Steward requests/Checkuser

From Meta, a Wikimedia project coordination wiki
Jump to: navigation, search
Requests and proposals Steward requests (Checkuser) latest archive
Checkuser icons
These indicators are used by CheckUsers and stewards for easier skimming of their notes, actions and comments.
{{Confirmed}}:  Confirmed {{MoreInfo}}: MoreInfo Additional information needed
{{Likely}}: Likely Likely {{Deferred}}: Deferred Deferred to
{{Possible}}: Possible Possible {{Completed}}: Completed Completed
{{Unlikely}}: Unlikely Unlikely {{TakeNote}}: Note Note:
{{Unrelated}}: Unrelated Unrelated {{Doing}}: Symbol wait.svg Doing...
{{Inconclusive}}: Inconclusive Inconclusive {{StaleIP}}: Stale
{{Declined}}: Declined Declined {{Fishing}}: Fishing CheckUser is not for fishing
{{Pixiedust}}: Pixiedust CheckUser is not magic pixie dust {{8ball}}: 8ball The CheckUser Magic 8-Ball says
{{Duck}}:  It looks like a duck to me {{Crystalball}}: Crystalball CheckUser is not a crystal ball

This page is for requesting CheckUser information on a wiki with no local CheckUsers (see also requesting checkuser access). Make sure to follow the following instructions, or your request may not be processed in a timely manner.

Before making a request:

  1. Make sure you have a good reason for the check. It will only be accepted to counter vandalism or disruption to Wikimedia wikis. Valid reasons include needing a block of the underlying IP or IP range, disruptive sockpuppetry, vote-stacking, and similar disruption where the technical evidence from running a check would prevent or reduce further disruption.
  2. Be specific in your reasons. Ambiguous or insufficient reasons will cause delays. Explain the disruption and why you believe the accounts are related, ideally using diff links or other evidence.
  3. Make sure there are no local checkusers or policies.
  4. Please ensure that the check hasn't already been done:

How to make a request

How to make a request:

  • Place your request at the bottom of the section, using the template below (see also {{srcu}} help).
    === Username@xx.project ===
    {{CU request
     |status          = <!--don't change this line-->
     |language code   = 
     |project shortcut= 
     |user name1      = 
     |user name2      = 
     |user name3      = 
    <!-- Max 10 users -->
     |discussion      = [[Example]]<!-- local confirmation link / local policy link -->
     |reason          = Reasons here. ~~~~

    For example:

    === Example@en.wikipedia ===
    {{CU request
     |status          = <!--don't change this line-->
     |language code   = en
     |project shortcut= w
     |user name1      = Example
     |user name2      = Foo
     |user name3      = Bar
    <!-- Max 10 users -->
     |discussion      = [[:w:en:Example]]<!-- local confirmation link / local policy link -->
     |reason          = Reasons here. ~~~~
  • Specify the wiki(s) you want to perform the check on.
Cross-wiki requests
Meta-Wiki requests



Hello, I am bg:User:The TV Boy. I would like to add one more account to be checked: bg:user:The FM Boy, which is created especially to parody my username, used on bgwiki - The TV Boy. This harassment towards me continues for almost a month now and I would like to thank Luchesar for drawing attention to this problem. This vandal group originally spawned from the accounts bg:User:Модернатор (Modernator) and bg:User:Хейтър (Hater), after these accounts were blocked in 2011 the group halted for a while, but returned the previous month with direct attacks towards me, as well as other TV based articles, such as bg:Диема Спорт, bg:Диема, bg:Булсатком, bg:Хоум Бокс Офис, and others. I would really appreciate your help for the problem. Thanks in advance! --The Wiki Boy (talk) 22:47, 5 June 2016 (UTC)
I should probably add as a background info that the associated anonymous edits come so far from one specific ISP, Vivacom / Bulgarian Telecommunications Company, which is known for using DHCP with easily changeable addresses throughout their services: mobile and fixed. I've been thus forced to block entire network ranges to stop the persistent vandalism; the blocks are listed here (I also wouldn't be surprised if the vandal(s) pop up from another one -- this particular ISP has quite many -- as they had done previously). — Luchesar V. ILIEV • T/C 11:04, 6 June 2016 (UTC)
Hello, is there a reason why the check is delayed so much? There are couple more users with the same edit pattern as the listed above, but we need to see the results from the check in order to decide what to do next.--The Wiki Boy (talk) 19:58, 9 June 2016 (UTC)
We are all volunteers and this includes the checkusers. The check will be done when it's done. Also, I'd appreciate if you first share things about "couple more users" on our RfAA rather than here (unless you have very good reasons to add them directly to the request, which -- I agree here -- has been the case with User:The FM Boy). Let's really not complicate this any more than it's necessary. — Luchesar V. ILIEV • T/C 21:04, 9 June 2016 (UTC)
Added User:Stefan012345672 too. I'm afraid this really resembles very much the schizophrenic case from five years ago. Some of the puppets then presented themselves as mere "bystanders", yet were making suspiciously similar edits to the other socks; others were playing "vigilantes", mixing combating the vandalism of other socks with their own acts of vandalism; and there were even "the really good guys", who got caught only by the CU. It's exactly this "multiple personality disorder" on behalf of the socks that makes these cases so complicated: if they were pure vandals, we would've blocked them right away without any need for a CU. In the end, I'll probably block them all only on the basis of "reasonable suspicion", but any corroborating evidence from the CU would definitely be much appreciated. — Luchesar V. ILIEV • T/C 08:47, 10 June 2016 (UTC)
Added User:Dimitur12344. Pretty sure Plovdiv 10 [stalktoy] – [cross-wiki edits] is also involved, but their last edits are from almost an year ago, so not CU-able. The Wiki Boy, were these (Stefan012345672 and Dimitur12344) the two "other" users you had been referring to? — Luchesar V. ILIEV • T/C 09:01, 10 June 2016 (UTC)
And another two, although the one named "АдМинистратор" is to be blocked anyway only because of the name: "Administrator" in Bulgarian. This is yet another flashback of the previous case: the ring master, Модернатор, was a play on the word "moderator" in Bulgarian. — Luchesar V. ILIEV • T/C 09:13, 10 June 2016 (UTC)
The other two that I was referring to are Ivan1234567891011 (talk • contribs • block • x-wiki • CA), and bg:User:АдМинистратор. Can't add the "Ivan" user account to the check board because it says "max 10 users". The "Ivan" account showed up the previous week. Plovdiv 10 (talk • contribs • block • x-wiki • CA) also seems to be an incarnation of user "Plovdiv12". Also, as Luchesar pointed out the account "АдМинистратор" showed up, paralleling the name of bg:User:Администратор, who was blocked last year because the name literally means "Administrator". I am pretty sure that one and the same person stands behind those accounts.--The Wiki Boy (talk) 12:33, 10 June 2016 (UTC)
And one more pop-up Триъгълник (talk • contribs • block • x-wiki • CA) (Triangle).--The Wiki Boy (talk) 13:39, 10 June 2016 (UTC)
Indeed, the same edit pattern. Thx. — Luchesar V. ILIEV • T/C 13:43, 10 June 2016 (UTC)

And yet one more: Виваком [stalktoy] – [cross-wiki edits]. This one bears the name of the involved ISP I mentioned earlier, Vivacom (Виваком in Bulgarian) / Bulgarian Telecommunications Company, and the user states on their page that the account is operated by Vivacom employees. The edit pattern however is the typical one for the group. — Luchesar V. ILIEV • T/C 17:18, 11 June 2016 (UTC)

Another one, Ivan001234567 [stalktoy] – [cross-wiki edits]. Pretty sure this one comes from a different IP, because the original IP–at least the one I suspect to be behind most of these accounts (not going to put it here for reasons of privacy)–apparently got caught by the autoblock: it has never missed a day without (mixed vandal/semi-productive/"vigilante") edits since May 1st, yet after I started blocking some of the suspected socks, it suddenly ceased editing. I'll wait a bit more and then will block it directly and indefinitely (or for a pretty long period). As a bonus, whoever is behind the IP has also already admitted in their own words to being behind User:The FM Boy. But while I already feel pretty confident about the extent of the vandal group and their IP ranges, I'll still very much appreciate any additional confirmation from a CU. I'll also be grateful for any suggestions on additional IP ranges to block (beside the ones already listed here), especially if they are suspected open proxies (of which we already have quite a bunch of networks blocked due to rather heavy vandalism from different sources recently). Many thanks in advance again. — Luchesar V. ILIEV • T/C 12:26, 12 June 2016 (UTC)
Feminism has again been vandalised in the very same way as it was the first time this case caught my attention. I suppose this might be a retaliation for the blocks that I started to impose on the suspected socks. The address is from a different network (obviously, as the original ones are still blocked), but from the same ISP. I wouldn't be surprised if the aforementioned User:Ivan001234567 comes from that very block too (though not from the same very address, because of the autoblock; but as mentioned earlier, this ISP is known for using DHCP, which is very easily abused for vandalism: with each reset, the cable/DSL modem picks up a different address from the pool). — Luchesar V. ILIEV • T/C 13:33, 12 June 2016 (UTC)
Yet one more, Ivan00123456 [stalktoy] – [cross-wiki edits], which is quite obviously a sock. This might come from the IP I mentioned earlier, because one of the autoblocks expired a minute before the account was created (and it may have been the one that caught it). Because the topic becomes pretty long, here's a table with all suspected accounts (I'll be updating it with any new ones):
— Luchesar V. ILIEV • T/C 18:08, 12 June 2016 (UTC)
So, the vandal behind those socks apparently became nervous and sloppy and tried—rather stupidly—to gain access to my (sysop) account. This of course revealed their IP address and it turned out to be the one I had already been strongly suspecting and which seemed affected by the autoblock that I mentioned earlier. Needless to say, the IP is now blocked indefinitely. I'm pretty sure they'll try to continue with their vandalism from other addresses though, and therefore I'd be grateful if you don't mind me keeping the case open here. It's quite probable that I'll need your assistance if the vandal decides to retaliate by a new wave of massive vandalism. Thanks.
— Luchesar V. ILIEV • T/C 15:24, 16 June 2016 (UTC)
The vandal behind this sock puppet group turned out to be with IP <deleted>, identifying himself as "TV-FEN". So far there is a probability that he might try avoiding the block using other IP, but if you can still check if there are any other sock puppets that this IP registered that yet don't have edits, but might be used for vandalism in the future.--The Wiki Boy (talk) 16:31, 16 June 2016 (UTC)
That's not necessary. The IP is prohibited from editing even through registered accounts and the other accounts can simply be blocked based on their edit pattern. I'm rather more interested in open proxies that the socks might've used or any other network ranges indeed, so I can possibly (depending on the collateral damage estimate) block them too. — Luchesar V. ILIEV • T/C 17:00, 16 June 2016 (UTC)
I've also removed the IP from your post. It's visible in other places (e.g. the diff I provided earlier), and I feel we shouldn't make it more public than absolutely necessary. Sorry about this.
— Luchesar V. ILIEV • T/C 17:14, 16 June 2016 (UTC)

моля за отблокиране на мобилната мрежата на Виваком в БГ Уикипедия, тъй като повече няма да правим лоши редакции в нея. За фиксираната мрежа -оставете я така,тъй като не правихме ние вандализмите там. Пишем тук, защото няма как да пишем на заявките към администраторите.

С уважение,

бивши вандали от мобилната мрежа на БТК. 06:52, 20 June 2016 (UTC)

 Confirmed list of locked accounts

-- masti <talk> 15:37, 24 June 2016 (UTC)

Outstanding! Thank you very much, indeed! — Luchesar V. ILIEV • T/C 17:25, 24 June 2016 (UTC)
masti, could you please check these too? Or are they not connected?
Cheers, — Luchesar V. ILIEV • T/C 19:34, 24 June 2016 (UTC)


--masti <talk> 14:22, 25 June 2016 (UTC)

Two more. The second one may in fact be unrelated, but the intuition strongly tells me from the edit pattern that it is, even though the tactics has apparently been changed:

masti, when you have time for it, could you also please review the things that I wrote you about off-wiki. Thanks! — Luchesar V. ILIEV • T/C 13:22, 27 June 2016 (UTC)

Mihai Nicolae@ro.wikipedia[edit]



See also[edit]