• Nuria added a comment.EditedNov 6 2019, 7:23 PM

Also if you look at the pageviews from this IP from 1 day these are the titles requested.

+-----+----------------------+

cpage_title

+-----+----------------------+

353706521_Pina
34046FASZ_Pirszósz_Grevenón
32473Hüvely
31998Hímvessző
29105Pina_(folyó)
28810Pina_(település)
28529Pina_(film)
26318Anális_szex
25991Orális_szex
25752Ondó

+-----+----------------------+

• Nuria added a project: Analytics-Kanban.Nov 7 2019, 11:21 PM
• Nuria added a comment.Nov 7 2019, 11:50 PM

After running the data for hu.wikipedia through bot spikes detection the top list for 2019/10/16 looks like the following. Most rogue pages (marked in red) disappear, note that for a few pages about 80% of traffic is bot in nature. This are results for 2019/10/16

Screen Shot 2019-11-07 at 3.46.26 PM.png (870×2 px, 464 KB)

• Nuria added a comment.Nov 7 2019, 11:53 PM

Pinging here Product-Analytics so they are aware that effects of bots in "small" sites like these can be dramatic

Bencemac added a comment.Nov 11 2019, 4:15 PM

@Nuria Thanks for the details! Is there anything further we can do?

• Nuria added a subscriber: JAllemandou.Nov 11 2019, 4:16 PM

@Bencemac not for known, @JAllemandou and myself are thinking this quarter how to best deploy our bot spike detection algorithms, when we have more news we will send an update

Ottomata assigned this task to • Nuria.Nov 11 2019, 4:35 PM
Ottomata triaged this task as High priority.
Ottomata moved this task from Incoming to Data Quality on the Analytics board.
• Nuria removed a project: Analytics-Kanban.Nov 14 2019, 4:16 PM
• Nuria mentioned this in T207171: Have a way to show the most popular pages per country.Nov 14 2019, 7:12 PM
• Nuria mentioned this in T238357: Label high volume bot spikes in pageview data as automated traffic .Nov 14 2019, 7:20 PM
• Nuria mentioned this in T238358: Deploy high volume bot spike detector to hungarian wikipedia.Nov 14 2019, 7:23 PM
Bencemac added a project: Pageviews-Anomaly.Nov 18 2019, 4:15 PM

T123442 could be related.

Bencemac added a comment.Nov 23 2019, 7:08 PM

Since 19th of October, the flood has stopped (17th and 18th of October).

MusikAnimal removed a project: Tool-Pageviews.Jan 14 2020, 12:38 AM

Removing Tool-Pageviews as this is an issue with the underlying data, not the tool itself.

Bencemac added a comment.Feb 5 2020, 7:11 AM

The flood fortunately stopped, but the most viewed articles of 2019 is strongly occupied by them (5., 7., 8., 10–16., etc.). Would be a disclaimer possible and useful until they are gone? @MusikAnimal

• Nuria added a comment.Mar 17 2020, 5:08 PM

Update on this, we have deployed our identifying code to the pageview pipeline and it is being run on shadow mode (meaning end users do not yet see the results of the classification)

Bencemac added a comment.Mar 18 2020, 1:12 PM
In T237282#5976508, @Nuria wrote:

Update on this, we have deployed our identifying code to the pageview pipeline and it is being run on shadow mode (meaning end users do not yet see the results of the classification)

Excited to see. :)

Bencemac mentioned this in T249792: Abnormal peaks @ huwiki.Apr 9 2020, 7:12 AM
• Nuria added a comment.May 5 2020, 2:45 PM

The bot detection has been deployed, see: https://wikitech.wikimedia.org/wiki/Analytics/Data_Lake/Traffic/BotDetection

Closing this ticket as there are no actionables

• Nuria closed this task as Resolved.May 5 2020, 2:45 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL