Steward requests/Checkuser/2010-07

From Meta, a Wikimedia project coordination wiki

Requests

117.6.64.175@vi.wikipedia

Summary of the above request: Several IPs participating in the same topic in the Administrator's Noticeboard. The requesting user fear that the IPs are veteran users (since they seem to be very knowledgeable about Wikipedia's rules) who created many sockpuppet accounts to accuse other users of using sockpuppets. Their modus operandi seem to be accusing people of using sockpuppets, but then keep switching accounts so that people can't respond to them. DHN 07:47, 13 June 2010 (UTC)
Hello, I would say  Declined because Fishing CheckUser is not for fishing. We will not be pointing out which user edits under X IP address for privacy reasons. Other stewards are welcome to review and comment. — Dferg 09:38, 28 June 2010 (UTC)
I agree. with Dferg's assessment. FiliP ██ 14:14, 3 July 2010 (UTC)
OK, thanks!Thần Gió 00:42, 4 July 2010 (UTC)

Trans-Continental@uk.wikipedia

Do I understand properly that you're going to request checking whenever you see an account with not very large amount of edits noticed in voting? Otherwise I can't find an acceptable explanation for the request. Yes, two accounts. Yes, they both took part in votings, one of them is fairly blocked for disruption. What is Trans-Continental's fault? Corrections of mistakes are not a crime, nor voting is. Trolling is absolutely absent, isn't it? I mean, although the coincidence is possible (theoretically), there's no ground for processing this request, as one of the nominants hasn't violated any established rules. I urge stewards to treat such requests with more accuracy. --700!n 09:00, 19 May 2010 (UTC)
Every time I make a request here appears a user with no or little contributions who says the check shouldn't be done... The situation is as follows: user Trans-Continental was registered on March 8 and was completely inactive, suddenly on May 15 (more precisely, while Lunic 14 was blocked) he makes 50 edits in 42 minutes, 20 minutes later he makes a list of unused templates and 10 minutes later he makes a deletion request. After Lunic 14's block is over, Trans-Continental disappears and Lunic 14 comes back. However, after Lunic 14 was fairly blocked for disruption, Trans-Continental becomes active again. Personally for me it's clear that if Trans-Continental who was inactive for more than two months edits only when Lunic 14 is blocked and has similar style, it's a block evasion — NickK 10:44, 19 May 2010 (UTC)
The fact that Trans-Continental had been registered a month before Lunic 14 did automatically refutes the possibility of his being a sockpuppet. Your reasoning about the consequence of events would make sense if they hadn't happened within one day, and Lunic 14 hadn't been indefblocked in 20 minutes after his response to the first blocking.

In fact, these accounts have virtually nothing is common, one single occurring in a voting is rather casual (given that its summary is clear anyway), making a list of unused templates has nothing to do with sockpuppetry, similarity of the styles is just your opinion, and you know this perfectly. Trans-Continental hasn't infringed any rules, and that's why there is no good reason for the check and no use revealing personal info about his IP. --700!n 11:48, 19 May 2010 (UTC)

  • I guess, it's about time we closed the request, as we seem to have agreed upon its unnecessity. Moreover, Trans-Continental is indefblocked now on account of groundless complaints, thus the check is not needed any longer. --700!n 09:41, 25 May 2010 (UTC)
    Trans-Continental was blocked for trolling, and uk:User:Thetrain appeared. He had exactly 52 article edits, and in a few hours after Trans-Continental was blocked voted against deletion of his page and nominated Category of Indefblocked users for deletion. He also continued very strange comments at the page of deletion requests. Trans-Continental, Lunic 14 and Thetrain have many things in common, they all act in the same way: 1) creation of a userpage, 2) 52 to 54 article edits (our rules require 50 article edits to post comments to deletion requests) (Trans-Continental Lunic_14 Thetrain), 3) some break, usually another account is active at this moment (Trans-Continental did not edit until Lunic_14 was blocked, Thetrain edited only articles until Trans-Continental was blocked), 4) user ceases making article edits and edits only talk pages and deletion requests, the only article edits are rather provocative or edit wars (Trans-Continental Lunic_14 Thetrain), 5) user receives warning for disruption and comments in a rude way (Lunic_14 Thetrain). All these three users look like someone's accounts created solely for gaming the system and participation in votings, their behavior is pretty annoying, so I think that it's necessary to check whether they are sockpuppets of the same user and if their IP can be blocked (particularly, if they use open proxies) — NickK 22:51, 25 May 2010 (UTC)
    Firstly, you're simply lying, as two of them have 65 mainspace edits, and this lie clearly points to your reluctance to give the correct reason for the check. You were explained why the request about L14/T-C was inappropriate, and nonetheless you continue to bring the same arguments here.
    Well, then please answer - where do you see trolling amongst Thetrain's contribs? I don't. The rule about 50 mainspace edits was invented not for harassment of those who votes after making 52/54/60 ones, really? Then his behavior is normal and predictable, moreover, he had written two perfect articles - what else do you expect?
    creation of a userpage - oh, all admins have a userpage, let's check them for using open proxies! (if speak seriously, 75% of newbies on any Wikipedia have a userpage, hard to believe you're unaware of it)
    52 to 54 article edits - this is lie;
    some break, usually another account is active at this moment - my previous reply concerned this, be more attentive;
    user ceases making article edits and edits only talk pages and deletion requests, the only article edits are rather provocative or edit wars - I personally don't observe it, however, everyone is welcome to choose what he wants to edit.

So, your "arguments" have no validity again. --700!n 08:57, 26 May 2010 (UTC)

Yes, they try to look like really good users, bt anyway, don't you think that their behavior significantly changes after 52nd or 54th article edit? They begin to participate in all possible discussions and votings instead of what they have previously done (creation of articles, fixing spelling and grammar mistakes). Yes, some of Lunic 14 has made 54 edits in 2 days, and it took him 19 days to make the next 11 edits, Trans-Continental has made 53 edits in 49 minutes, and it took him 19 days to make the next 12 edits. And these edits are very different, if the first 53 or 54 edits were useful minor edits, the following ones were different, e.g. Trans-Continental was blocked in dewiki for removal of names in foreign languages in the article about city, where he was reverted by Pavlo_Chemist, so he added names in foreign languages to the article about chemical compound. Among Lunic_14's 11 edits there is the following one. An example of Thetrain's trolling is given above, is it normal to change one's mind from oppose vote with argument "fdsfgs" to support vote with argument "fdsfgs"? Anyway, these users make about 50 really useful edits and immediately begin trolling in Project namespace and/or provocative edits, so that's very unlikely that these are three different users who immediately after 52nd or 54th edit suddenly decide to comment in all possible discussions. The same matter with User:700!n, who suddenly appeared here with good knowledge of the policies of Ukrainian Wikipedia but without any edits in any project — NickK 09:44, 26 May 2010 (UTC)

From a technical standpoint, it appears that these accounts are all related:

Віктор Чуй@uk.wikipedia (talk contribs deleted contribs logs block user block log checkuser CentralAuth AllContribs) Thetrain@uk.wikipedia (talk contribs deleted contribs logs block user block log checkuser CentralAuth AllContribs) Vitya Feonor@uk.wikipedia (talk contribs deleted contribs logs block user block log checkuser CentralAuth AllContribs) Maxim09@uk.wikipedia (talk contribs deleted contribs logs block user block log checkuser CentralAuth AllContribs) Another World@uk.wikipedia (talk contribs deleted contribs logs block user block log checkuser CentralAuth AllContribs) Trans-Continental@uk.wikipedia (talk contribs deleted contribs logs block user block log checkuser CentralAuth AllContribs) 700!n@uk.wikipedia (talk contribs deleted contribs logs block user block log checkuser CentralAuth AllContribs) Electric Barbarella@uk.wikipedia (talk contribs deleted contribs logs block user block log checkuser CentralAuth AllContribs) Prącie@uk.wikipedia (talk contribs deleted contribs logs block user block log checkuser CentralAuth AllContribs) Lunic 14@uk.wikipedia (talk contribs deleted contribs logs block user block log checkuser CentralAuth AllContribs) Ex-516@uk.wikipedia (talk contribs deleted contribs logs block user block log checkuser CentralAuth AllContribs) Йо@uk.wikipedia (talk contribs deleted contribs logs block user block log checkuser CentralAuth AllContribs) Globalfree@uk.wikipedia (talk contribs deleted contribs logs block user block log checkuser CentralAuth AllContribs) Diskard@uk.wikipedia (talk contribs deleted contribs logs block user block log checkuser CentralAuth AllContribs) Our Truth@uk.wikipedia (talk contribs deleted contribs logs block user block log checkuser CentralAuth AllContribs) Lffff@uk.wikipedia (talk contribs deleted contribs logs block user block log checkuser CentralAuth AllContribs) Marko-Antonio@uk.wikipedia (talk contribs deleted contribs logs block user block log checkuser CentralAuth AllContribs) Я гусак!@uk.wikipedia (talk contribs deleted contribs logs block user block log checkuser CentralAuth AllContribs) Artf1rst@uk.wikipedia (talk contribs deleted contribs logs block user block log checkuser CentralAuth AllContribs) Фшпіавгшрівіпршмеішгукшгеимспкра@uk.wikipedia (talk contribs deleted contribs logs block user block log checkuser CentralAuth AllContribs) .one.of.them.@uk.wikipedia (talk contribs deleted contribs logs block user block log checkuser CentralAuth AllContribs) Вася1987@uk.wikipedia (talk contribs deleted contribs logs block user block log checkuser CentralAuth AllContribs) Kukurudza@uk.wikipedia (talk contribs deleted contribs logs block user block log checkuser CentralAuth AllContribs) 32x8@uk.wikipedia (talk contribs deleted contribs logs block user block log checkuser CentralAuth AllContribs) New Moon on Monday@uk.wikipedia (talk contribs deleted contribs logs block user block log checkuser CentralAuth AllContribs) ΠΟΠΑ@uk.wikipedia (talk contribs deleted contribs logs block user block log checkuser CentralAuth AllContribs) ѠѠѠѠѠѠѠѠѠѠѠ@uk.wikipedia (talk contribs deleted contribs logs block user block log checkuser CentralAuth AllContribs) ĸäłååļîšūŧ@uk.wikipedia (talk contribs deleted contribs logs block user block log checkuser CentralAuth AllContribs)

J.delanoygabsadds 21:02, 26 May 2010 (UTC)

Please also check a few more new accounts:

contribs deleted contribs logs block user block log checkuser CentralAuth AllContribs) (user's only contributions is provocation at ArbCom elections by nominating a bot, an indefblocked user and users with long history of blocks, the second edit was creation of a userpage with a strange userbox art)

contribs deleted contribs logs block user block log checkuser CentralAuth AllContribs) (user only wrote a welcome message to the above user)

contribs deleted contribs logs block user block log checkuser CentralAuth AllContribs) (user's only contribution is an addition of a userbox, which was nominated for deletion as useless)

contribs deleted contribs logs block user block log checkuser CentralAuth AllContribs), 195.64.148.9@uk.wikipedia (talk contribs deleted contribs logs block user block log checkuser CentralAuth AllContribs) — IPs edited after most active of the above users were blocked, but before CU results, pretty similar style (provocation in deletion discussion - like Thetrain, wars about colours of babel boxes - like Lunic_14, strange citation requests a few minutes after an edit was made - like Lffff

contribs deleted contribs logs block user block log checkuser CentralAuth AllContribs) - IP notificated one crat and one admin about the results of the above check

Thanks — NickK 19:57, 2 June 2010 (UTC)

Brezza del mare,Vunz Vujmingz,Byadengz,Quite Storm,Amaqqut,Biŋhai@zh.wikipedia

Results
  • User:Vunz Vujmingz looks Unrelated unrelated.
  • It is Inconclusive inconclusive from a CheckUser point of view to determine that the accounts User:Brezza del mare, User:Byadengz, User:Quite Storm, User:Amaqqut and User:Biŋhai are operated by the same user. You/Your community will have to decide that based on other things (like editing patterns, etc - please note that CheckUser is not the unique tool to find out sockpuppets). If any steward wants to review my findings is welcome to do so.

— Dferg 23:54, 6 July 2010 (UTC)

I looked at Dferg's findings, and I agree with his conclusions. Excluding Vunz Vujmingz, no conclusions can be made without more information.Shanel 00:24, 7 July 2010 (UTC)

ෆෙලිඩේ@si.wikipedia

Results

— Dferg 11:00, 7 July 2010 (UTC)

Thank you Dferg, for the speedy response.--Chanakal 12:33, 7 July 2010 (UTC)

ko:사용자:부산 et al

115.92.202.27 04:57, 7 July 2010 (UTC)

--Shizhao 09:52, 7 July 2010 (UTC)

Prima_klasy4na@ukwiki

Status:    Done

Please check

  • Ні
  • Userlinks
  • K3
  • Ттх
  • Db
  • Erudit
  • Капут
  • Амба
  • Тест

These accounts created in March and made similar edits in some templates. Possible, it is docks of indefblocked Prima_klasy4na.Anatoliy (talk) 22:14, 10 July 2010 (UTC)

Results of the sockfarm: Users: Ні, Userlinks, K3, Ттх, Db, Erudit, Капут, Амба, Тест, X1, I7, I5 Dy, K9, Текст, Карта, Нд and Тест1 are the same user. After review old logs I can say  Confirmed the relationship with user Prima klasy4na. Regards - @lestaty discuţie 23:04, 10 July 2010 (UTC)

@lestaty, thanks for good and fast work. And explain me, please, how and why most of this nicks where blocked before results of the sockfarm? Is any violations of rules by uk:user:NickK? See uk:Спеціальна:Log/block/NickK--Wikimeetup 00:52, 11 July 2010 (UTC)

Hi! I don't know local police about blocks, but technical information (checkuser) is not the only method to find socks. Regards - @lestaty discuţie 01:01, 11 July 2010 (UTC)
  • There are no any rules at uk.wikipedia.org--Wikimeetup 01:11, 11 July 2010 (UTC)
    There are rules. According to Blocking policy, a block is limited to the user, not to one of his accounts. There is also ArbCom desicion, according to it Prima_klasy4na (aka Ink) is allowed neither to edit Template namespace nor to create sockpuppets, but he has created sockpuppets listed above to edit Template namespace. Most of these sockpuppets clearly passed duck test, thus they were blocked without CU request — NickK 13:49, 11 July 2010 (UTC)

Yashar@fawiki

CheckUser results/comments

Hello,  It looks like a duck to me. That is to say: if there is enough behavioural evidence to justify a block (the so called "blocks on behaviour") there is no need to run a CheckUser. Best regards, --dferg ☎ talk 17:01, 10 July 2010 (UTC)

Thank you so much.Behzad.Modares 02:45, 11 July 2010 (UTC)

Beetlebaum@en.wikiversity

It is a sockpuppet of user JWSchmidt. I report this since there's currently a controversy about blocks relating all these users so community can make an informed decision. es:Drini 14:55, 14 July 2010 (UTC)

ෆෙලිඩේ@si.wikipedia

Users - Unrelated Unrelated
IP - Not done - cannot associate an IP to a user for obvious reasons.

--Jyothis 04:27, 17 July 2010 (UTC)

Withclear@zh.wikipedia

CheckUser results and comments
  • KEIM is Stale, that means that his/her edits are too old and are no longer stored in the CheckUser database. Check not performed, request can't be processed. --dferg ☎ talk 19:06, 19 July 2010 (UTC)

Krishjaanis@lv.wikipedia

Unlikely Unlikely. Krishjaanis and Mansalus from different ISPs and use many different user-agents --Shizhao 09:38, 20 July 2010 (UTC)
In that case would it be possible to check if someone else is harassing Krishjaanis or (though I find it unlikely) that Mansalus is also using open proxy to hide who he is if checked or using mobile phone which would have diffrent ISP (in that case ISP would be LMT, Tele2 or Bite) ? The thing is I think somebody is trolling and this has been going on for quite some time, but I can't quite put my finger on it ~~Xil...(talk) 10:40, 20 July 2010 (UTC)
No, ISP not LMT, Tele2 or Bite. Krishjaanis and Mansalus use several diffrent computer access internet( at diffrent ISP), maybe at Home, at Work, at Cafe etc. Plese other stewards review--Shizhao 11:20, 20 July 2010 (UTC)
Note Note: Krishjaanis and Mansalus same point: 1) a number of different ISP; 2)Often use different computers (user-agents). Difference: ISP and user-agents are not nearly the same --Shizhao 11:40, 20 July 2010 (UTC)
The thing is that someone well versed in Wikipedia is occasionaly is making open proxy attacks on us, since first time was two years ago after Krishjaanis was blocked for the first time, so I suspected him. Few months ago this happened again and I blocked Krishjaanis believing that there is enough evidence that it is him. He contested the block using several IP addreses, when asked he admited two of the anonymous users were him and explained that he was editing from home and work. One of those was a proxy at which he blamed sysadmins at his workplace, implying that it is some safety feature rerouting everything through proxies. Also someone created lv:Lietotājs:Revolucija! this January with sole purpose to flame at community portal, perhaps the same guy. There is though some evidence that someone else may be using open proxies e.g. here someone using a proxy is teasing Krishjaanis ~~Xil...(talk) 12:20, 20 July 2010 (UTC)
Nevermind another user confesed that he created this account for his friend ~~Xil...(talk) 13:21, 21 July 2010 (UTC)

ko:사용자:떠돌이 et al

-- 100범 10:33, 20 July 2010 (UTC)

Unrelated Unrelated from a CheckUser point of view --Shizhao 11:30, 20 July 2010 (UTC)

HISTORIAGEOGRAFIA@eswikibooks

Results

I'd say yes after reviewing the CU data. No other accounts es:Drini 18:41, 22 July 2010 (UTC)

Thank you. --dferg ☎ talk 18:43, 22 July 2010 (UTC)

Rock drum@en.wikiversity

Please check Rock drum and Moulton. A Wikiversity Sysop accused me of being a sockpuppet. A link to the discussion can be found here. The user in question, Ottave Rima, seems determined to call me a sockpuppet. Thanks, Rock drum (talk·contribs) 16:30, 22 July 2010 (UTC)

Moulton is Stale, Rock drum and JWSchmidt Unrelated Unrelated--Shizhao 12:00, 26 July 2010 (UTC)

Retailer@ms.wikipedia

Status:    Done

Hi, I am SYSOP from MS Wiki. Please block IP address for * Retailer (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser). Suspected to be mass vandal as previous attack. Previous suspected sockpuppet used are Shah560, Lidl10, Datamonitor, MyExcellency ... a lot more. Yosri 04:25, 23 July 2010 (UTC)

Previous sockpuppet as follow (in no particular order):-

Results

Completed Completed - I've found a blockable range. Please contact me privatelly via email or IRC on #wikimedia-stewardsconnect. Thanks, --dferg ☎ talk 11:20, 23 July 2010 (UTC)

Votez Romano@frwiktionary

Regular vandal on this project. I blocked this IP plage and he staid calm for a moment. But yesterday some insults refering to nazism have been insered into pages with account Votez Romano@frwiktionary.

Please see past requests : Steward_requests/Checkuser/2010-05#Philon_III.40frwiktionary | Steward_requests/Checkuser/2010-01#Regulus.40fr.wiktionary.org.

Best regards. -- Quentinv57 14:08, 23 July 2010 (UTC)

Likely Likely closely matches the Philon III series. Tchatch Wadjango is another account in Philon series that is not blocked at this time. --Jyothis 14:09, 23 July 2010 (UTC)

Done Okay, I blocked him. Thanks -- Quentinv57 14:34, 23 July 2010 (UTC)

Tranco28@it.wikiquote

Results