Steward requests/Checkuser/2010-12

From Meta, a Wikimedia project coordination wiki

Requests

Boneco de Neve@pt.wikipedia

MoreInfo Additional information needed, please provide more information about this case, we are not active in the ptwiki community and therefore we can not know all about the real reasons for this check. I dont see any motive to check these users only looking for the "Anexo:Elenco de Ribeirão do Tempo". --- @lestaty discuţie 22:29, 6 December 2010 (UTC)
His favorite pages are Rede Record's telenovelas. Francisco 22:37, 6 December 2010 (UTC)
This isn't a reason to check the user xD. Having socks does not constitute a "crime" unless you use them to vote, comment in the same discussion with two or more accounts or evade blocks. Striker talk 20:07, 8 December 2010 (UTC)
The reason is "block evasion" of the banned user Lucas081094. Previous related request.” TeleS (T PT @ C G) 21:45, 11 December 2010 (UTC)

-- Avi 06:04, 16 December 2010 (UTC)

Klymax@pt.wikipedia

 It looks like a duck to me? I think that it looks a duck to you too. If the answer is "yes", no ckeck is necessary... --- @lestaty discuţie 22:33, 6 December 2010 (UTC)
A sort of... the pages are the same, but the behavior is different, so it is not exactly a duck IMHO. Only the edits of Klymax are insulting. Numivasi could have used his own account to do what Klymax did. He was not blocked and there isn't a clear reason for s/he create another account. Besides, the accounts were used in an alternate way. If it is the same person, s/he logged-in and logged-out at least four times, which is uncommon and leads me to think that the edits were made by more than one person. What do you tell me? Should I block Numivasi too?” TeleS (T PT @ C G) 23:22, 6 December 2010 (UTC)

 Declined Not necessary now. Bring back if suspicions of sockpuppetry come back. -- Avi 06:25, 16 December 2010 (UTC)

侯傑倫@zh.wiki

Results as follows. Important: please do review carefully before taking any action. This check was rather difficult and if somebody wants to re-check my findings is welcome to do so.
  • Stale (no data avalaible)
zh:User:影武者
  •  Confirmed
zh:User:侯傑倫
zh:User:劉勝仁
  • Likely Likely (group #1 - same range)
zh:User:Jay Hou (blocked)
zh:User:Joy Hou (blocked)
zh:User:John Hou
zh:User:蔣渭水 (blocked)
zh:User:林柳生 (blocked)
zh:User:林信輝 (blocked)
zh:User:劉勝仁 (blocked)
zh:User:林福映 (blocked)
zh:User:林福映 (blocked)
zh:User:李金津 (blocked)
zh:User:絕世超人劉曉波 (blocked)
zh:User:超人劉曉波 (blocked)
zh:User:Martial Champion (blocked)
zh:User:林朕圀 (blocked)
zh:User:丁文傑 (blocked)
zh:User:林桀 (blocked)
zh:User:Super Freedom Hero (blocked)
zh:User:Jason0425 (previously blocked) (globally locked)
zh:User:丁有善 (blocked)
zh:User:Alfred0823 (blocked)
zh:User:大峱支 (blocked)
zh:User:Peter Obama Lam (blocked)
zh:User:蕭建隆
  • Likely Likely (group #2 - another range - dup. accouts from range #1 may appear here as well)
zh:User:Peopledom of Vietland
zh:User:吉田光明
zh:User:John Hou
zh:User:林福映 (blocked)
zh:User:侯傑倫 (blocked)
zh:User:蕭建隆 (blocked)
zh:User:萊斯利 (blocked)
zh:User:李金津 (blocked)
zh:User:吳清白 (blocked)
zh:User:Martial Champion (blocked)
zh:User:林曉波 (blocked)
zh:User:吉田光明 (blocked) maybe of interest
zh:User:Peopledom of Coviet (blocked)
zh:User:洨籃子 (blocked)
zh:User:朱學淵 (blocked)
zh:User:德國峱支 (blocked)
zh:User:大峱支 (blocked)
zh:User:林光榮 (blocked)
zh:User:Alfred0823 (blocked)
zh:User:聖鬥士冰河 (blocked)
zh:User:林桀 (blocked)
zh:User:林柳生 (blocked)
zh:User:金田山部 (blocked)
zh:User:林朕圀 (blocked)
zh:User:蕭建隆
  • Possible Possible (please do review thoroughly before taking any action)
zh:User:Jason Obama Lin
  • Note Note: For those with "(blocked)" next to the username I didn't checked for how long they are. Your task. Please do review all the accounts before taking any action. As I've said, it was rather difficult. Thank you.
--dferg ☎ talk 20:15, 6 December 2010 (UTC)
Thank you very much!--Altt311 12:09, 8 December 2010 (UTC)

Abc72866@zh.wikipedia

more users:

--Shizhao 14:24, 1 December 2010 (UTC)

Lets to results...

Stale

  • LB336699 (no data avaiable)

 Confirmed

  • Pop72866
  • Qwasd38699
  • Aaa72866
  • Zzz72866
  • Qapp72866
  • Acef72866
  • 小彥
  • 吳昱棋
  • Zzz72866
  • Asd7286600
  • Lopol336699
  • 奇特追查員
  • Msnhinet8jp
  • Dreamnext
  • 九十九年
  • Qaz7286600
  • 鈴木音樂才能教育
  • Polpol336699
  • Zzz72866
  • Boyo

All users are socks from Abc72866. Note: The user is using multiple IP's and many OS, but he always ends up sharing the profile with yours own other accounts. --- @lestaty discuţie 22:03, 6 December 2010 (UTC)

thx! --Shizhao 08:06, 7 December 2010 (UTC)

201.37.243.132@pt.wikipedia

Since these users were blocked awhile ago, their accounts are probably stale. I don't think we'd find any IP information if we did the check. Shanel 13:27, 3 December 2010 (UTC)
But the user has been using other IPs and sock puppets since he was blocked with his "main accounts", such as 187.89.21.57 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser), 187.51.130.235 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser), Edmilson Quebra-força (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser) and 201.37.33.145 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser). RafaAzevedo 18:33, 3 December 2010 (UTC)
Stale Is not possible check the accounts Quintinense and Dbc2004, but with the data avaiable in checkuser logs of ptwiki is possible Likely Likely the ips 201.37.XXX.XXX with these accounts. --- @lestaty discuţie 22:09, 6 December 2010 (UTC)
What does it mean, exactly, in practical terms? Can the ptwiki admins actually do something about it? And also, if the logs of blocked users is not available anymore for verifications due to the amount of time passed, how will it ever be possible to check for future attempts made by them to circumvent their blocks? There are a number of users in the same situation as Quintinense, using IPs despite being blocked for long periods. RafaAzevedo 17:46, 7 December 2010 (UTC)


Mapa@bg.wikipedia

 Confirmed

  • Mapa
  • Mapa111
  • Fark333333

 Confirmed

  • English
  • Rssssss

Likely Likely

  • Fark65464
  • English
  • Napa1111
  • RS3333
  • Rs58

Done -- Not matching to any IP specifically for obvious reasons. --Jyothis 00:13, 21 November 2010 (UTC)

Excuse me, I didn't understand about the IPs, what reasons are obvious? Then, what about English, I didn't understand whether it is confirmed or likely? And what about Gogo? Can you further check Fasa565464, Fasa565464654654, Fasa565464333, English23456, Mapa34567890, Mapa121242342? Spiritia 17:48, 21 November 2010 (UTC)
We do not match people to IPs for privacy reasons. Gogo didnt have any recent records to check with. likely group comes from a similar range, but not exactly same as others in the group, where as their user agents matches. It will be upto the community to review their actions and confirm if they are same.

 Confirmed

  • English23456
  • English

 Confirmed

  • Mapa34567890
  • Mapa
  • Fasa565464
  • Mapa121242342
  • Fasa565464

No contribution to check

  • Fasa565464654654
  • Fasa565464333
Alright, thanks for the explanation and the efforts in checking the new ones. (I'd only note that I haven't expected you to be able to match people to IPs, but usernames to IPs. But that's fine too.) Spiritia 08:09, 22 November 2010 (UTC)

New cases for investigation

Sorry for intruding again, but I think that the same user today also registered the three usernames bg:user:Спиритиа, bg:user:ШейдОфГрей and bg:user:Блъдайс, which represent Cyrillic versions of my username and the usernames of the sysops bg:user:ShadeOfGrey and bg:user:BloodIce. It shares with the rest accounts the same pattern of behaviour (using of capslock, vandalising our userpages and obsession of becoming sysop). The range may be different, since the range covering the above mentioned IPs has been locally blocked. Please lock these account globally and take (serious!) measures against this proceding disruption. Thank you. Spiritia 15:37, 22 November 2010 (UTC)

Likely Likely

  • Спиритиа
  • ШейдОфГрей
  • Блъдайс
  • Уикипедия
  • Модернатор

All in similar range and same identification pattern. Kindly review their actions and look for the common patterns--Jyothis 18:56, 22 November 2010 (UTC)

Just would like to add that these matched one another and were not checked against the ones we checked before --Jyothis 19:02, 22 November 2010 (UTC)
(Sorry for writing only now, but other Wikipedia-related legal issues with deadline of yesterday prevailed.) I'm not surprised from the results, the common pattern exists. May I repeat my request to compare this group of sockpuppets against the group formed around Mapa, as traced above. This check is really important. Spiritia 10:13, 24 November 2010 (UTC)
I'm afraid the case is becoming more and more complicated... Could you please also check bg:User:Лъчезар Илиев? (That happens to be my name, obviously in another attempt at malicious impersonation.) Thanks a lot! LuchesarT/C 18:47, 29 November 2010 (UTC)
Sorry, I'm not sure why a Checkuser is/was required here. The last usernames were already indefinitely blocked for impersonation. The disruption from them on Wikipedia was extremely minor (no or very few edits limited to talk pages, no article vandalized, no voting abuse). From CheckUser#Privacy_policy: privacy policy considerations are of tremendous importance. Unless someone is violating policy with their actions (e.g. massive bot vandalism or spam) and revealing information about them is necessary to stop the disruption, it is a violation of the privacy policy to reveal their IP, whereabouts, or other information sufficient to identify them, unless they have already revealed this information themselves on the project. In this case revealing information about them was NOT necessary to stop the disruption as they were already blocked. --5ko 11:46, 30 November 2010 (UTC)
If there had been any misunderstanding concerning how much information could be revealed about the user account vs IP address relationships, I believe it's cleared now. Apart from that, I don't really see any request for personal information (e.g. IP addresses, browser user-agents, etc.) of any specific registered user. The requests were — and from the very beginning — to identify possible cases of sock puppetry. I wouldn't call that "privacy violation" — after all, it's exactly the (main) reason to have checkusers.
As for each puppet having caused only minor disruption — that is true, indeed. But then why are we bothered with the sock puppetry at all if what matters is only the disruption per single puppet? It's hardly necessary to explain this, but sock puppetry is one of the most, if not the most damaging act against the trust between the Wikipedia editors. We know the rule: DO NOT SOCK. It's simple, it's clear, and its importance cannot be emphasized well enough.
Sadly, the results so far present one ugly picture of sock puppetry, where someone (could be a few people, as well) plays a game with the Bulgarian Wikipedia community. Not only he/she pretends to be several different people, but he/she also organizes elaborate "dramas", where the puppets engage in hot arguments with one another, and with the alleged pupped-master playing the role of the "good Samaritan", defending Wikipedia from the "bad guys".
Some colleagues have called this behaviour schizophrenic, and while I'd rather refrain from putting such harsh labels, at least from my professional point of view as an infosec officer, I find the case genuinely disturbing. For this reason, I also find the request to reveal how far this sock puppetry has spread to be well substantiated. The whole story has caused enough frustration (unsurprisingly, indeed) amongst the editors to be just left alone.
LuchesarT/C 20:54, 30 November 2010 (UTC)
I was referring to the usernames in this section, not the "Mapa111"... bunch. In my view, these can be immediately blocked for impersonation and so they were, CheckUser is not necessary for this. It is obvious that the "Mapa" group was a new, impatient user who didn't want to read the documentation and got blocked many times, and it is obvious that "Модернатор" is someone with a lot of wiki-experience (ever heard of Namespace shift?). A CheckUser may be needed if there are reasons to believe someone (like "Mapa") uses multiple accounts to evade bans or blocks, to vote multiple times, to evade the Three Revert Rule. CheckUser is not required to fight minor-scale vandalism and shouldn't be used to put pressure on other editors. It should only be used to prevent further disruption if blocking doesn't help. "Модернатор" stated that s/he'll create other accounts or edit anonymously. What are you planning to do now with this CheckUser information? How exactly will it help to prevent further disruption? --5ko 15:27, 1 December 2010 (UTC)

To answer the question on Лъчезар Илиев, This matches the last set. Also, the last set does not seems to link directly to the first set at a glance. I did not dig deeper, as you are discussing the need for this. I am closing this request at this time and I would request you all to take this discussion back to the local wiki and decide together on what you would like to do with them. Thanks --Jyothis 01:15, 4 December 2010 (UTC)

Опа, сега влизам и що да видя- блокиран за 3 месеца. Тц, тц, тц тюх да се не види, оцапах ви бохчата? Не е нужно да се хабите,може да бъдете сигурни че няма да чакам 3 месеца. Не берете грижа и за потребителската сметка- изоставям я. Няма да ме "изритате с ритници" дори и да искате и да си развеете байряка че сте ми били шута. Ваш си проблем. Не си мислете, че като Мапа ще ви пиша простотии по страниците, или като ИнжИнера ще ви обиждам. Нищо подобно, просто няма да ви обръщам внимание. Пък ако искате си ме блокирайте- пак си е ваш проблема. Благодаря на Лъчо за поканата да се регистрирам- направих го, но не стана, даже стана по-зле. Сигурен съм, че ще блокирате това ИП, както и всички останали, но пак помислете, че след мен ИП-то ще се използва от други хора, напълно невинни. Това е от мен. Аз съм тук и ако някой иска да направи опит за диалог- да заповяда. Аз направих опит. Най сърдечни поздрави.--79.100.27.62 13:46, 5 December 2010 (UTC) Модернатор

189.30.117.4@pt.wikipedia

kalon@zh.wikipedia

-- Avi 06:18, 25 November 2010 (UTC)

Numerous @en.wikiversity

Status:    Done
   * ??????????????????????? (talk | email | contribs | stats)
   * Vandal_account_1703 (talk | email | contribs | stats)
   * Vandal_account_1704 (talk | email | contribs | stats)
   * Vandal_account_1705 (talk | email | contribs | stats)
   * Vandal_account_1706 (talk | email | contribs | stats)
   * Vandal_account_1707 (talk | email | contribs | stats)
   * Vandal_account_1708 (talk | email | contribs | stats)
   * Vandal_account_1709 (talk | email | contribs | stats)
   * Vandal_account_1710 (talk | email | contribs | stats)
   * Vandal_account_1711 (talk | email | contribs | stats)
   * Vandal_account_1712 (talk | email | contribs | stats)
   * Vandal_account_1713 (talk | email | contribs | stats)

I'm guessing there's a connection ;-). --SB_Johnny|talk|books 18:34, 23 November 2010 (UTC)

{{duck}}? :-) --dferg ☎ talk 15:33, 27 November 2010 (UTC)
  • Stale
    1. Vandal account 1701 (Created on 15 November 2006 at 22:13)
    2. Vandal account 1703 (Created on 11 December 2006 at 22:27)
    3. Vandal account 1704 (Created on 27 December 2006 at 17:49)
    4. Vandal account 1705 (Created on 19 August 2006 at 00:36)
    5. Vandal account 1706 (Created on 13 December 2006 at 00:21)
    6. Vandal account 1707 (Created on 22 November 2006 at 17:12)
    7. Vandal account 1708 (Created on 28 December 2006 at 21:03)
    8. Vandal account 1709 (Created on 12 December 2006 at 23:44)
    9. Vandal account 1710 (Created on 5 October 2006 at 15:14)
    10. Vandal account 1711 (Created on 8 September 2006 at 16:18)
    11. Vandal account 1712 (Created on 18 August 2006 at 23:20)
    12. Vandal account 1713 (Created on 8 September 2006 at 16:30)

-- Avi 17:15, 28 November 2010 (UTC)

Can you please check all the accounts in v:Special:PrefixIndex/User:EGM6321? :| TelCoNaSpVe :| 06:17, 29 November 2010 (UTC)
It is obviously a school/university project as it's on English Wikiversity. --Bsadowski1 06:20, 29 November 2010 (UTC)

Pellagra@pt.wikipedia

-- Avi 01:21, 28 November 2010 (UTC)

Os Mutantes Caminhos do Coração@pt.wikipedia

-- Avi 01:32, 28 November 2010 (UTC)

Salamat@pt.wikipedia

Let the stewards do the job... Thanks. Leandromartinez 13:11, 29 November 2010 (UTC)
Tá bom, Leandro...
Forgot what I said. Please, DO NOT CLOSE this request. Desculpa, é que eu me senti culpado a manhã inteira de ter feito esse pedido... Samurai BruxoMerry Christmas! 13:37, 29 November 2010 (UTC)

Quero ressaltar que eu apenas estou continuando com este pedido de verificação a pedido do Leandro, acima, porque eu também acho que o Salamat não fez nada de errado, pelo menos agora que eu descobri a verdade. Samurai BruxoMerry Christmas! 15:31, 29 November 2010 (UTC)

  • Comment Comment I didn't understand what kind of 'second opinion' you're waiting for after reading this, however I think this request is founded. I bear in mind that it would be better for the verified if you show the results, as his innocence or not can be confirmed and, in the first case, the persecution he says to exist over him may stop. This is just my point of view. Striker 18:39, 29 November 2010 (UTC)
    • Sometimes, I wish confirmation of my findings, so I ask a second steward to review the evidence. If we both arrive at the same results, great; if not, then a finding of Inconclusive Inconclusive is more likely. -- Avi 20:42, 29 November 2010 (UTC)

Review by a second steward agrees with the following findings:

Thank you for your patience. -- Avi 20:37, 29 November 2010 (UTC)

Questions: what are the valid reasons for both stewards have made this check? What's the damage to prevent here? Tagging articles for maintainance/deletion? Editing music-related articles? Finnaly, how was the fishing? CasteloBrancomsg 21:24, 29 November 2010 (UTC)
Per CheckUser policy#Use of the tool: "The tool is to be used to fight vandalism, to check for sockpuppet abuse, and to limit disruption of the project." If stewards believe that there is potential disruption to the project that can be addressed through identifying the IPs of those users who may be involved in that disruption, use of the tool is authorized. Portugese wikipedia does not allow the use of sockpuppets in many situations, including creating the illusion of more support and harassing other users (see w:pt:Wikipedia:Sock puppet where it includes "Esconder sua real identidade com vista a dar a impressão de um maior apoio a determinado ponto de vista (ou descredibilizar o ponto de vista contrário). Além de anti-ético, não é permitido, pois isso pode distorcer a opinião da comunidade como um todo." and "Ofender outras pessoas ou causar polêmica gratuita.") This request indicated that such activity was potentially occurring. Of course, there is an element of judgment involved, as there is with any wikimedia activity (should I post this, should I protect this page, should I block this user). Sometimes, when the results seem clear, but we want to ensure that no mistake is being made, we may discuss the issue amongst ourselves. It is long accepted that we would rather have two or three authorized people investigate an issue, than only one who may have come to an incorrect conclusion. In this case, PtWiki has no local checkusers, and so the necessity to combat certain kinds of sockpuppetry and cross-wiki vandalism falls on the stewards. Furthermore, stewards are supposed to refrain, if possible, from using steward powers on their home wiki, so stewards who would call PtWiki home, but who are not local checkusers, are not the ones making these checks. Thus, those of us who remain, have to decide whether or not the potential for disruption exists despite any language or lack-of-knowledge handicap we have. On the bright side, it also means we are ignorant of, and thus immune to, whatever political machinations are occurring on the the local wiki. In this case, the determination that there was enough potential for disruption was made, and was justified in the result, which seems to indicate that someone who was looking for administrative privileges on PtWiki is much more closely related to a few other accounts than he or she should be. It is now up to the PtWiki community to decide how to deal with the findings. Lastly, if the PtWiki community can eventually decide upon a pair of acceptable checkusers, that would allow for people who are more aware of the project and language to serve the function, obviating the need for stewards to act. Until such time, however, it remains part of our duty as volunteers who have been elected by world-wide project members to assist in ensuring that violations of wikimedia policies are identified when supplied with a reasonable request that informs us of potential disruption. -- Avi 23:35, 29 November 2010 (UTC)

That's what hapenned. Some users on pt-wikipedia supected of Salamat's edits. That's why I made this request. But I found that Salamat isn't doing any illegal or wrong thing. This request eventually became a fishing. The strange thing is that at end, Salamat created socks, but he didn't use them, either legitimately or ilegitimately. Samurai BruxoMerry Christmas! 01:41, 30 November 2010 (UTC)

Cão e Gato@pt.wikipedia

 Confirmed:

Likely Likely:

--Shizhao 14:43, 1 December 2010 (UTC)

Bruno Leonard@ptwikipedia

  • Completely unnecessary, the editor Bruno Leonard and I are from quite distant places, it's realy easy to see. It's hard to believe that an experienced editor cannot perceive it. Probably it's a bad faith fishing, trying to take advantage that currently the verifications are being made by stewards and not by local checkusers. A local checkuser would never accept this request. I am trying to save an article created by that other editor from elimination because it is obviously notable (it even has an interwiki). My behaviour is very reasonable. The mere fact that I know "how to configurate sources and other resources" do not allow an invasion of privacy like this. IP editors are not banished from portuguese Wikipedia and, may editor Yanguas like it or not, I have all the right to edit Wikipedia. 189.10.152.99 19:33, 3 December 2010 (UTC)
  • This (above) is a typical Leonard's behaviour, that's why he has been blocked for abuse a lot of times. Yanguas 19:51, 3 December 2010 (UTC)
  • As you may easily see, Bruno Leonard's IP [6] is from en:São Luís, Maranhão [7], on the extreme North of Brazil. My IP [8] is from en:Triunfo [9], on the extreme South of Brazil. So it's impossible that we are the same editors. This is totally fishing and I ain't doing anything wrong. As I said before, a local checkuser would never accept this request. Even alerted he insists on the error (a typical Yanguas' behaviour), what clearly typifies bad faith. 189.10.152.10 20:13, 3 December 2010 (UTC)
  • Curiously, these are the same opinions Bruno had about me. 200.171.249.39 19:10, 6 December 2010 (UTC)
Fishing CheckUser is not for fishing, anyway the information by the first and second anonymous user is right, these ips are not related with Bruno Leonard and I have many experience about the socks and technical profile about this user. - @lestaty discuţie 22:22, 6 December 2010 (UTC)
Ok, I accept your answer, but what is the difference between this case and Boneco de Neve@pt.wikipedia's (below)? Both cases of block evasion. Yanguas 12:00, 16 December 2010 (UTC)
"Cão e Gato" was caught in a previous CU run, and is a puppet of a known master. In this case, all I see are three IPs. If there is serious concerns, some judicious soft blocks should be enough to prevent socking. If it gets very bad, and you can show that, bay all means, bring it back here. -- Avi 17:44, 16 December 2010 (UTC)

Hello, I'm Bruno Leonard (sorry for the delay). I was surprised by the accusation absurd, because I have no connection IPs located in southern Brazil, for clear reasons (I have no money to go on site to carry out the fraud). @lestaty, besides doing nothing for the improvement Wikinews (only very few edits, alleging "not having time "), could unlock my account there? Stop distorting his comments prejudiced (as to lock the account of my cousin on Wikinews-en). Is he going through it personally? If you prefer to do this, you can be sure that he found wrong guy. But the question is that IP who responded so quickly. Better check? Bruno Leonard 03:17, 27 December 2010 (UTC)

Rodrigogomesonetwo@pt.wikipedia

  • Not done Checkuser is not necessary for this. Semi-protection of the page, or a softblock of the IP, can be applied without needing to do a CU. -- Avi 07:20, 23 December 2010 (UTC)

RStaparo@pt.wikipedia

    • I am tempted to deny this one. Checking against Quintinense will probably be impossible because checkuser can only look a few months back, so there are no edits by Quintinense to compare with. So the only thing that could be checked is whether the other three are sockpuppets of each other - but at first glance I see no reason why that would be a problem even if they were. In other words, parts of your claims can be checked, parts of your claims would be sockpuppet abuse if true, but nothing is in both categories at once. - Andre Engels 20:23, 11 December 2010 (UTC)
      • Until I know, the use of multiple accounts to a polling is illegal and forbidden in the Wikipedia. And, in my experience on Wikipedia, I realize that when a user leaves and suddenly appears to contribute only in votes, it is because it is another user trying to support a viewpoint. This is the case of accounts Ryonagana and RStaparo, as can be seen in the historical contribution of users. Robertogilnei 21:53, 11 December 2010 (UTC)
        • It's only illegal (at least on the languages where I am most active) if both accounts are used in the same poll (or similar polls on the same subject). Can you point me to a case where that is actually what is done? As for your second point - checkuser is not going to provide extra evidence for or against it, so using it would be useless. - Andre Engels 21:59, 11 December 2010 (UTC)

Andre, I have a couple of questions about this case. The result is "unlikely", which is not a surprise (see below why I say that). In the request, is written "inexplicably". That is not correct, because it was explained, but omitted here.

The user Higor Douglas was checked two others times and now he was checked for the third time. He was checked here and here.
The user RStaparo was checked here.
The user Ryonagana was checked here.

The reasons exposed in this request are the same that motivated the other checks. They are now being used again to repeat a check. In all the checks above, the results were the same; the relation between the accounts was not confirmed and was said that the users edit from different states. We all know that checkuser can not be done routinely and that is why the last request was denied (the accounts were already checked and we can't keep checking them forever).

So, here is my question to the steward that responds this request or any other: If you knew that these accounts have already been checked with this same reason (one of them more than once), would you check them again? If the answer is "yes", I have another. How many times are you willing to check these accounts if the results keep telling us they are not related? Will you check them indefinitely?” TeleS (T PT @ C G) 05:09, 12 December 2010 (UTC)
    • The user Higor Douglas, who had not edited in Wiki-pt since November 2, suddenly appeared yesterday minutes after I made this request and made a single edit, just in a vote. Was it merely coincidence?
And I ask the steward if there is no possibility of another account, other than those mentioned, have some relationship with these users? Robertogilnei 12:03, 12 December 2010 (UTC)
      • As for what the guy above said, it is worth remembering the number of cases of sock Quintinense had their first results as Unrelated.
In this one, the CheckUser wrote "Unrelated between accounts Quintinense and Missigno (which proved to share IP) and the account Joao666." Later it was proven that the three belonged to the same user. In my first request for account verification of Dbc2004, the justification of the same CheckUser "No relation. Also, use different providers."Here, another user requests the inclusion of the suspect account Dbc2004 in check and again the verdict of the CheckUser was Unrelated. Finally, in other check, was confirmed the binding of the accounts, also being one more that had not yet been verified. Robertogilnei 12:39, 12 December 2010 (UTC)
  • I surely know this case and I'm agreed that the user Quintinense once (and more than once) really had to be checked and that is why he was checked a few times. I'm just not agreed with these repeated checks usign the same reasons and, for some users, the same diffs that were already used to start a check previously. Quintinense gave clear reasons to be checked and was proved that he used socks, but the other users are different. About Robertogilnei's second question, if there isn't any account related (you are talking about a "possibility of another account, other than those mentioned"), that is called "fishing". I keep my questions above. They will be checked indefinitely?” TeleS (T PT @ C G) 18:17, 12 December 2010 (UTC)
  • Crystalball CheckUser is not a crystal ball Andre did the initial check, and the checkuser tool is not magic in that it will work every time. -- Avi 07:23, 23 December 2010 (UTC)

Manoel colorado@pt.wikipedia

200.208.6.195 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser) (recent) Bruno Leonard 02:10, 20 December 2010 (UTC)

 Confirmed: Manoel colorado, Manoel da Silva and 200.208.6.195; Unrelated Unrelated: 189.80.180.250.
Note Note: : 200.208.6.195 may be a proxy or shared IP --Shizhao 08:03, 20 December 2010 (UTC)

Comment Comment: Bruno, could you, please, link here a diff of a misuse of the accounts and explain why the edits are not allowed? I'm sorry, but I couldn't find it, so I can't block any accounts yet. Thanks.” TeleS (T PT @ C G) 07:30, 25 December 2010 (UTC)

Comment Comment:Yes Compare the old editions of the two accounts, the edited pages and check the IPs (as in the case, the ranges of IPs 189.XXX.XXX.XXX). Bruno Leonard 03:17, 27 December 2010 (UTC)
Comment Comment: Repeating question in Portuguese: Bruno, você poderia, por favor, colocar uma ligação aqui para o diferencial de edição que mostra mau uso das contas e explicar por que as edições não são permitidas? Desculpe, não consegui achar as edições, portanto não posso bloquear as contas ainda. Obrigado.” TeleS (T PT @ C G) 14:35, 27 December 2010 (UTC)
Pode esperar alguns dias? Pois demora pra achar os IPs. (Translate: "You can expect a few days? As it takes to find the IPs."). Bruno Leonard 03:01, 30 December 2010 (UTC)

FelipheKühnLeão@pt.wikipedia

Stale: no data avalaible--Shizhao 07:53, 20 December 2010 (UTC)

What does "no data avalaible"? Why not check? Bruno Leonard 03:17, 27 December 2010 (UTC)

Polaco galeto@pt.wikipedia

  • Done Polaco galeto is using dynamic IPs over a huge range to edit. There is not much that can be done other than being vigilant. I see no obvious sleepers. -- Avi 07:32, 23 December 2010 (UTC)

Its block ranges of IPs in that it uses, because at first, he promised (and kept) and circumvent some of the managers had to be forced to block ranges of IPs for a week. Maybe he recently edited, but do not know which, so I asked for the check on behalf of the new threat. No reject! Bruno Leonard 03:17, 27 December 2010 (UTC)

Dálmata@pt.wikipedia

Fishing CheckUser is not for fishing--Shizhao 08:09, 20 December 2010 (UTC)

Hélio Hélio@pt.wikipedia

  • Unnecessary Unnecessary If the IP is obviously disrupting, it can be blocked and discounted without a checkuser. If not, people are allowed to edit from an IP, and more than one person may share an opinion. Is there actual votestacking going on? -- Avi 07:37, 23 December 2010 (UTC)

topholidaydestinations.net spammers

Status:    Done

I hereby request a checkuser on the users below (39 users do not fit in the CU request template, so I'll list them as usersummaries).

These users have all spammed the -now globally blacklisted[24]- link *.topholidaydestinations.net crosswiki. This is a very widespread spamming campaign. It took me several hours to remove all the links (at least 256 were placed, countless removed by me, in the last hour alone I visited 29 projects to remove this spam), for a listing see User:COIBot/XWiki/topholidaydestinations.net. All these users have the same general modus operandi; in some cases they remove some or all other external links and in all cases put in their own link, often marking it as a minor edit. The links are almost all inserted in the external links section and only a few as reference. Some of the usernames give the impression of being a bot, but they are probably human, seeing the time between edits and the style of the edits. Each user made only a few edits per project and then moved to another project.

I have checked the edits of the users below and found that they are pure spam-accounts, with the exception of Publicis (who placed the link on nl:wp, but also made other edits (Luxo-tool). I have not found anything that would even remotely be a sign of good faith. I have requested global locking (permlink) of these accounts and a global checkuser to see if there are more bad-faith users or other spammed domains.













































































--EdBever 09:12, 22 December 2010 (UTC)

One more registered user from User:COIBot/XWiki/travelsitesonline.net:



-- EdBever 09:23, 23 December 2010 (UTC)

All locked. I investigated a couple of them and they're obviously all related. Thanks for bringging this to our attention. --dferg ☎ talk 09:26, 23 December 2010 (UTC)

The spamming continues! The IP of the site is now also blocked. Please CU:



- pt:wp



- pt:wp



- tr:wp



-es:wp



-es:wp



-tr:wp



-ro:wp



-ru:wp



-ru:wp

I would like to know if there are more projects he spammed. He makes only one or two edits with each user account so this guy must have many users on one IP. If there is one IP, or a reasonably small range I request blocking of this IP. a CU on NL:WP BY RonaldB confirmed the IP 212.200.128.10/11 for the users involved. These IP's were also used for spamming without logging in. -- EdBever 13:21, 23 December 2010 (UTC)

More added. (Miflorida-Seanser). EdBever 14:31, 23 December 2010 (UTC)
Done --dferg ☎ talk 17:40, 23 December 2010 (UTC)
Small correction: RonaldB is not a CU on nl:wp. The check was not done by him, but by Japiot. - Andre Engels 21:47, 23 December 2010 (UTC)

La Isla del Lauper@pt.wikipedia

Some more users:
  1. Blog br (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
  2. Lauper Costa (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
  3. Cyndiblogbr (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
  4. Cyndu Photos (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
  5. Ddragoonss (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
All with same behaviour Teles appointed above. Béria Lima msg 10:21, 23 December 2010 (UTC)
Stale:Cyndiblogbr, Cyndu Photos, Blog br, Lauper Costa, Cyndiloka, Cyndiblogbr
Unrelated Unrelated: Ddragoonss
 Confirmed:
  • Group 1: La Isla del Lauper, Cynngue Ann Mad, MediaLauper, Moderação Cyndi Lauper
  • Group 2: Cyndi Power, Lukek
Group 1 and group 2 Unlikely Unlikely
Possible Possible: Lucas Cynnogue and Cyndilauperjsf

But these users from same ISP and use dynamic IPs edit.--Shizhao 12:39, 24 December 2010 (UTC)

Shizhao, let me see if I understand: the accounts in group 2 (Cyndi Power and Lukek) are related socks? Sorry to ask it; the answer is apparently obvious, but this result was very unexpected, since Lukek is the user that requested the block of the other socks and since Lukek was not listed. I would be glad if you can confirm it.” TeleS (T PT @ C G) 07:52, 25 December 2010 (UTC)
Yes. From a technical point, Cyndi Power and Lukek are related socks, them from same ISP and use same user-agent. --Shizhao 09:16, 27 December 2010 (UTC)
Thank you.” TeleS (T PT @ C G) 12:00, 27 December 2010 (UTC)

Ramon-Valdez@pt.wikipedia

 Confirmed: Nolam, Tom Moraes
Stale: Quintinense
Unrelated Unrelated: Ramon-Valdez, Sandroavlr

But Ramon-Valdez and #La Isla del Lauper@pt.wikipedia Group 1 Possible Possible--Shizhao 12:58, 24 December 2010 (UTC)

Please, check Lidbergue and compare it to Nolam, Ramon-Valdez and Sandroavlr: exactly the same behavior. Urgent request. Ruy Pugliesi 13:51, 29 December 2010 (UTC)
Done. Unrelated Unrelated.--Shizhao 16:37, 29 December 2010 (UTC)
But  Confirmed: Lidbergue, Lunglung, Xapakenty, Andremsc are related socks --Shizhao 16:40, 29 December 2010 (UTC)

87.196.188.211@pt.wikipedia

Not done Even if there was sockpuppeting it would just barely count as abuse (and it might also be an innocent case of forgetting to log in), on the other hand the edits as they are described seem to be problematic whether or not there is a case of sockpuppeting. It seems better to take action to the (one or) two based on that rather than on a vague claim of sockpupeeting. - Andre Engels 20:42, 26 December 2010 (UTC)

UmBunsd(a)Men@pt.wikipedia

Nothing relevant except Resurrection already blocked --Melos 10:46, 27 December 2010 (UTC)

Lukek@pt.wikipedia

 Confirmed:
  • Group 1: Parnanguara, Mariland, Kodak, Payperview, E1000. Menezes, Big Apple
  • Group 2: Dad111, RockTheBoat, DecemberBot, Lukek
Unrelated Unrelated: Rehab2, Group 1, Group 2

--Shizhao 16:55, 29 December 2010 (UTC)

Thank you. Leandro Martinez msg 05:39, 30 December 2010 (UTC)