Steward requests/Checkuser/2009-07

Add links
From Meta, a Wikimedia project coordination wiki

Requests

Ouch@fawiki

The following discussion is closed.

this has attacked some of fawiki legitimate user by defacing their page , i have block his ips for several time but he does it again so i would like to check this account for possible sleepers --Mardetanha talk 08:18, 29 June 2009 (UTC)

Following accounts are  Confirmed sleepers/socks of Ouch:
None of these are blocked. Laaknor 08:28, 29 June 2009 (UTC)
Takk så mye --Mardetanha talk 08:32, 29 June 2009 (UTC)

LordOfTheBirds@en.wikiversity

The following discussion is closed.

Suspected also using DetroidHokg and Kjoldft and somehow showing up in user creation logs as: 

05:22, 27 June 2009 LordOfTheBirds (Talk | contribs | block) Account created automatically

Looks like this vandel is using scripts to replace content with objectionable pictures.

Same pattern of vandalism from User:Defiotl. --mikeu talk 11:41, 27 June 2009 (UTC)
Both locked, btw. Kylu 12:05, 27 June 2009 (UTC)
The other two accounts: Kjoldft and DetroidHokg do not appear to be locked at this time. --mikeu talk 13:15, 27 June 2009 (UTC)
Locked — Mike.lifeguard | @en.wb 20:56, 27 June 2009 (UTC)

Politikus Jaga Hati@ms.wikipedia

The following discussion is closed.

There's a user who is vandalizing a certain page in ms.wikipedia. Every time he is blocked, he creates a new account and repeats it again. The accounts are: Subo, IDreamedADream, Catsmemory, Nikodym, Martingale, Numeraire, Politikus Jaga Hati. He's also revealed his IP address: 158.143.134.148.

The following IP adresses are also probably his: 158.143.132.20, 158.143.133.240, 158.143.135.16, 158.143.133.153, 158.143.197.21, 158.143.136.163, 158.143.134.199, 158.143.133.58.

Can a steward do a range blocking & prevent account creation, preferably for a long time? Thanks. ...Aurora... 14:11, 22 June 2009 (UTC)

All IPs are within the same subnet (RIPE), and belongs to London School of Economics. There is no need for doing a CU with the information given, you can block 158.143.0.0/16 yourself, and then block the entire school... Laaknor 15:03, 22 June 2009 (UTC)
Ok, I wasn't sure how to do range blocking. Thanks for the info. ...Aurora... 15:14, 22 June 2009 (UTC)
No problem ;) Laaknor 15:23, 22 June 2009 (UTC)

This one will need CU: IDreamedTwoDreams. I don't know whether my block didn't work or whether he's using another IP address outside the range. ...Aurora... 12:10, 23 June 2009 (UTC)

 Confirmed - same vandal as before, but this range cannot be blocked as it is very large and very busy. I've locked the account so they don't vandalize other wikis.  — Mike.lifeguard | @en.wb 21:02, 27 June 2009 (UTC)

Kftsang hk, Todakoen, Mykazetachi@zh.wikipedia

The following discussion is closed.

The above stated users are currently editing the articles about an animation (Hime-chan's Ribbon and related articles) in zh.wikipedia, with similar editing style (little content and only related to railway, which is one of Kftsang hk's contribution area in the past). In deletion request of some of the related articles, they support one another, giving an impression to me that the latter two users are the sockpuppets of Kftsang hk (though this account doesn't involve in the editing much). Therefore, I would like to request a CU to see if these three users are related. Thank you very much!--Altt311 07:26, 25 June 2009 (UTC)

For your information, Kftsang hk has been confirmed to use a sockpuppet to support himself in the past (CU Record). At that time, the behavior of the sockpuppets are similar.--Altt311 07:54, 25 June 2009 (UTC)

The previous check doesn't say "confirmed". As well, I don't see any indication of disruption to the project that would warrant a check.  — Mike.lifeguard | @en.wb 21:04, 27 June 2009 (UTC)
The major concern is that he is fabricating the support for his preservation idea if the above accounts are related to each other. If this is not a valid reason, I will request again only when I have sufficient evidence. Thank you.--Altt311 08:30, 28 June 2009 (UTC)
Just because three people agree with one another is no reason to invade their privacy.  — Mike.lifeguard | @en.wb 14:42, 28 June 2009 (UTC)

Leylaz@fa.wikipedia

The following discussion is closed.

fa:user:Iraj Mirzaee and fa:user:Leylaz and fa:user:HamidGhanbari are spamming the same thing in fa:رنجرور. Another note: "Leylaz" uploaded several images without proper copyright information in fa.wikipedia, which I deleted. Now I see that "Iraj Mirzaee" and "HamidGhanbari" have uploaded exactly the same images in commons with the same filename and with strange informations (Source: www.rover.com, Author: Gourdaafarid ?!) [1] [2]. Raamin 20:43, 25 June 2009 (UTC)

please check fa:user:Dr Iraj Mirzaee too. Raamin 20:49, 25 June 2009 (UTC)

 Confirmed: Iraj Mirzaee, HamidGhanbari, Ladybeetle, Mirthful, Ramie, اين نيز بگذرد, Leylaz, Saeed Leylaz, Sayyedeh, Dr Iraj Mirzaee
Likely Likely: PALA, Raamir, دكتر هومن صدر, K1LM, Raanin, Madib871
 — Mike.lifeguard | @en.wb 21:18, 27 June 2009 (UTC)

Vandal using open proxies at vi.wp

The following discussion is closed.

This vandal floods 'Recent changes' with obscenities and appears to use open proxies. We have blocked the following accounts indefinitely. Please block the open proxies involved. Thanks and sorry for the long list! Tmct 11:42, 26 June 2009 (UTC)

Suspected socks

Please don't bother listing other socks of the same vandal. I'd appreciate if you list some of the open proxies so that I could find the list of open proxies the vandal might be using and block them all. Thanks.Tmct 19:23, 26 June 2009 (UTC)

Doing... --birdy geimfyglið (:> )=| 19:32, 26 June 2009 (UTC)
result:  Confirmed socks

I recommend to block the range 203.162.112.0/27, seems to be a proxy range and no good users are there.

Some proxy listings:
  • 69.149.204.113
  • 87.101.95.14
  • 122.209.122.21
  • 148.233.239.23
  • 148.233.239.24
  • 189.28.179.130
  • 193.192.63.233
  • 200.65.129.2
  • 200.96.37.202
  • 201.2.110.71
  • 201.12.36.10
  • 201.30.141.82
  • 201.34.32.100
  • 201.36.220.178
  • 203.148.85.101
  • 203.160.1.71
  • 203.160.1.162
  • 211.54.10.162
  • 212.116.219.102
  • 217.128.20.38
  • 218.14.227.197

If vi.wiki wants to contact his provider to report abuse, contact me, his real IPs are known. Best regards, --birdy geimfyglið (:> )=| 20:45, 26 June 2009 (UTC)

P.S. If there are insulting accounts we can hide them, this might be better than to rename them (because when renaming them the names will be shown in the renamelog. Best regards, --birdy geimfyglið (:> )=| 20:47, 26 June 2009 (UTC)
more proxies
  • 61.255.239.201
  • 66.63.165.7
  • 66.237.61.213
  • 67.18.186.115
  • 67.91.182.64
  • 82.194.76.198
  • 148.233.239.24
  • 201.25.119.34
You could think about blocking open proxies with a script, User:DerHexer has done this for wikis with similar problems (for example ml.wiki [3] and others), but of course You need consens of the community first, then You can contact DerHexer for help, he is a steward and runs this service.
Best regards, --birdy geimfyglið (:> )=| 18:20, 29 June 2009 (UTC)
Actually, the original request asks to block the proxies. If Tmct confirms that that is the community's wish, I can do it quickly.  — Mike.lifeguard | @en.wb 18:41, 29 June 2009 (UTC)
Please do block them. The vandals are back now, creating many sleeper accounts and then renaming articles around, causing vast amount of damage. Could you also check for more sleeper accounts so that we can preemptively block them? DHN 18:45, 29 June 2009 (UTC)

勉強大好き etc. @jawikinews

The following discussion is closed.

They all are cross-wiki vandal global acounts, recently locked.

  1. Do they use any common IP addresses?
  2. Do they use open proxies?
  3. Are there any sleeper accounts?

Thank you. --Kanjy 14:52, 1 July 2009 (UTC)

Vandalism is continual and serious. So admins of jawikinews need checkuser's help. Thank you. --Marine-Blue [ talk contribs ] 00:04, 6 July 2009 (UTC)

 Confirmed that they use the same IP and
Best regards, --birdy geimfyglið (:> )=| 12:19, 6 July 2009 (UTC)
winkThanks! a lot, birdy! But, perhaps, did you mean s:ja:User:りんごちゃん (ringo-chan) by n:ja:User:みかんちゃん (mikan-chan)? Anyway, thanks, again! --Kanjy 03:51, 7 July 2009 (UTC)
Sorry, I meant 歴史大好き (talk • contribs • block • xwiki-contribs • xwiki-date (alt) • CA • ST • lwcheckuser) is one of them too. I have sent the whole info to the ml, so ja.wiki checkusers can have a look at this too. Best regards, --birdy geimfyglið (:> )=| 05:30, 7 July 2009 (UTC)

Germanoarceus@it.wikiquote

Status:    Done

Multiple vandalism on user page 1 2, but i think the anomynous IP is user himself. User has been already blocked on it.wikipedia 3 for vandalism. User also post a "personal attack" message. Anonimous IP are from the same geographic zone. Sorry for my english, but i hope you'll undestand me.  :-) --Quaro75 19:40, 7 July 2009 (UTC)

No other users found, he seems to be very young. Info sent to ml so it.wiki checkusers can have a look there. Best regards, --birdy geimfyglið (:> )=| 06:57, 9 July 2009 (UTC)
Sorry but I don't understand. Is Germanoarceus = 151.56.3.122? May we block his account for vandalism? --Quaro75 09:45, 11 July 2009 (UTC)

Crabbofix@svwiki

The following discussion is closed.
Special:Contributions/Bongoman|contr]] · [[
Special:DeletedContributions/Bongoman|deleted]] · block · log · block log · CA · guc · checkuser · lwcheckuser)

Please make a cross-wiki check and check if Crabbofix is a sockpuppet. The very likely suspect is Bongoman, who has an extensive block logg on sv wikipedia for sockpuppetry (marionett in Swedish), outing, threatening fellow editors, among other things. There are several similarities in editing style between Bongoman and Crabbofix, and Crabbofix was obviously not a new user as he knew the wiki technique from the start. The perhaps strongest evidence is the name Crabbofix who is a character from the Asterix series. The account was created almost simultaneously as several other Asterix characters some of which are satirising (eg: Idefix, Obälisk, Tragicommiepoppix, Majestix, Hycklarix, Smidefix - while some of these were proven to be sockpuppets of another user, the others were likely puppets of Bongoman who was blocked at the time), all with the purpose to bemock sv:User:Obelix (also a Asterix character) on Swedish Wikipedia.

While Crabbofix has not yet been blocked (s)he is constantly making flamebites, edit warring and making unexplained reverts (example: [4] [5]) and is probably aspiring to become an admin when everyone has forgotten about the Bongoman account.

Also check if (s)he is using ISP from Hi3G Access (the ISP of the trolling IP numbers above), and make a geographic comparison, especially Helsingborg and Kristianstad are suspect locations. A thorough check is necessary as (s)he is very skillful in using open proxies, wardriving and other tricks. Thanks. Hej 09:31, 9 July 2009 (UTC)

Hello, commons, sv.wiki and en.wiki have local checkusers, please contact one of them and tell them to communicate with the other two wikis, thanks, --birdy geimfyglið (:> )=| 09:54, 9 July 2009 (UTC)
It would be easier if you did it here. Hej 12:19, 10 July 2009 (UTC)
 Declined, as said, please contact the locals, they communicate with each others. thanks, --birdy geimfyglið (:> )=| 23:38, 18 July 2009 (UTC)

wikademia@en.wikiversity and eme@en.wikiversity

The following discussion is closed.

Blocked user Wikademia has used alternate account Eme to evade block. This user has a number of accounts that have been used in the past. The See also section at v:Wikiversity:Community review#User:Wikademia has a list of alternate accounts that are suspected of belonging to the same person. Most of those are likely stale. Requesting CU to enforce block while community reviews the status of this user. --mikeu talk 21:16, 12 July 2009 (UTC)

  • Likely Very likely: Wikademia, Eme, I eat wiki for breakfast, Palatial Regalia
  • Likely Likely: Poettype8, The Book Saver, Gbullet

More info forwarded to CheckUser mailing list.  — Mike.lifeguard | @en.wb 23:32, 12 July 2009 (UTC)

Thank you for the quick response. FYI, see this section of v:WV:CR. There is some indication that the actions of v:User:Wikademia might be a copycat of the w:Wikipedia_Art_controversy. see ref --mikeu talk 10:10, 13 July 2009 (UTC)

Gallery threshold@nowiki

The following discussion is closed.

The user has been blocked as a suspected sockpuppet of an earlier blocked user. Asked that a CU be performed on himself here to establish that he is not a sockpuppet. The earlier user (Sju hav) was blocked in november, and a CU will probably not work, but there are suspicion that he has more than one account active now (as the earlier user had when that account was active). The user probably edits trough proxies as autoblock has failed.

Can you please perform a CU on the following accounts, and find possible sleepers:

Older accounts (blocked in november)

Sincerly. Laaknor 09:31, 13 July 2009 (UTC)

Hello 119.42.98.25 is Unrelated Unrelated to any of these accounts . Bjørn Sagvolden kommisjonen and E92f+ and Sju hav as you have mentioned are Stale.Bjørn Sagvolden Forum is also Unrelated Unrelated to others .
Soldater og andre undertrykte and Gallery of soldiers and Gallery threshold are Likely Likely to be same person . --Mardetanha talk 14:01, 18 July 2009 (UTC)


The following discussion is closed.
On further request from Laaknor, I've checked Controversial soldiers and Negated soldiers. They are on the same IP range, with slightly different software profiles. Determination should depend on other similarities such as editing behaviour. —Pathoschild 16:33:45, 06 August 2009 (UTC)

그상찾‎ @ jawiktionary

The following discussion is closed.

Would you please check User:그상찾‎ @ jawiktionary? This user created the article which means the word looking down on Korean culture, so we suspect that it is a sock of regular vandal user. (And the words '그상찾' does not exist on Korean langauge.) Thank you. LERK 05:06, 19 July 2009 (UTC)

 Declined: You can block the user now - there is no need to run a checkuser.  — Mike.lifeguard | @en.wb 04:35, 20 July 2009 (UTC)
Thank you. LERK 05:45, 20 July 2009 (UTC)
Retrieved from "https://meta.wikimedia.org/w/index.php?title=Steward_requests/Checkuser/2009-07&oldid=24907132"