Steward requests/Checkuser/2017-10

Please do not post any new comments on this page. This is a discussion archive first created in October 2017, although the comments contained were likely posted before and after this date. See current discussion.

Requests

Ibdianajohns@hi.wikipedia

Status: Done

List of users: जाट (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); चौधरी (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Ibdianajohns (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

Reason(s): First two accounts are blocked for promotion and to be sockpuppets of previous acoounts (can be check on discussion link). New user first edit was to vote on a afd of page which was created by socks. See also - enwiki Hindust@ni^{क्या करें? बातें!} 16:54, 2 October 2017 (UTC)

Likely, the same provider, the same UA. einsbor _talk 08:28, 4 October 2017 (UTC)

शिवम कुमार श्रिवास्तव@hi.wikipedia

Status: Done

List of users: शिवम कुमार श्रिवास्तव (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); RechargeMobile Line (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Dreadicator (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Air u for UIDAI (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); बहु लक्ष्मी (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); आरहााकीप (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); शिवम कुमार श्रीवास्तव - अभिनेता (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Ericaally (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); GPRS. Sanchalit (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

Reason(s): All created articles (mostly blank page) about same person or add his name on various pages, apparently same person as first account. Hindust@ni^{क्या करें? बातें!} 17:03, 2 October 2017 (UTC)

user "Ericaally" is not connected, according to CU data, the rest is

Confirmed. einsbor _talk 08:36, 4 October 2017 (UTC)

Agadirhaha@commons

Tracked in Phabricator:
Task T174342

Status: Done

List of users: Agadirhaha (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

CU log

Reason(s): This user uploaded a video demonstrating IP address change to evade an ISP-level blackholing of Phabricator (gerrit:368775). We've identified a number of ISP addresses from public records for Maroc Telecom phab:Z567#10425, but need assistance in finding more ranges. Dispenser (talk) 18:11, 25 August 2017 (UTC)

Deferred to c:COM:RFCU. Hello. Commons has their own CheckUsers, you should request them on their request page. Regards, —MarcoAurelio (talk) 10:03, 26 August 2017 (UTC)

Is this still the case when Phabricator uses www.mediawiki.org for OAuth login? Dispenser (talk) 11:49, 26 August 2017 (UTC)

I cannot really answer that question because I do not know if OAuth logins leave CU trace. I think they don't, but I'll ping @Tgr (WMF) and BDavis (WMF) for clarification. In any case, I think Phabricator administrators can access IP data about users so if there's sockpuppetry problems over there maybe @AKlapper (WMF) and MModell (WMF) will be able to assist. —MarcoAurelio (talk) 09:53, 27 August 2017 (UTC)

Indeed they don't (although the user had to login to MediaWiki at some point, that you could look up). We can add something to the system logs if you think that would be important, feel free to open a phab task about it. Creating MediaWiki log records would be too much effort compared to how rarely it would be useful, IMO. (Also probably not something CUs should have access to, as OAuth authentication can be used for third-party logon and whatnot.) --Tgr (WMF) (talk) 20:26, 27 August 2017 (UTC)

Phab administrators can access IP data of users. If anything is wanted, please elaborate. In the case of Agadirhaha, I can see several IPs but no other users who used these exact IPs (might be WP0 anyway). Based on behavior in Phab I pesonally believe that mw:User:Vaporitoo, mw:User:Monadamat_almajanyat, mw:User:Said_raz, mw:User:Samurai_rider, mw:User:About_spindab, mw:User:Adriano_gagazoo, mw:User:Vampire_dracula, mw:User:Darcula, mw:User:Wikishopia, mw:User:Milanooooooooo, mw:User:Disponsable, mw:User:Skillboy_ghost are sock puppet accounts. --AKlapper (WMF) (talk) 10:25, 28 August 2017 (UTC)

I'll have a look at those on mediawiki. —MarcoAurelio (talk) 10:33, 28 August 2017 (UTC)

There are not conclusive results at mediawiki. They might be sockpuppets based on what they do, but so far the only connection I see is continental procedence, which is not much. The ranges are also crowded to do a safe IP range block. If someone else with more experience does want to have a look, feel free. —MarcoAurelio (talk) 11:27, 28 August 2017 (UTC)

@MarcoAurelio: Can you confirm any of Aklapper's previously seen /16 ranges? Dispenser (talk) 13:49, 3 September 2017 (UTC)

I've filed a phabricator task. Cleaning up phabricator requires console commands which is why a /8, /11s, and /12s are blackholed, but they still somehow got through two filters. Dispenser (talk) 13:04, 28 August 2017 (UTC)

Closing as done, no further action needed here. – Ajraddatz (talk) 18:58, 15 October 2017 (UTC)

Cont Periculos@ro.wikipedia

Status: Done

List of users: Cont Periculos (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); PETștePrăjit (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); PETșteCopt (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); PETștePlutitor (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); GlumeTimesNewRoman (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); GlumeTNR (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); GlumeKMKZ (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Clorură de pește (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Sulfat de pește (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Clorură de iarbă (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

CU log
Discussion: None

Reason(s): No discussion available, since these accounts have been blocked rightaway. They are the most recent creations of a vandal whose sockpuppets, hundreds of them, have plagued the project for years (they are useless for the verification, being too old). The duck test identifies them beyond doubt, but a confirmation by checkuser would add more weight. Victor Blacus (talk) 19:42, 4 October 2017 (UTC)

Done @Victor Blacus: all accounts are

Confirmed. The following confirmed accounts are still unblocked: Cont Periculos, Cont Vechi, and Cont Nou. If you block the accounts with autoblock, it will block the two IPs being used. – Ajraddatz (talk) 17:37, 7 October 2017 (UTC)

Cont Deblocat@ro.wikipedia

Status: Done

List of users: Cont Deblocat (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Aidepikiw, eidepolcicne! (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Eraerc tnoc, rebil! (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Emun ed rotazilitu, alorap! (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Am atuja, as gela! (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Cont Periculos (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); PETștePrăjit (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); PETșteCopt (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); PETștePlutitor (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Clorură de iarbă (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

CU log
Discussion: None

Reason(s): No discussion available, since these accounts haven't been used. The first five have been created last night; the duck test suggests they are sockpuppets of a vandal who has plagued the project for years. The last five are already blocked; they are confirmed sockpuppets of that vandal. See the previous request for more. Here confirmation is requested, in order to block the new ones as well. Victor Blacus (talk) 07:29, 13 October 2017 (UTC)

Done @Victor Blacus: All these accounts are

Confirmed socks. I also found few more - Cont Pescuit, Cont_Provocator, Hqflforshglh, Jvxvcrqvn and Gjti that are unblocked. --Pmlineditor (t · c · l) 10:32, 13 October 2017 (UTC)

Thanks! -- Victor Blacus (talk) 11:13, 13 October 2017 (UTC)

Shivam artistss@hi.wikipedia

Status: Done

List of users: Shivam artistss (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Amzon-net india (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Shivam (born- 24 june) (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

Reason(s): Socks of शिवम कुमार श्रिवास्तव (talk · contribs). Editing same articles and creation of article on himself. Hindust@ni^{क्या करें? बातें!} 18:10, 14 October 2017 (UTC)

Confirmed as well as Shiwam Kumar (Actor), Shiwam--(Hindu Actor), Shiwam Kumar Shrivastava, Shiwam Kumar Shriwastawa, Redirected name, Draft Shiwam Kumar, Shiwam-Kumar-Shriwastaw24, Shivam-- (Actor)--sks, HGVioo, GrX this part post, Shhiwam Kumaar, Television Graff pvtd, Megha punjaa, Shivam Sriwashtav official, SF dpoje, बहु लक्ष्मी, Shivam Srivastav, Alisha was, Shivam Kumar Srivastav, Shivam Kumar Shrivastava, Shiwam - Indian Actor, Shiwam Kumar Sriwastaw (TV Actor). It is related to en:Wikipedia:Sockpuppet_investigations/Shiwam_Kumar_Sriwastaw/Archive. Ruslik (talk) 18:05, 15 October 2017 (UTC)

Sci-fi-@en.wikiversity 2

Status: Done

List of users: bigcheeses (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Jamenta_2 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Rome Viharo WWHP (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); I run away in a desert (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Abd stop stalking people (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Manuls brother (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Why are you reviving all this i will not tolerate it (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Anti racist for life (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Marshallsumter illegal (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); From a tower (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

CU log
Discussion: Suspected large family of LTA accounts already identified per this request and this one. Bigcheeses and Jamenta 2, having more recent edits, already locked, are included for comparison. Most recent:
Bruce Canada (talk • contribs • block • xwiki-contribs • xwiki-date ^(alt) • CA • ST • lwcheckuser) active 15 October 2017
Stop old metally ill internet stalkers in their 70s from internet acess (talk • contribs • block • xwiki-contribs • xwiki-date ^(alt) • CA • ST • lwcheckuser) blocked as vandal 15 October 2017, already locked.

Added as possible:

ZaFrumi (talk • contribs • block • xwiki-contribs • xwiki-date ^(alt) • CA • ST • lwcheckuser) suspected related SPA, not clearly abusive.

Reason(s): Prior requests have identified sleepers and other WMF socks, allowing broader connections. This is, from those (information has been kept private), an LTA with over 200 identified socks, and aggressively attempting to prevent identification or harass anyone looking into the activity. See this edit for the threat claiming 16 active or occasional Wikipedia accounts. If this is true (these socks routinely lie), the user may be using partitioned access, to avoid checkuser, but if there is much activity, users make mistakes and socks are revealed. Thanks. --Abd (talk) 16:28, 15 October 2017 (UTC)

Adding new disruption on meta:

Guerrilla Skepticism member (talk • contribs • block • xwiki-contribs • xwiki-date ^(alt) • CA • ST • lwcheckuser)
Logos is back (talk • contribs • block • xwiki-contribs • xwiki-date ^(alt) • CA • ST • lwcheckuser)

Creating a new account here in order to show multi-user support is classic sock puppetry. If Logos is back is actually w:User:Logos, when Logos is not blocked on meta, nor anywhere, in fact, is sock abuse. Because this LTA often impersonates others, this cannot be seen as showing actual abuse by Logos.

As well, if "Guerrilla Skepticism member" is an actual active Wikipedian working with GSOW, an organization promoting "skepticism on Wikipedia," this would also be abusive socking. I would think that legitimate GSOW members would avoid anything like that. No claim is made of any GSOW abuse on the pages under attack or here. The sock master either lies about affiliations, or there is an even deeper problem, not to be addressed here. This report is only about possibly abusive socking, here or anywhere in the WMF family. --Abd (talk) 18:25, 15 October 2017 (UTC)

Abd is perm blocked on Wikipedia. He is not an admin or check-user here but pretends to be one. He now uses Wikimedia to write slander and false allegations about Wikipedia users he does not like [1]. He makes allegations but does not use check-user data. He has no evidence linking any of the above accounts to AngloPyramidologist or Logos. Why does he have two pages attacking Wikipedia users? He accuses innocent users of impersonation and owning socks they do not own. This is abuse. Bruce Canada (talk) 16:59, 15 October 2017 (UTC)

Btw this is not a fair check-user request. It is clear some of the accounts above are indeed the same person i.e. "Abd stop stalking people", "Why are you reviving all this i will not tolerate it", "I run away in a desert" etc which were active only recently. These belong to a user like myself who Abd has been harassing. Of course an exact match will occur on those accounts I suspect because they were likely editing from the same IP. But you will not individually check all the above old accounts such as Rome Viharo WWHP, that is an old account that will come up stale. But 100$ dollars says the check-user will match three of these recent accounts and then claim all of the accounts including the old unrelated accounts are all the same person. It is easy to just say that but, Wrong. I have every reason to believe at least four different people are responsible for the above accounts. Btw one of the above accounts was mine. Bruce Canada (talk) 17:16, 15 October 2017 (UTC)

I assume that stewards know what they are doing, and I hope that they will be careful, and specific, i.e., between definitive identification and possible relation. Behaviorally, all but one of the reported socks could be locked, but that's not my decision and this is not a lock request. --Abd (talk) 18:25, 15 October 2017 (UTC)

I (and some others) have done these checks. All but Bruce Canada are

Confirmed on the same IP. There is no technical evidence that Bruce Canada is related to the other accounts, though I wouldn't expect any with the type of IP he was using. – Ajraddatz (talk) 19:08, 15 October 2017 (UTC)

In discussing it with Ajraddatz, we have found that Bruce Canada is indeed connected to Guerrilla Skepticism member, Logos is back, Logos Tumbleman Manul Abd Jamenta Dan Skeptic, Muslim atheist, Big Bang happened and is a fact etc so there is technical evidence enough for

Likely at least. RadiX ∞ 20:27, 15 October 2017 (UTC)

Out of caution, please explicitly confirm, if possible, the relatedness of the account below, which appears to be an account impersonating a real person who operates a blog called WWHP, and known to be a long-term target of this sock family.

Rome Viharo WWHP (talk • contribs • block • xwiki-contribs • xwiki-date ^(alt) • CA • ST • lwcheckuser).

Given the duck test, "likely" is good enough here for us to assume connection, if not identity. --Abd (talk) 21:19, 15 October 2017 (UTC)

Unfortunately, CU data on that account will be

Stale by now. RadiX ∞ 21:28, 15 October 2017 (UTC)

Done Thanks. --Abd (talk) 22:03, 15 October 2017 (UTC)

Aydinsalis@az.wikipedia

Status: Done

List of users: Aydinsalis (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Afrasiyab (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Al.xonder (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Çim Çen In (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Faderis (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Shekikhanof (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Айдин Мамедов (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); M.Salis (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Xananxanxana (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Petux sseferin ağzına verən (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

CU log

Reason(s): This user is a vandal. Administrators block him, but hi registers new accounts. I would like to be sure that all this accounts belong to him..--Sortilegus (talk) 18:25, 18 October 2017 (UTC)

I've checked the accounts, and there is only very weak technical evidence connecting some to others. Afrasiyab and Xananxanxana are

Likely. The rest jump between multiple mobile ranges. You'll need to block based on behavioural evidence, I'm afraid. – Ajraddatz (talk) 19:19, 18 October 2017 (UTC)

Thanks Ajraddatz. --Sortilegus (talk) 19:41, 18 October 2017 (UTC)

शिवम कुमार श्रीवास्तव - अभिनेता@hi.wikipedia

Status: Done

List of users: Xfggolifee (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Sunnharagh (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Kundali Bhagya (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

CU log
Discussion: w:hi:वि:कठपुतली

Reason(s): Creation of article which was created by confirmed sock-puppet above. Hindust@ni^{क्या करें? बातें!} 17:36, 22 October 2017 (UTC)

What I posted here might be better off brought to Commons and/or enwiki, but I'm posting here just for reference. On enwiki, the article Kundali Bhagya has been persistently added images of Kundali Bhagya, which then get deleted (from Commons) for copyright violation. Examples:

Addition by Amzon-net india: 1, delink due to Commons deletion: 2
Addition by Kundali Bhagya: 1, delink due to Commons deletion: 2

As for Commons, Kundali Bhagya 2017.jpg, Kundali-Bhagya.jpg and Kundali Bhagya.jpg are the ones that got repeatedly uploaded by Shiwam's socks. Also notable is that all these three accounts listed have several contributions at Commons, but almost all of them have been deleted.

So there have been some accounts keep uploading the same image at commons, and in the mean time putting them to enwiki. -★- PlyrStar93. _{→Message me. ←} 01:13, 24 October 2017 (UTC)

All

Confirmed as belonging to the same LTA. No sleepers found. RadiX ∞ 01:45, 24 October 2017 (UTC)

Bertrand101@ceb.wikipedia

Status: Done

List of users: DWTS-AM (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); SMCitySantiago (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

CU log
Discussion: W:Wikipedia:Long-term abuse/Bertrand101

Reason(s): This username has its own evidence itself DWTS-AM created DYHH a fork of DZHH which is owned by Mareco Broadcasting Network. Please check for other users on Cebuano Wikipedia which is creating hoax stations and lock the socks. 209.242.141.27 20:51, 23 October 2017 (UTC)

Confirmed. Also found: DYMA-AM. RadiX ∞ 02:05, 24 October 2017 (UTC)

Various Impersonator@th.wikipedia

Status: Done

List of users: วรกร ศวัสกร (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); ฝนทิพย์ วัชรตระกูล (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); ชยพล บุนนาค (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); ธันวา สุริยจักร (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); คเชนทร์ เปล่งศิริวัธน์ (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); ณัฐวัฒน์ เปล่งศิริวัธน์ (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); ทัศนียา การสมนุช (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); อธิชนัน ศรีเสวก (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); ฮาน่า ลีวิส (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

CU log

Reason(s): These users in Thai Wikipedia is the name of actors/actresses who performed on Channel 7 in Thailand. Apparently, someone impersonated their name in Wikipedia and repeatedly insert false information about soap operas/TV series these actors are participating with the intent to provide false impression that the actors/actresses themselves are editing Wikipedia. While many of these accounts are blocked with account creation disabled, the mastermind is still at large, and I would like to request checks whether these accounts are related in some way in order to establish proof for further handling of new incidents. G(x) (talk) 08:43, 27 October 2017 (UTC)

Doing... Ruslik (talk) 19:51, 30 October 2017 (UTC)

All accounts appear to be blocked. I did not find any master account. Ruslik (talk) 20:02, 30 October 2017 (UTC)