Steward requests/Checkuser

Shortcut:
SRCU

Checkuser icons
These indicators are used by CheckUsers and stewards for easier skimming of their notes, actions and comments.
{{Confirmed}}: Confirmed	{{MoreInfo}}: Additional information needed
{{Likely}}: Likely	{{Deferred}}: Deferred to
{{Possible}}: Possible	{{Completed}}: Completed
{{Unlikely}}: Unlikely	{{TakeNote}}: Note:
{{Unrelated}}: Unrelated	{{Doing}}: Doing...
{{Inconclusive}}: Inconclusive	{{StaleIP}}: Stale
{{Declined}}: Declined	{{Fishing}}: CheckUser is not for fishing
{{Pixiedust}}: CheckUser is not magic pixie dust	{{8ball}}: The CheckUser Magic 8-Ball says
{{Duck}}: It looks like a duck to me	{{Crystalball}}: CheckUser is not a crystal ball

<translate> This page is for requesting CheckUser information on a wiki with no local CheckUsers (see also [[<tvar name="SRP">Steward requests/Permissions</tvar>|requesting checkuser access]]). Make sure to follow the following instructions, or your request may not be processed in a timely manner.</translate>

<translate> Before making a request:</translate>

<translate> Make sure you have a good reason for the check. It will only be accepted to counter vandalism or disruption to Wikimedia wikis. Valid reasons include needing a block of the underlying IP or IP range, disruptive sockpuppetry, vote-stacking, and similar disruption where the technical evidence from running a check would prevent or reduce further disruption.</translate>
<translate> Be specific in your reasons. Ambiguous or insufficient reasons will cause delays. Explain the disruption and why you believe the accounts are related, ideally using [[<tvar name="diff">mw:Special:MyLanguage/Help:Diff</tvar>|diff links]] or other evidence.</translate>
<translate> Make sure there are no local checkusers.</translate>
- Wikimedia: meta • commons • species • data
- Wikipedia: ar • bn • ca • cs • da • de • en • es • fa • fi • fr • he • hu • id • it • ja • ko • ml • nl • pl • pt • ro • ru • simple • sl • sr • sv • th • tr • uk • vi • zh
- Wikibooks: en
- Wikinews: en
- Wiktionary: en
<translate> Please ensure that the check hasn't already been done:</translate>

<translate> How to make a request</translate>

<translate> How to make a request:</translate>

<translate> Place your request at the bottom of the section, using the template below (see also [[<tvar name="Srcu">Template:Srcu/doc#Usage</tvar>|<tvar name="Srcu2">{{srcu}}</tvar> help]]).</translate>

=== Username@xx.project ===
{{CU request
 |status          = <!--don't change this line-->
 |language code   = 
 |project shortcut= 
 |user name1      = 
 |user name2      = 
 |user name3      = 
<!-- Max 10 users -->
 |discussion      = <translate><!--T:11--> [[Example]]<!-- local confirmation link / local policy link --></translate>
 |reason          = <translate><!--T:12--> Reasons here</translate>. ~~~~
}}

<translate> For example:</translate>

=== Example@en.wikipedia ===
{{CU request
 |status          = <!--don't change this line-->
 |language code   = en
 |project shortcut= w
 |user name1      = Example
 |user name2      = Foo
 |user name3      = Bar
<!-- Max 10 users -->
 |discussion      = <translate><!--T:14--> [[:w:en:Example]]<!-- local confirmation link / local policy link --></translate>
 |reason          = <translate><!--T:15--> Reasons here.</translate> ~~~~
}}

<translate> Specify the wiki(s) you want to perform the check on.</translate>

Cross-wiki requests
CheckUser information Global blocks/locks Permissions (global) Permissions (bot) Permissions (other) Username changes/ usurpation requests Miscellaneous requests URL blacklisting Title/username blacklisting Email blacklisting
Meta-Wiki requests
CheckUser information Deletion Permissions Requests for help

Requests

MS Vandal

Resolved.

SiapaPerluBertanggungjawabMH370 [stalktoy] – [cross-wiki edits]

How come this new user can create a lot of edit. Isn`t there a limit for new user edit? Yosri (talk) 22:38, 10 April 2014 (UTC)[reply]

If there is a limit, then it wasn't editing fast enough to trigger it. There is a main IP being used which has now been autoblocked, though like QU said above they are using a couple of IPs. I'll email you the main IP to block if you wish. Ajraddatz (talk) 23:07, 10 April 2014 (UTC)[reply]

Let me consult with another admin. Tq for your assistant. Yosri (talk) 05:44, 11 April 2014 (UTC)[reply]

I agree the main IP should be properly blocked. An autoblock doesn't last very long. ...Aurora... (talk) 15:24, 11 April 2014 (UTC)[reply]

DedahKebenaranMH370 [stalktoy] – [cross-wiki edits] Yosri (talk) 11:03, 12 April 2014 (UTC)[reply]

CariPembunuhMH370 [stalktoy] – [cross-wiki edits] Yosri (talk) 19:03, 12 April 2014 (UTC)[reply]

TakUsahMembelaKerajaanLembabMH370 [stalktoy] – [cross-wiki edits] Yosri (talk) 23:09, 14 April 2014 (UTC)[reply]

Locked these three. Unfortunately an IP block isn't stopping them. Ajraddatz (talk) 23:12, 14 April 2014 (UTC)[reply]

Thank you for your assistant. As we (MS) have no checkuser, I will update here as and when it happen. Your assistant in blocking the IP is much appreciated. What will happen, will happen. Yosri (talk) 01:43, 15 April 2014 (UTC)[reply]

Keamanansejagat [stalktoy] – [cross-wiki edits] Yosri (talk) 08:45, 16 April 2014 (UTC)[reply]

KelakuanKejamPembunuhMH370 [stalktoy] – [cross-wiki edits] Yosri (talk) 23:12, 20 April 2014 (UTC)[reply]

I've locked them all, but per this comment I don't think a CU is useful now anymore. If I'm wrong, do correct me please. Trijnstel_talk 18:59, 13 May 2014 (UTC)[reply]

Gilemard-tabarestan@fa.wikipedia

Status: Done

List of users: کولاک (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); 66.135.33.230 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); 174.34.166.10 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); 93.115.85.170 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

Reason(s): The old problem on Persian Wikipedia has arisen again! Earlier this month I asked the stewards to open an investigation concerning disruptive behavior of User:کولاک. Unfortunately, all of his socks were stale and could not be checked. ‌But luckily, the number of similarities were sufficient to convince administrators to block his account indefinitely (4 admins confirmed sock puppetry based on looking at his contributions). But again a newly-created account and some IPs (probably open proxies) began to do the same edits. I have no doubt that duck test applies here and if I were an admin, I would block the newly-created account indefinitely. I think this CU investigation might not be a good idea because the user is probably using open proxies and even has considered using different browsers on different platforms to mislead stewards. By the way, I'm just doing what User:Mehran (admin on Persian Wikipedia) suggested me to do. 4nn1l2 (talk) 15:05, 25 May 2014 (UTC)[reply]

If the IP addresses are known, then there is no need to do a CU check; and if the IP addresses are problematic they can easily be blocked individually or by range, especially 174.34.164.0/22 which is a ubiquity range. If the account is problematic, then it can be blocked without knowing if it is associated with the IP addresses. I am not seeing what a CU check will provide outside what you already know. My feeling is that this should be marked "not done", though happy to hear a counter argument on how CU data may be helpful. — billinghurst sDrewth 12:51, 1 June 2014 (UTC)[reply]

@Billinghurst: How about "Gilemard-tabarestan"? Could you please check if it is the same "کولاک"? Since the latter has been blocked, editing with a new account would not be admissible. In fact this CU request is based on the similarity of these two accounts, but User:4nn1l2 asked me to re-block the main account due to editing with a SP and some IPs during the blocking term and I should have an evidence in order to do it. Mehran^Debate 13:41, 1 June 2014 (UTC)[reply]

Inconclusive there are some common factors, there are factors of difference, and if pushed, I would say less likely but truly not enough information if relying on CU data. There is no evident relationship between the IPs listed and any of the accounts. — billinghurst sDrewth 14:42, 1 June 2014 (UTC)[reply]

Thanks a lot. Mehran^Debate 10:48, 2 June 2014 (UTC)[reply]

Aqui mando yo@es.wikivoyage

Status: In progress

List of users: Municipalidad de Trujillo‎ (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); ‎31.220.3.10 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

CU log
Discussion: [1]

Reason(s): Vandalism (is disrupting the good environment of the wiki by doing harmful edits). Please check if the account and IP is related to Geógrafo23. Zerabat (discusión) 03:24, 1 June 2014 (UTC)[reply]

Also, the IP 31.220.3.10 left me a pair of messages [2] [3] threatening of death to me. --Zerabat (discusión) 03:55, 1 June 2014 (UTC)[reply]

@Zerabat: If the accounts or the IP addresses are problematic then block them. I do not see how a CU helps or what information you believe that it will provide. FWIW the Belize IP address is unlikely to be the named vandal. So I don't see that a CU helps though happy to hear how you believe that it will help. — billinghurst sDrewth 12:58, 1 June 2014 (UTC)[reply]

Multiple IPs @brwikimedia and @metawiki

Status: Not done

List of users: 189.38.142.144 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); 189.38.142.39 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); 189.38.144.89 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

CU log

Reason(s):

189.38.143.158 and 189.38.144.144 have made some personal attacks on brwikimedia weeks ago
189.38.142.39 and 189.38.142.144 (edited today) have made also some here on Meta
189.38.145.254 and 189.38.142.110 have also done some personal attacks on brwikimedia, buth months ago.

I believe that those IP addresses are an attempt of Rodrigo_Tetsuo_Argenton [stalktoy] – [cross-wiki edits]/R.T.Argenton [stalktoy] – [cross-wiki edits]/Rodrigo.Argenton [stalktoy] – [cross-wiki edits] to hide new personal attacks within its main account. At time of personal attacks on brwikimedia he wasn't blocked on brwikimedia, but on ptwikipedia. A cross-check between brwikimedia, metawiki and ptwikinews may be enough to confirm my suspicion.

A brief summary of reasons that most pt-N users aren't willing to further work with Argenton is available at this edit. Those are also the reasons that can enforce an attempt from him to hide some of his personal attacks: give the impression that many hates our actions, not only that an entire community is gradually choosing to simply ignore Argenton's existence (we have disagreements, but not at the level that Argenton tries to advertise in places such his infamous RfC). Lugusto • ※ 01:23, 5 June 2014 (UTC)[reply]

(Non-steward observation) Unless the abuse is very extreme, we will not connect IP addresses with accounts.--Jasper Deng (talk) 01:43, 5 June 2014 (UTC)[reply]

If trolling an entire community and trying to damage any attempt to make outreach actions isn't very abusive, I simply can't realize what should be considered as an very extreme abusive behaviour. Lugusto • ※ 03:21, 5 June 2014 (UTC)[reply]

In this case just block these IPs. Ruslik (talk) 19:25, 6 June 2014 (UTC)[reply]

He, as expected, keeps saying that isn't the same user. Isn't possible to run a check without making the results available to the public but at least sending a private (Special:EmailUser) alert to Argenton (or whatever else that is behind those IPs) to just stop and, in case of future abusive behaviour here on meta, doing an indef block to his local (meta) user accounts (since the local accounts are timed or indef blocked)? Lugusto • ※ 18:00, 7 June 2014 (UTC)[reply]

As a local checkuser at meta, I can have a look at the local edits, and look to discuss any issue that may arise if I consider there has been local abuse. I doubt that a report can be made here about the checks at such an early stage of an inquiry. — billinghurst sDrewth 15:47, 8 June 2014 (UTC)[reply]

@555: As a note to the original IPs that were supplied, you can block 189.38.142.0/24, 189.38.143.0/24, 189.38.144.0/23 as they are in a reasonable tight range. Make them anonymous only, and not allow user account creations. It is a case of watch and act so that the person abusing is restricted or prevented from acting. Whether your communities wish to act with someone will require to be a separate matter at this point of time. At some point these vandals slip up (and they have to be really really clever), and rather than just getting a warning, the consequences are more severe. — billinghurst sDrewth 15:59, 8 June 2014 (UTC)[reply]

Thanks, billinghurst. I've blocked those on brwikimedia and on ptwikisource (this last one because a portion of personal attacks was directed to me and is possible that the user behind those IPs tries new ways to provoke me). Lugusto • ※ 20:04, 8 June 2014 (UTC)[reply]

Requests

MS Vandal

Gilemard-tabarestan@fa.wikipedia

Aqui mando yo@es.wikivoyage

Multiple IPs @brwikimedia and @metawiki

See also