Steward requests/Checkuser

From Meta, a Wikimedia project coordination wiki
Jump to: navigation, search
Requests and proposals Steward requests (Checkuser) latest archive
Checkuser icons
These indicators are used by CheckUsers and stewards for easier skimming of their notes, actions and comments.
{{Confirmed}}: Confirmed Confirmed {{MoreInfo}}: MoreInfo Additional information needed
{{Likely}}: Likely Likely {{Deferred}}: Deferred Deferred to
{{Possible}}: Possible Possible {{Completed}}: Completed Completed
{{Unlikely}}: Unlikely Unlikely {{TakeNote}}: Note Note:
{{Unrelated}}: Unrelated Unrelated {{Doing}}: Symbol wait.svg Doing...
{{Inconclusive}}: Inconclusive Inconclusive {{StaleIP}}: Stale Stale
{{Declined}}: Declined Declined {{Fishing}}: Fishing CheckUser is not for fishing
{{Pixiedust}}: Pixiedust CheckUser is not magic pixie dust {{8ball}}: 8ball The CheckUser Magic 8-Ball says
{{Duck}}: Duck It looks like a duck to me {{Crystalball}}: Crystalball CheckUser is not a crystal ball

This page is for requesting CheckUser information on a wiki with no local CheckUsers (see also requesting checkuser access). Make sure to follow the following instructions, or your request may not be processed in a timely manner.

Before making a request:

  1. Make sure you have a good reason for the check. It will only be accepted to counter vandalism or disruption to Wikimedia wikis. Valid reasons include needing a block of the underlying IP or IP range, disruptive sockpuppetry, vote-stacking, and similar disruption where the technical evidence from running a check would prevent or reduce further disruption.
  2. Be specific in your reasons. Ambiguous or insufficient reasons will cause delays. Explain the disruption and why you believe the accounts are related, ideally using diff links or other evidence.
  3. Make sure there are no local checkusers or policies.
  4. Please ensure that the check hasn't already been done:

How to make a request

How to make a request:

  • Place your request at the bottom of the section, using the template below (see also {{srcu}} help).
    === Username@xx.project ===
    {{CU request
     |status          = <!--don't change this line-->
     |language code   = 
     |project shortcut= 
     |user name1      = 
     |user name2      = 
     |user name3      = 
    <!-- Max 10 users -->
     |discussion      = [[Example]]<!-- local confirmation link / local policy link -->
     |reason          = Reasons here. ~~~~

    For example:

    === Example@en.wikipedia ===
    {{CU request
     |status          = <!--don't change this line-->
     |language code   = en
     |project shortcut= w
     |user name1      = Example
     |user name2      = Foo
     |user name3      = Bar
    <!-- Max 10 users -->
     |discussion      = [[:w:en:Example]]<!-- local confirmation link / local policy link -->
     |reason          = Reasons here. ~~~~
  • Specify the wiki(s) you want to perform the check on.
Cross-wiki requests
Meta-Wiki requests



Where are these users participants and what makes you think there could be a link? --MF-W 23:39, 18 January 2015 (UTC)
[1], participant (Lakiditto098) said that his brother allegedly Gagik (Gagik18).--6AND5 (talk) 10:59, 19 January 2015 (UTC)
[2]--6AND5 (talk) 11:02, 19 January 2015 (UTC)
@6AND5: that still doesn't indicate the purpose of knowing that they are related parties. An interest in a relationship alone is not a reason for checkuser. There would be need for a proof of wrongdoing, circumventing votes, circumventing blocks, etc.  — billinghurst sDrewth 07:03, 24 January 2015 (UTC)
The question is that the participant (Lakiditto098 (same 1221nor, Lilit1345, Karenpetrosyan)The following accounts are Confirmed Confirmed) is blocked (unlimited), and now his brother allegedly began to write articles. --6AND5 (talk) 14:11, 24 January 2015 (UTC)
If it is his brother that may or may not mean the same IP address. It may or may not mean the same user agents, etc. There is nothing that we can do that is going to differentiate that sort of relationship and you will need to work it out for yourself.  — billinghurst sDrewth 11:24, 25 January 2015 (UTC)
Member admitted he and his brother one person.--6AND5 (talk) 14:04, 25 January 2015 (UTC)
Thanks for getting back to us. Closed Closed Issue resolved by community.  — billinghurst sDrewth 14:05, 25 January 2015 (UTC)

Dr. Syed Shahzad Ali Najmi@en.wikipedia[edit]

Dr. Syed Shahzad Ali Najmi[edit]

With reference to previous investigation Dr. Syed Shahzad Ali Najmi/Archive can the following two can be identified as the Sockpuppet.

Reason: Keeps on adding and supporting about Shahzad Ali Najmi and his book, used for commercial advertising.

As the previous Sockpuppets which were Blocked in English Wikipedia and later on Urdu Wikipedia, these two users are acting as the same.

Please confirm if the are Sockpuppets. --Tahir mq (talk) 05:27, 18 January 2015 (UTC)

 Not done. has local checkusers. Savhñ 13:55, 20 January 2015 (UTC)


Time2wait.svg pending close of admin decision process I do not believe that this should be undertaken at this time, if required they can be taken when the vote is to be closed and is a demonstrated need. There is a history of alternate accounts.  — billinghurst sDrewth 06:36, 24 January 2015 (UTC)
The very reason this is requested, now, is because there may be possible subversion of the admin request process, using sock accounts, by a user confirmed to maintain a 200 plus sockfarm and has abused sock accounts before. -- Cirt (talk) 06:40, 24 January 2015 (UTC)
As mentioned, I know the history well. When it is closed we can do the checks, prior to a decision. There is no advantage and no demonstrated urgency for doing checks now, and it could be seen to pervert the discussion if they are not socks. Whilst suspicions can be checked, we still need to assume good faith.  — billinghurst sDrewth 06:45, 24 January 2015 (UTC)
It will potentially pervert the discussion to allow possible socks to comment in the discussion while it is ongoing, creating potential for follow-on-voting based upon possible socking, during the voting period itself. -- Cirt (talk) 06:48, 24 January 2015 (UTC)
Then please gain a consensus of your community to have these checks undertaken prior to the close.  — billinghurst sDrewth 06:51, 24 January 2015 (UTC)
Thank you for this recommendation, requested, at [3]. -- Cirt (talk) 07:09, 24 January 2015 (UTC)
We never require a consensus of the community for conducting a check; can you point me to a policy that says this? We should only be checking to see whether the request follows the CU policy and the privacy policy. What is even more disturbing is that this sets the precedent that community consensus can direct that a check is run, thus violating someone's privacy. --Rschen7754 17:02, 24 January 2015 (UTC)
Thank you for your helpful comment, Rschen7754, most appreciated. -- Cirt (talk) 22:59, 24 January 2015 (UTC)
  • As one of the few bureaucrats on Wikiquote, I support running a Checkuser investigation on the two editors identified above, although for slightly different reasons than Cirt proposes. Wikiquote has lately been deluged by a vandal (or team of vandals) using multiple accounts to disrupt the operations of the cite generally, and engaging in a pattern of behavior wherein an account will make a few legitimate edits before launching into disruptive attacks (of which Kalki has been a frequent target). In this light, I agree that it is suspicious for the two identified low-volume editors to have appeared in an adminship discussion as they have - even if this is totally unrelated to any past actions by Kalki. This is particularly the case for User:Gene96, who has edited nowhere else in any Wikimedia project. I also believe that it would be a mistake to require a community consensus on the point, if there is any possibility that such consensus could be tainted by sockupuppetry occurring in that discussion. BD2412 T 22:35, 24 January 2015 (UTC)
    • Agree here with BD2412. -- Cirt (talk) 22:59, 24 January 2015 (UTC)
      • I also note that Kalki has stated in the Wikiquote discussion initiated by Cirt that he has no objection to having his status checked. Cheers! BD2412 T 01:09, 25 January 2015 (UTC)
Yes check.svg Done, not socks of Kalki. They are socks and of another person who has voted. I have struck the votes.  — billinghurst sDrewth 12:10, 25 January 2015 (UTC)
Which other person who has voted are they socks of, Billinghurst? -- Cirt (talk) 17:04, 25 January 2015 (UTC)
Cirt blocked both accounts as socks, but of whom? I'm concerned. Someone in that RfA attempted to disrupt or warp it. I think Wikiquote needs to know. Thanks. --Abd (talk) 21:03, 25 January 2015 (UTC)
Agreed. -- Cirt (talk) 21:12, 25 January 2015 (UTC)
I also agree. If there is another editor of whom these are sockpuppets, we should know who that is, as they are engaging in prohibited conduct. BD2412 T 21:59, 25 January 2015 (UTC)
Thank you, BD2412, then it seems we in the en.wikiquote local community are unanimous in requesting more information about who else is connected to these sockpuppets as the sockmaster and other socks. -- Cirt (talk) 03:00, 26 January 2015 (UTC)
When multiple accounts are in breach of community policy, it is usually the protocol to link to that policy though I went and found that policy on this occasion. It is my opinion that getting the person to self-disclose may be more valuable for a resolution and an explanation, and ask that you try that on this occasion. If the person chooses to not to disclose then I am comfortable releasing that information.  — billinghurst sDrewth 05:51, 26 January 2015 (UTC)
Billinghurst, this is quite curious, and not how it's normally done at Wikiquote or Wikipedia, to my experience. We are unanimous in asking you, in a request from our local Wikiquote community, to reveal the connected sock accounts. You said the data is unequivocal. We're not asking for IP addresses. Merely to identify all the confirmed socks together. Please. Thank you, -- Cirt (talk) 06:26, 26 January 2015 (UTC)
I've now made the request for whoever is behind those accounts to self-disclose in a comment at q:Wikiquote:Requests for adminship/Kalki (4th request). I must say this is quite odd, and against the unanimous consensus of our local Wikiquote community. Again: We the local Wikiquote community please ask Billinghurst to identify all accounts Confirmed Confirmed as tied to sock accounts Gene96 (talk · contribs) and Jimmy11234 (talk · contribs). -- Cirt (talk) 06:35, 26 January 2015 (UTC)
Cirt, I have not refused to provide the detail and I clearly state that above. I have suggested that for a community in dispute that you try self-disclosure. There is no vandalism, there is no urgency, so please try a diplomatic approach to a resolution, rather than your current approach of looking to smash heads. (Please don't overstate your case, three people does not equal unanimity.) I ask you to employ some circumspection, reflect on why your community has got itself into this situation, and look to an outcome that is beneficial to the community.  — billinghurst sDrewth 06:49, 26 January 2015 (UTC)
Billinghurst, each of your statements are more confusing! What do you mean by "community in dispute"? What do you mean by "why your community has got itself into this situation"? Either some third party at the ongoing Request for Adminship is part of the socking, or not, right? You already stated that was the case. Now, I've followed your advice, and posted to the RFA page with a formal request for that third-party to self-disclose. But I just for the life of me can't understand your behavior here. Please, enlighten me, why is this particular case so unique? -- Cirt (talk) 07:05, 26 January 2015 (UTC)
Do you really think that this is the place for such a discussion? I don't. Take some time to reflect, read between the lines.  — billinghurst sDrewth 07:31, 26 January 2015 (UTC)
Billinghurst, I'm sorry, I'm trying to understand, but I really don't know what you mean. I don't even know what you're implying. I don't even know why you don't think this is the place for a discussion about Checkuser results. Can you please explain it to me? Please? Please, Billinghurst, I'm trying to understand here. I've notified most of the users that voted before your action at the Request for Adminship. I've posted a notice at the Request for Adminship, asking users to please self-disclose if they are related to the other two Confirmed Confirmed sock accounts. I just don't understand what you're hinting at here, and why this isn't the place? -- Cirt (talk) 07:34, 26 January 2015 (UTC)
Perhaps others that commented above including Rschen7754, BD2412, or Abd are as confused as me as to why other sock account(s) at the Request for Adminship haven't been disclosed, and/or what else may be going on here. I guess I'm not clued into "read between the lines" as Billinghurst put it. Perhaps others have more clue than I, so maybe they'll comment with some insight. -- Cirt (talk) 07:49, 26 January 2015 (UTC)
I can see the value in maybe waiting 24-48 hours or so, but after that, the community deserves to know I think. --Rschen7754 14:37, 26 January 2015 (UTC)
Cirt was reasonably correct about "unanimity" in that there is no opposition. However, Billinghurst's restraint is also reasonable. I recommend that Cirt stop arguing here. Making the request was enough. Rschen7754, thanks. --Abd (talk) 15:17, 26 January 2015 (UTC)
Okay, I agree here with the idea by Rschen7754, above. Thank you, -- Cirt (talk) 15:41, 26 January 2015 (UTC)

There has been no self-disclosure, which means that CU disclosure is all that remains. The third and original username/account holder for this checkuser request is Miszatomic.  — billinghurst sDrewth 21:55, 27 January 2015 (UTC)

I've notified Miszatomic of this request. Tiptoety talk 22:42, 27 January 2015 (UTC)
Is this the same puppeteer as the several accounts named (only a fraction of those involved in a massive campaign of disruption) at WQ:AN#Twerp troll-vandal earlier this month with related content and locus of the activity. Is this also related to this case from last month with similar threatening behavior? At issue is whether we are dealing with a persistent long-term (very long-term) campaign of vandalism and harassment, or just a recent copycat. ~ Ningauble (talk) 17:00, 28 January 2015 (UTC)
  • I logged into the accounts when one of the vandals first said that his account password was Zarbon I logged into other vandals to check if they were vandals and used this information and took action to block other accounts immediately .
This is not about this case, Miszatomic is talking about other accounts, not the two identified socks here. He has already acknowledged being the two identified socks. --Abd (talk) 19:20, 28 January 2015 (UTC)
Note: This one can be closed, thank you. -- Cirt (talk) 22:13, 30 January 2015 (UTC)


Unrelated Unrelated. AFAICS, it would appear that each account has its own, distinct access point to Internet. There are some overlaps that suggest that there are indeed two different people [4] [5]. Elfix 19:36, 27 January 2015 (UTC)


Note: This one can be closed, thank you. -- Cirt (talk) 22:14, 30 January 2015 (UTC)
This has been addressed by other means.  — billinghurst sDrewth 14:21, 31 January 2015 (UTC)
Thanks. BD2412 T 14:51, 31 January 2015 (UTC)


The following aggregated IP addresses and associated ranges might be related:

All above IP addresses have been blocked previously on en.wikiquote for similar spates of vandalism.

Thank you, -- Cirt (talk) 17:01, 30 January 2015 (UTC)

One addition = Hellpraiser (talk · contribs) link, returned after a three (3) year absence. Impressive that the vandal / sockmaster still knows his password after that long. -- Cirt (talk) 17:27, 30 January 2015 (UTC)
Also please correlate check with Sir Knolte (talk · contribs), link, another account dormant for three (3) years, only to come back today, seemingly still knows its password. -- Cirt (talk) 17:34, 30 January 2015 (UTC)
Now see also -- Cirt (talk) 17:36, 30 January 2015 (UTC)
And also -- Cirt (talk) 17:58, 30 January 2015 (UTC)
Yes check.svg Done accounts locked, and other measures take to address concerns. To note the IP data is another known vandal, and if that point of origin vandal continues stewards have data for that xwiki vandal that can be applied.  — billinghurst sDrewth 14:23, 31 January 2015 (UTC)
Thank you! Which vandal is the other one? -- Cirt (talk) 20:19, 31 January 2015 (UTC)[edit]

See also[edit]