Steward requests/Checkuser

Shortcut:
SRCU

Checkuser icons
These indicators are used by CheckUsers and stewards for easier skimming of their notes, actions and comments.
{{Confirmed}}: Confirmed	{{MoreInfo}}: Additional information needed
{{Likely}}: Likely	{{Deferred}}: Deferred to
{{Possible}}: Possible	{{Completed}}: Completed
{{Unlikely}}: Unlikely	{{TakeNote}}: Note:
{{Unrelated}}: Unrelated	{{Doing}}: Doing...
{{Inconclusive}}: Inconclusive	{{StaleIP}}: Stale
{{Declined}}: Declined	{{Fishing}}: CheckUser is not for fishing
{{Pixiedust}}: CheckUser is not magic pixie dust	{{8ball}}: The CheckUser Magic 8-Ball says
{{Duck}}: It looks like a duck to me	{{Crystalball}}: CheckUser is not a crystal ball

This page is for requesting CheckUser information on a wiki with no local CheckUsers (see also requesting checkuser access). Make sure to follow the following instructions, or your request may not be processed in a timely manner.

Before making a request:

Make sure you have a good reason for the check. It will only be accepted to counter vandalism or disruption to Wikimedia wikis. Valid reasons include needing a block of the underlying IP or IP range, disruptive sockpuppetry, vote-stacking, and similar disruption where the technical evidence from running a check would prevent or reduce further disruption.
Be specific in your reasons. Ambiguous or insufficient reasons will cause delays. Explain the disruption and why you believe the accounts are related, ideally using diff links or other evidence.
Make sure there are no local checkusers.
- Wikimedia: meta • commons • species • data
- Wikipedia: ar • bn • ca • cs • da • de • en • es • fa • fi • fr • he • hu • id • it • ja • ko • ml • nl • pl • pt • ro • ru • simple • sl • sr • sv • th • tr • uk • vi • zh
- Wikibooks: en
- Wikinews: en
- Wiktionary: en
Please ensure that the check hasn't already been done:

How to make a request

How to make a request:

Place your request at the bottom of the section, using the template below (see also {{srcu}} help).

=== Username@xx.project ===
{{CU request
 |status          = <!--don't change this line-->
 |language code   = 
 |project shortcut= 
 |user name1      = 
 |user name2      = 
 |user name3      = 
<!-- Max 10 users -->
 |discussion      = [[Example]]<!-- local confirmation link / local policy link -->
 |reason          = Reasons here. ~~~~
}}

For example:

=== Example@en.wikipedia ===
{{CU request
 |status          = <!--don't change this line-->
 |language code   = en
 |project shortcut= w
 |user name1      = Example
 |user name2      = Foo
 |user name3      = Bar
<!-- Max 10 users -->
 |discussion      = [[:w:en:Example]]<!-- local confirmation link / local policy link -->
 |reason          = Reasons here. ~~~~
}}

Specify the wiki(s) you want to perform the check on.

Cross-wiki requests
CheckUser information Global blocks/locks Permissions (global) Permissions (bot) Permissions (other) Username changes/ usurpation requests Miscellaneous requests URL blacklisting Title/username blacklisting Email blacklisting
Meta-Wiki requests
CheckUser information Deletion Permissions Requests for help

Requests

Agadirhaha@commons

Tracked in Phabricator:
Task T174342

Status: Done

List of users: Agadirhaha (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

CU log

Reason(s): This user uploaded a video demonstrating IP address change to evade an ISP-level blackholing of Phabricator (gerrit:368775). We've identified a number of ISP addresses from public records for Maroc Telecom phab:Z567#10425, but need assistance in finding more ranges. Dispenser (talk) 18:11, 25 August 2017 (UTC)[reply]

Deferred to c:COM:RFCU. Hello. Commons has their own CheckUsers, you should request them on their request page. Regards, —MarcoAurelio (talk) 10:03, 26 August 2017 (UTC)[reply]

Is this still the case when Phabricator uses www.mediawiki.org for OAuth login? Dispenser (talk) 11:49, 26 August 2017 (UTC)[reply]

I cannot really answer that question because I do not know if OAuth logins leave CU trace. I think they don't, but I'll ping @Tgr (WMF) and BDavis (WMF) for clarification. In any case, I think Phabricator administrators can access IP data about users so if there's sockpuppetry problems over there maybe @AKlapper (WMF) and MModell (WMF) will be able to assist. —MarcoAurelio (talk) 09:53, 27 August 2017 (UTC)[reply]

Indeed they don't (although the user had to login to MediaWiki at some point, that you could look up). We can add something to the system logs if you think that would be important, feel free to open a phab task about it. Creating MediaWiki log records would be too much effort compared to how rarely it would be useful, IMO. (Also probably not something CUs should have access to, as OAuth authentication can be used for third-party logon and whatnot.) --Tgr (WMF) (talk) 20:26, 27 August 2017 (UTC)[reply]

Phab administrators can access IP data of users. If anything is wanted, please elaborate. In the case of Agadirhaha, I can see several IPs but no other users who used these exact IPs (might be WP0 anyway). Based on behavior in Phab I pesonally believe that mw:User:Vaporitoo, mw:User:Monadamat_almajanyat, mw:User:Said_raz, mw:User:Samurai_rider, mw:User:About_spindab, mw:User:Adriano_gagazoo, mw:User:Vampire_dracula, mw:User:Darcula, mw:User:Wikishopia, mw:User:Milanooooooooo, mw:User:Disponsable, mw:User:Skillboy_ghost are sock puppet accounts. --AKlapper (WMF) (talk) 10:25, 28 August 2017 (UTC)[reply]

I'll have a look at those on mediawiki. —MarcoAurelio (talk) 10:33, 28 August 2017 (UTC)[reply]

There are not conclusive results at mediawiki. They might be sockpuppets based on what they do, but so far the only connection I see is continental procedence, which is not much. The ranges are also crowded to do a safe IP range block. If someone else with more experience does want to have a look, feel free. —MarcoAurelio (talk) 11:27, 28 August 2017 (UTC)[reply]

@MarcoAurelio: Can you confirm any of Aklapper's previously seen /16 ranges? Dispenser (talk) 13:49, 3 September 2017 (UTC)[reply]

I've filed a phabricator task. Cleaning up phabricator requires console commands which is why a /8, /11s, and /12s are blackholed, but they still somehow got through two filters. Dispenser (talk) 13:04, 28 August 2017 (UTC)[reply]

Closing as done, no further action needed here. – Ajraddatz (talk) 18:58, 15 October 2017 (UTC)[reply]

Cont Periculos@ro.wikipedia

Status: Done

List of users: Cont Periculos (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); PETștePrăjit (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); PETșteCopt (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); PETștePlutitor (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); GlumeTimesNewRoman (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); GlumeTNR (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); GlumeKMKZ (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Clorură de pește (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Sulfat de pește (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Clorură de iarbă (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

CU log
Discussion: None

Reason(s): No discussion available, since these accounts have been blocked rightaway. They are the most recent creations of a vandal whose sockpuppets, hundreds of them, have plagued the project for years (they are useless for the verification, being too old). The duck test identifies them beyond doubt, but a confirmation by checkuser would add more weight. Victor Blacus (talk) 19:42, 4 October 2017 (UTC)[reply]

Done @Victor Blacus: all accounts are

Confirmed. The following confirmed accounts are still unblocked: Cont Periculos, Cont Vechi, and Cont Nou. If you block the accounts with autoblock, it will block the two IPs being used. – Ajraddatz (talk) 17:37, 7 October 2017 (UTC)[reply]

Cont Deblocat@ro.wikipedia

Status: Done

List of users: Cont Deblocat (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Aidepikiw, eidepolcicne! (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Eraerc tnoc, rebil! (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Emun ed rotazilitu, alorap! (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Am atuja, as gela! (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Cont Periculos (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); PETștePrăjit (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); PETșteCopt (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); PETștePlutitor (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Clorură de iarbă (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

CU log
Discussion: None

Reason(s): No discussion available, since these accounts haven't been used. The first five have been created last night; the duck test suggests they are sockpuppets of a vandal who has plagued the project for years. The last five are already blocked; they are confirmed sockpuppets of that vandal. See the previous request for more. Here confirmation is requested, in order to block the new ones as well. Victor Blacus (talk) 07:29, 13 October 2017 (UTC)[reply]

Done @Victor Blacus: All these accounts are

Confirmed socks. I also found few more - Cont Pescuit, Cont_Provocator, Hqflforshglh, Jvxvcrqvn and Gjti that are unblocked. --Pmlineditor (t · c · l) 10:32, 13 October 2017 (UTC)[reply]

Thanks! -- Victor Blacus (talk) 11:13, 13 October 2017 (UTC)[reply]

Shivam artistss@hi.wikipedia

Status: Done

List of users: Shivam artistss (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Amzon-net india (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Shivam (born- 24 june) (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

Reason(s): Socks of शिवम कुमार श्रिवास्तव (talk · contribs). Editing same articles and creation of article on himself. Hindust@ni^{क्या करें? बातें!} 18:10, 14 October 2017 (UTC)[reply]

Confirmed as well as Shiwam Kumar (Actor), Shiwam--(Hindu Actor), Shiwam Kumar Shrivastava, Shiwam Kumar Shriwastawa, Redirected name, Draft Shiwam Kumar, Shiwam-Kumar-Shriwastaw24, Shivam-- (Actor)--sks, HGVioo, GrX this part post, Shhiwam Kumaar, Television Graff pvtd, Megha punjaa, Shivam Sriwashtav official, SF dpoje, बहु लक्ष्मी, Shivam Srivastav, Alisha was, Shivam Kumar Srivastav, Shivam Kumar Shrivastava, Shiwam - Indian Actor, Shiwam Kumar Sriwastaw (TV Actor). It is related to en:Wikipedia:Sockpuppet_investigations/Shiwam_Kumar_Sriwastaw/Archive. Ruslik (talk) 18:05, 15 October 2017 (UTC)[reply]

Sci-fi-@en.wikiversity 2

Status: Done

List of users: bigcheeses (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Jamenta_2 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Rome Viharo WWHP (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); I run away in a desert (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Abd stop stalking people (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Manuls brother (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Why are you reviving all this i will not tolerate it (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Anti racist for life (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Marshallsumter illegal (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); From a tower (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

CU log
Discussion: Suspected large family of LTA accounts already identified per this request and this one. Bigcheeses and Jamenta 2, having more recent edits, already locked, are included for comparison. Most recent:
Bruce Canada (talk • contribs • block • xwiki-contribs • xwiki-date ^(alt) • CA • ST • lwcheckuser) active 15 October 2017
Stop old metally ill internet stalkers in their 70s from internet acess (talk • contribs • block • xwiki-contribs • xwiki-date ^(alt) • CA • ST • lwcheckuser) blocked as vandal 15 October 2017, already locked.

Added as possible:

ZaFrumi (talk • contribs • block • xwiki-contribs • xwiki-date ^(alt) • CA • ST • lwcheckuser) suspected related SPA, not clearly abusive.

Reason(s): Prior requests have identified sleepers and other WMF socks, allowing broader connections. This is, from those (information has been kept private), an LTA with over 200 identified socks, and aggressively attempting to prevent identification or harass anyone looking into the activity. See this edit for the threat claiming 16 active or occasional Wikipedia accounts. If this is true (these socks routinely lie), the user may be using partitioned access, to avoid checkuser, but if there is much activity, users make mistakes and socks are revealed. Thanks. --Abd (talk) 16:28, 15 October 2017 (UTC)[reply]

Adding new disruption on meta:

Guerrilla Skepticism member (talk • contribs • block • xwiki-contribs • xwiki-date ^(alt) • CA • ST • lwcheckuser)
Logos is back (talk • contribs • block • xwiki-contribs • xwiki-date ^(alt) • CA • ST • lwcheckuser)

Creating a new account here in order to show multi-user support is classic sock puppetry. If Logos is back is actually w:User:Logos, when Logos is not blocked on meta, nor anywhere, in fact, is sock abuse. Because this LTA often impersonates others, this cannot be seen as showing actual abuse by Logos.

As well, if "Guerrilla Skepticism member" is an actual active Wikipedian working with GSOW, an organization promoting "skepticism on Wikipedia," this would also be abusive socking. I would think that legitimate GSOW members would avoid anything like that. No claim is made of any GSOW abuse on the pages under attack or here. The sock master either lies about affiliations, or there is an even deeper problem, not to be addressed here. This report is only about possibly abusive socking, here or anywhere in the WMF family. --Abd (talk) 18:25, 15 October 2017 (UTC)[reply]

Abd is perm blocked on Wikipedia. He is not an admin or check-user here but pretends to be one. He now uses Wikimedia to write slander and false allegations about Wikipedia users he does not like [1]. He makes allegations but does not use check-user data. He has no evidence linking any of the above accounts to AngloPyramidologist or Logos. Why does he have two pages attacking Wikipedia users? He accuses innocent users of impersonation and owning socks they do not own. This is abuse. Bruce Canada (talk) 16:59, 15 October 2017 (UTC)[reply]

Btw this is not a fair check-user request. It is clear some of the accounts above are indeed the same person i.e. "Abd stop stalking people", "Why are you reviving all this i will not tolerate it", "I run away in a desert" etc which were active only recently. These belong to a user like myself who Abd has been harassing. Of course an exact match will occur on those accounts I suspect because they were likely editing from the same IP. But you will not individually check all the above old accounts such as Rome Viharo WWHP, that is an old account that will come up stale. But 100$ dollars says the check-user will match three of these recent accounts and then claim all of the accounts including the old unrelated accounts are all the same person. It is easy to just say that but, Wrong. I have every reason to believe at least four different people are responsible for the above accounts. Btw one of the above accounts was mine. Bruce Canada (talk) 17:16, 15 October 2017 (UTC)[reply]

I assume that stewards know what they are doing, and I hope that they will be careful, and specific, i.e., between definitive identification and possible relation. Behaviorally, all but one of the reported socks could be locked, but that's not my decision and this is not a lock request. --Abd (talk) 18:25, 15 October 2017 (UTC)[reply]

I (and some others) have done these checks. All but Bruce Canada are

Confirmed on the same IP. There is no technical evidence that Bruce Canada is related to the other accounts, though I wouldn't expect any with the type of IP he was using. – Ajraddatz (talk) 19:08, 15 October 2017 (UTC)[reply]

In discussing it with Ajraddatz, we have found that Bruce Canada is indeed connected to Guerrilla Skepticism member, Logos is back, Logos Tumbleman Manul Abd Jamenta Dan Skeptic, Muslim atheist, Big Bang happened and is a fact etc so there is technical evidence enough for

Likely at least. RadiX ∞ 20:27, 15 October 2017 (UTC)[reply]

Out of caution, please explicitly confirm, if possible, the relatedness of the account below, which appears to be an account impersonating a real person who operates a blog called WWHP, and known to be a long-term target of this sock family.

Rome Viharo WWHP (talk • contribs • block • xwiki-contribs • xwiki-date ^(alt) • CA • ST • lwcheckuser).

Given the duck test, "likely" is good enough here for us to assume connection, if not identity. --Abd (talk) 21:19, 15 October 2017 (UTC)[reply]

Unfortunately, CU data on that account will be

Stale by now. RadiX ∞ 21:28, 15 October 2017 (UTC)[reply]

Done Thanks. --Abd (talk) 22:03, 15 October 2017 (UTC)[reply]

Илия от Шумен@bg.wikipedia

Status: In progress

List of users: Илия от Шумен (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); АнтиМакедон (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); TormonOkalinovModernator (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Теменуга Пеева (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Иванчо 23 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Стевка Дойчева (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Стоянка Мустачева (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Дара Славова (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

CU log

Reason(s): These accounts (only a handful presented here from the hundreds) have been consistently threatening our editors. The general template is “You [offensive name], once you get out of prison, you'll meet my [buddy, etc.] and you are not going to like it. Are you prepared for this?” Especially aggravating seems the fact that recently the person has specifically targeted our female colleagues—I guess it shouldn't be necessary to explain why this is so worrying. This harassment is going on for many months now, despite the hundreds of thousands of blocked open proxies and even the almost a hundred completely banned ISPs. We suspect that at least some of the accounts are created and operated from own (home/work) IPs of the person behind them. Considering the gravity of the case, we'd be grateful if the network ranges from which these threats are made are revealed, so that we may block them (specific addresses are not necessary).

Many thanks in advance!
— Luchesar • T/C 12:29, 18 October 2017 (UTC)[reply]

Pinging some colleagues who might want to follow this .
— Luchesar • T/C 13:02, 18 October 2017 (UTC)[reply]

Aydinsalis@az.wikipedia

Status: Done

List of users: Aydinsalis (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Afrasiyab (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Al.xonder (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Çim Çen In (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Faderis (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Shekikhanof (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Айдин Мамедов (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); M.Salis (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Xananxanxana (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Petux sseferin ağzına verən (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

CU log

Reason(s): This user is a vandal. Administrators block him, but hi registers new accounts. I would like to be sure that all this accounts belong to him..--Sortilegus (talk) 18:25, 18 October 2017 (UTC)[reply]

I've checked the accounts, and there is only very weak technical evidence connecting some to others. Afrasiyab and Xananxanxana are

Likely. The rest jump between multiple mobile ranges. You'll need to block based on behavioural evidence, I'm afraid. – Ajraddatz (talk) 19:19, 18 October 2017 (UTC)[reply]

Thanks Ajraddatz. --Sortilegus (talk) 19:41, 18 October 2017 (UTC)[reply]

Requests

Agadirhaha@commons

Cont Periculos@ro.wikipedia

Cont Deblocat@ro.wikipedia

Shivam artistss@hi.wikipedia

Sci-fi-@en.wikiversity 2

Илия от Шумен@bg.wikipedia

Aydinsalis@az.wikipedia

See also