Steward requests/Checkuser

From Meta, a Wikimedia project coordination wiki
Jump to: navigation, search
Requests and proposals Steward requests (Checkuser) latest archive
Checkuser icons
These indicators are used by CheckUsers and stewards for easier skimming of their notes, actions and comments.
{{Confirmed}}:  Confirmed {{MoreInfo}}: MoreInfo Additional information needed
{{Likely}}: Likely Likely {{Deferred}}: Deferred Deferred to
{{Possible}}: Possible Possible {{Completed}}: Completed Completed
{{Unlikely}}: Unlikely Unlikely {{TakeNote}}: Note Note:
{{Unrelated}}: Unrelated Unrelated {{Doing}}: Symbol wait.svg Doing...
{{Inconclusive}}: Inconclusive Inconclusive {{StaleIP}}: Stale
{{Declined}}: Declined Declined {{Fishing}}: Fishing CheckUser is not for fishing
{{Pixiedust}}: Pixiedust CheckUser is not magic pixie dust {{8ball}}: 8ball The CheckUser Magic 8-Ball says
{{Duck}}:  It looks like a duck to me {{Crystalball}}: Crystalball CheckUser is not a crystal ball

This page is for requesting CheckUser information on a wiki with no local CheckUsers (see also requesting checkuser access). Make sure to follow the following instructions, or your request may not be processed in a timely manner.

Before making a request:

  1. Make sure you have a good reason for the check. It will only be accepted to counter vandalism or disruption to Wikimedia wikis. Valid reasons include needing a block of the underlying IP or IP range, disruptive sockpuppetry, vote-stacking, and similar disruption where the technical evidence from running a check would prevent or reduce further disruption.
  2. Be specific in your reasons. Ambiguous or insufficient reasons will cause delays. Explain the disruption and why you believe the accounts are related, ideally using diff links or other evidence.
  3. Make sure there are no local checkusers or policies.
  4. Please ensure that the check hasn't already been done:

How to make a request

How to make a request:

  • Place your request at the bottom of the section, using the template below (see also {{srcu}} help).
    === Username@xx.project ===
    {{CU request
     |status          = <!--don't change this line-->
     |language code   = 
     |project shortcut= 
     |user name1      = 
     |user name2      = 
     |user name3      = 
    <!-- Max 10 users -->
     |discussion      = [[Example]]<!-- local confirmation link / local policy link -->
     |reason          = Reasons here. ~~~~

    For example:

    === Example@en.wikipedia ===
    {{CU request
     |status          = <!--don't change this line-->
     |language code   = en
     |project shortcut= w
     |user name1      = Example
     |user name2      = Foo
     |user name3      = Bar
    <!-- Max 10 users -->
     |discussion      = [[:w:en:Example]]<!-- local confirmation link / local policy link -->
     |reason          = Reasons here. ~~~~
  • Specify the wiki(s) you want to perform the check on.
Cross-wiki requests
Meta-Wiki requests



Deferred Deferred to c:COM:RFCU. Hello. Commons has their own CheckUsers, you should request them on their request page. Regards, —MarcoAurelio (talk) 10:03, 26 August 2017 (UTC)
Is this still the case when Phabricator uses for OAuth login? Dispenser (talk) 11:49, 26 August 2017 (UTC)
I cannot really answer that question because I do not know if OAuth logins leave CU trace. I think they don't, but I'll ping @Tgr (WMF) and BDavis (WMF) for clarification. In any case, I think Phabricator administrators can access IP data about users so if there's sockpuppetry problems over there maybe @AKlapper (WMF) and MModell (WMF) will be able to assist. —MarcoAurelio (talk) 09:53, 27 August 2017 (UTC)
Indeed they don't (although the user had to login to MediaWiki at some point, that you could look up). We can add something to the system logs if you think that would be important, feel free to open a phab task about it. Creating MediaWiki log records would be too much effort compared to how rarely it would be useful, IMO. (Also probably not something CUs should have access to, as OAuth authentication can be used for third-party logon and whatnot.) --Tgr (WMF) (talk) 20:26, 27 August 2017 (UTC)
Phab administrators can access IP data of users. If anything is wanted, please elaborate. In the case of Agadirhaha, I can see several IPs but no other users who used these exact IPs (might be WP0 anyway). Based on behavior in Phab I pesonally believe that mw:User:Vaporitoo, mw:User:Monadamat_almajanyat, mw:User:Said_raz, mw:User:Samurai_rider, mw:User:About_spindab, mw:User:Adriano_gagazoo, mw:User:Vampire_dracula, mw:User:Darcula, mw:User:Wikishopia, mw:User:Milanooooooooo, mw:User:Disponsable, mw:User:Skillboy_ghost are sock puppet accounts. --AKlapper (WMF) (talk) 10:25, 28 August 2017 (UTC)
I'll have a look at those on mediawiki. —MarcoAurelio (talk) 10:33, 28 August 2017 (UTC)
There are not conclusive results at mediawiki. They might be sockpuppets based on what they do, but so far the only connection I see is continental procedence, which is not much. The ranges are also crowded to do a safe IP range block. If someone else with more experience does want to have a look, feel free. —MarcoAurelio (talk) 11:27, 28 August 2017 (UTC)
@MarcoAurelio: Can you confirm any of Aklapper's previously seen /16 ranges? Dispenser (talk) 13:49, 3 September 2017 (UTC)
I've filed a phabricator task. Cleaning up phabricator requires console commands which is why a /8, /11s, and /12s are blackholed, but they still somehow got through two filters. Dispenser (talk) 13:04, 28 August 2017 (UTC)
Closing as done, no further action needed here. – Ajraddatz (talk) 18:58, 15 October 2017 (UTC)

Cont Periculos@ro.wikipedia

Yes check.svg Done @Victor Blacus: all accounts are  Confirmed. The following confirmed accounts are still unblocked: Cont Periculos, Cont Vechi, and Cont Nou. If you block the accounts with autoblock, it will block the two IPs being used. – Ajraddatz (talk) 17:37, 7 October 2017 (UTC)

Cont Deblocat@ro.wikipedia

Yes check.svg Done @Victor Blacus: All these accounts are  Confirmed socks. I also found few more - Cont Pescuit, Cont_Provocator, Hqflforshglh, Jvxvcrqvn and Gjti that are unblocked. --Pmlineditor (t · c · l) 10:32, 13 October 2017 (UTC)
Thanks! -- Victor Blacus (talk) 11:13, 13 October 2017 (UTC)

Shivam artistss@hi.wikipedia

 Confirmed as well as Shiwam Kumar (Actor), Shiwam--(Hindu Actor), Shiwam Kumar Shrivastava, Shiwam Kumar Shriwastawa, Redirected name, Draft Shiwam Kumar, Shiwam-Kumar-Shriwastaw24, Shivam-- (Actor)--sks, HGVioo, GrX this part post, Shhiwam Kumaar, Television Graff pvtd, Megha punjaa, Shivam Sriwashtav official, SF dpoje, बहु लक्ष्मी, Shivam Srivastav, Alisha was, Shivam Kumar Srivastav, Shivam Kumar Shrivastava, Shiwam - Indian Actor, Shiwam Kumar Sriwastaw (TV Actor). It is related to en:Wikipedia:Sockpuppet_investigations/Shiwam_Kumar_Sriwastaw/Archive. Ruslik (talk) 18:05, 15 October 2017 (UTC)

Sci-fi-@en.wikiversity 2

Adding new disruption on meta:
Creating a new account here in order to show multi-user support is classic sock puppetry. If Logos is back is actually w:User:Logos, when Logos is not blocked on meta, nor anywhere, in fact, is sock abuse. Because this LTA often impersonates others, this cannot be seen as showing actual abuse by Logos.
As well, if "Guerrilla Skepticism member" is an actual active Wikipedian working with GSOW, an organization promoting "skepticism on Wikipedia," this would also be abusive socking. I would think that legitimate GSOW members would avoid anything like that. No claim is made of any GSOW abuse on the pages under attack or here. The sock master either lies about affiliations, or there is an even deeper problem, not to be addressed here. This report is only about possibly abusive socking, here or anywhere in the WMF family. --Abd (talk) 18:25, 15 October 2017 (UTC)
Abd is perm blocked on Wikipedia. He is not an admin or check-user here but pretends to be one. He now uses Wikimedia to write slander and false allegations about Wikipedia users he does not like [1]. He makes allegations but does not use check-user data. He has no evidence linking any of the above accounts to AngloPyramidologist or Logos. Why does he have two pages attacking Wikipedia users? He accuses innocent users of impersonation and owning socks they do not own. This is abuse. Bruce Canada (talk) 16:59, 15 October 2017 (UTC)
Btw this is not a fair check-user request. It is clear some of the accounts above are indeed the same person i.e. "Abd stop stalking people", "Why are you reviving all this i will not tolerate it", "I run away in a desert" etc which were active only recently. These belong to a user like myself who Abd has been harassing. Of course an exact match will occur on those accounts I suspect because they were likely editing from the same IP. But you will not individually check all the above old accounts such as Rome Viharo WWHP, that is an old account that will come up stale. But 100$ dollars says the check-user will match three of these recent accounts and then claim all of the accounts including the old unrelated accounts are all the same person. It is easy to just say that but, Wrong. I have every reason to believe at least four different people are responsible for the above accounts. Btw one of the above accounts was mine. Bruce Canada (talk) 17:16, 15 October 2017 (UTC)
  • I assume that stewards know what they are doing, and I hope that they will be careful, and specific, i.e., between definitive identification and possible relation. Behaviorally, all but one of the reported socks could be locked, but that's not my decision and this is not a lock request. --Abd (talk) 18:25, 15 October 2017 (UTC)
I (and some others) have done these checks. All but Bruce Canada are  Confirmed on the same IP. There is no technical evidence that Bruce Canada is related to the other accounts, though I wouldn't expect any with the type of IP he was using. – Ajraddatz (talk) 19:08, 15 October 2017 (UTC)
In discussing it with Ajraddatz, we have found that Bruce Canada is indeed connected to Guerrilla Skepticism member, Logos is back, Logos Tumbleman Manul Abd Jamenta Dan Skeptic, Muslim atheist, Big Bang happened and is a fact etc so there is technical evidence enough for Likely Likely at least. RadiX 20:27, 15 October 2017 (UTC)
Out of caution, please explicitly confirm, if possible, the relatedness of the account below, which appears to be an account impersonating a real person who operates a blog called WWHP, and known to be a long-term target of this sock family.
Given the duck test, "likely" is good enough here for us to assume connection, if not identity. --Abd (talk) 21:19, 15 October 2017 (UTC)
Unfortunately, CU data on that account will be Stale by now. RadiX 21:28, 15 October 2017 (UTC)
  • Yes check.svg Done Thanks. --Abd (talk) 22:03, 15 October 2017 (UTC)

See also