Steward requests/Checkuser/2016-11

Please do not post any new comments on this page. This is a discussion archive first created in November 2016, although the comments contained were likely posted before and after this date. See current discussion.

Requests

Mpb_eu@bg.wikipedia

Status: Done

List of users: Mpb eu (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Eu Mpb Eu (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Тамаш Йеньо Секереш (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Tervel 716 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Йоду (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); StZv (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

Reason(s): bg:User:Mpb eu had now been indefinitely banned due to harnessing, editing thought proxies and manipulating votes. After he was banned a couple of more accounts with similar edit pattern have popped-up after the previous request, again trying to vote in deletion requests even thought the policy states that new users cannot vote. Because these might be meatpuppets rather than Mpb_eu himself can you please check if there is any relation between the accounts?--The Wiki Boy (talk) 09:41, 10 September 2016 (UTC)

Done Will see what we can find. --Jyothis (talk) 22:55, 13 September 2016 (UTC)

@Jyothis:

Progress report? —Marco Aurelio 10:34, 24 September 2016 (UTC)

@Jyothis: Hello? I don't think you're handling this, right? —Marco Aurelio 13:47, 30 September 2016 (UTC)

Sorry about that - got caught up at work :( - I did half way and that was inconclusive. Let me re-start. --Jyothis (talk) 00:15, 12 October 2016 (UTC)

Still going through this. done with one part and doing the other. --Jyothis (talk) 14:43, 20 October 2016 (UTC)

Jyothis, thanks for not giving up on this case. I suspect that some of those may be meatpuppets (e.g. Тамаш Йеньо Секереш, which is the name of a different person, though still very closely related with the sockmaster), which makes an additional mess as the sockmaster is already likely using lots of proxies and might even know even better how to clear his tracks. On a side note, we're very close to electing local CUs, so we may finally ease a little bit the burden on you, guys (from conversations with other stewards I see that the socks get more and more knowledgeable and thus difficult to identify purely on technical grounds, especially without knowing much of the context).
— Luchesar • T/C 15:08, 20 October 2016 (UTC)

Yea I get that, but the issue is that it is pretty hard from a purely technical stand point and so far the checks has been inconclusive. I am trying to correlate as much as I can, but don't keep too much hope :) --Jyothis (talk) 00:46, 24 October 2016 (UTC)

Much appreciated, Jyothis! Take your time. — Luchesar • T/C 00:51, 24 October 2016 (UTC)

It appears that Eu Mpb Eu may be related to the existing blocked accounts. There are also a good number of IP based edits that goes with this set, but not planning to put that here.

Commons iliev
Iliev~bgwiki
500ГОДИНИРОБСТВОСТИГАТ
Pavel Staykov 94
Патриотите
Станков Павел
Един Патриот
Bulgarieca
Мико Ибрикчиев
Ибрикчийско Конче
Джингиби2
Манаса ВодноКонче
Манафа Мико
Bulgariec
Мико Манафа

For the rest, I will leave it as Inconclusive, as I have not seen compelling evidence that it is related, but someone who has more local knowledge and context on how this played out can review the list above and see if you can make further connections. Please let me know if you have any questions - I have marked the request as done, but do feel free to ping if you need additional info.

Also, thank you very much for being patient here--Jyothis (talk) 01:09, 31 October 2016 (UTC)

Jyothis, that's outstanding. Those accounts belong to a puppeteer who's been bugging us for years. At some point I did realize he had begun to impersonate another puppeteer "for the lulz", but Eu Mpb Eu is a surprise even to me. Then again, I've long also suspected that the guy might've been surreptitiously creating sleeper accounts, though when I shared this suspicion with my colleagues, their reaction was "eh, you've watched too many movies lately". :)) So, I think I owe you a beer if we happen to meet at a Wikimania or otherwise -- and the same of course goes for a few other stewards as well, who've helped in the past. Many thanks again, indeed!
P.S. May I contact you privately on IRC regarding possible IP ranges to block if the puppeteer becomes active again soon?
— Luchesar • T/C 04:37, 31 October 2016 (UTC)

Our playful vandal continues, this time in sister projects: in Bulgarian Wikisource as s:User:Чекюзър (cyrillic trasliteration of "Checkuser") and s:User:Бюрократът (cyr. transl. of "The Bureaucrat"), as well as in Commons as User:Илиев ибрикчиев (similar to those above). →Spiritia 05:27, 1 November 2016 (UTC)

Luchesar - Sure. --Jyothis (talk) 11:55, 1 November 2016 (UTC)

Xwiki promotional spambots

Status: Not done

We have have an absolute spambot bonanza of xwiki (attempted) spam for promotional codes and vouchers (visible inSpecial:AbuseLog). I have taken moves to blacklist the majority of the urls and I have COIBot monitoring others that are secondary. Have we undertaken some CU to identify the ranges and put some blocks in place? If not, can we please run a series of checks to better curb this in a proactive manner. Thanks. — billinghurst sDrewth 09:24, 2 October 2016 (UTC)

What wiki are you talking about? Ruslik (talk) 20:20, 3 October 2016 (UTC)

Not done Ruslik (talk) 17:54, 13 November 2016 (UTC)

KANENAS@el.wikipedia

Status: Done

List of users: KANENAS (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); TheDesertFox (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); IwannisE (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

CU log
Discussion: el:Μαριονέτα

Reason(s): While user KANENAS was blocked, user TheDesertFox continued the edit war (and up to then had no other edits). User IwannisE did some similar edits. C messier (talk) 00:11, 13 November 2016 (UTC)

KANENAS and TheDesertFox are

Likely the same user. IwannisE is

Unrelated. Ruslik (talk) 18:10, 13 November 2016 (UTC)

EVinente@pt.project

Status: Not done

List of users: Darwinius (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Leon saudanha (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Maria Madalena (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

CU log
Discussion: pt:Wikipédia:Pedidos a verificadores/Esquema Quintinense

Reason(s): Definitely more relevant accounts will appear. Seems to be one or two sets of vandalism accounts (probably with a history covering several years). Most of them can easiliy be identified, but some edits are constructive and disturbes the picture. A better understanding of the relation between the accounts would be beneficial to handle the vandalism and solve the problem of strawman socks and maybe turn the user into a constructive contributor. I make this request here because I am unable to edit on pt-Wiki, the page is protected. CatchYou (talk) 06:00, 24 November 2016 (UTC)

Declined and

Deferred to pt:Wikipédia:Pedidos a verificadores Portuguese Wikipedia has local checkusers. If you can't edit that page, try posting on the talk page or ask any user of pt:Special:ListUsers/checkuser to know what to do in this case. —Marco Aurelio 19:06, 25 November 2016 (UTC)

Devin-Henrickson@wikidatawiki

Status: Done

List of users: Devin-Henrickson ([[; Special:Contributions/Devin-Henrickson|contr]] · [[; Special:DeletedContributions/Devin-Henrickson|deleted]] · block · log · block log · CA · guc · checkuser · lwcheckuser); Armyboy2 ([[; Special:Contributions/Armyboy2|contr]] · [[; Special:DeletedContributions/Armyboy2|deleted]] · block · log · block log · CA · guc · checkuser · lwcheckuser)

CU log
Discussion: d:Wikidata:Administrators' noticeboard#Admin wannabe

Reason(s): Both users created premature requests for adminship. The former request has since been deleted. The latter request explicitly mentions "I have been in the same field before", and in addition, Armyboy2 immediately requested confirmed status and "welcomed" Devin-Henrickson on the English Wikipedia. Both users, in general, seem to have fun pretending to be local admins. Even without this evidence, the fact that Armyboy2 filed the request for admin access on his first non-deleted local edit is strong evidence that (s)he is not a new user here. Note that sockpuppetry of the suspected sort here is forbidden by local policy.--Jasper Deng (talk) 08:49, 27 November 2016 (UTC)

Done, Positive match for Devin-Henrickson and Armyboy2. Digital Sofware Development matches too. Linedwell (talk) 09:33, 27 November 2016 (UTC)