Steward requests/Checkuser/2012-06

From Meta, a Wikimedia project coordination wiki

Requests

Plasticj@zh.wikipedia

As I'm not so experienced, from a technical point of view it seems Likely Likely. --Luckas msg 14:16, 1 June 2012 (UTC)

SH9002@zh.wikipedia

From a technical point of view they are Unrelated Unrelated. --Luckas msg 14:16, 1 June 2012 (UTC)

Soviétique@frwiktionary

 Confirmed to be the same IP and UA. — billinghurst sDrewth 07:41, 3 June 2012 (UTC)
Clarify, both the listed users are at same IP and same UA. No data available for comparison. — billinghurst sDrewth 07:47, 3 June 2012 (UTC)

Chinese blogpost spammers at mediawiki.org

Status:    Done

I've blocked these accounts on mediawiki.org and there are probably more of those. Please consider investigating them, checking for sleepers and blocking its underlying IP(s) either locally or globally for a while. Thanks, Mathonius (talk) 12:57, 9 June 2012 (UTC)

Doing... -- Quentinv57 (talk) 13:29, 9 June 2012 (UTC)
Done. I removed the CheckUser rights on Quentin here as I think he was done. He blocked all confirmed socks locally and locked them too. Trijnsteltalk 21:26, 9 June 2012 (UTC)
Thanks! Mathonius (talk) 05:49, 11 June 2012 (UTC)

Teetrinker and Teeinfos

Status:    Done

These accounts were all created within the last few days and I'm afraid they might be 'sleeping' spambots. Please consider investigating if they're related. Mathonius (talk) 05:49, 11 June 2012 (UTC)

I did not check them all, but from what I checked I did not see any known spambot patterns. I think that the best to do here is to keep an eye on them, but I really doubt that they are spam-only accounts. Regards, -- Quentinv57 (talk) 06:46, 11 June 2012 (UTC)

南师大葛军老师@zh.wikipedia

It looks like our old friend zh:WP:LHLS from his edits. -Mys_721tx(talk) 07:04, 11 June 2012 (UTC)
Analyzing. I'm working in this request. —Marco Aurelio (audiencia) 08:42, 11 June 2012 (UTC)

Results

  •  Confirmed
    • 南师大葛军老师
    • Bencum
    • 超光速是真理
    • Guidetruly
  • Possible Possible (tending to likely)
    • 葛军真昏蛋
  • I can't speak in regards to the IP address. If behaves in a prohibited way, block it.

Marco Aurelio (audiencia) 09:10, 11 June 2012 (UTC)

Seanloon

Status:    Done

This non-sul account is being used to spam cross-wiki. I've blocked all profiles registered on June 6th, because they've been used to spam or tried to do so. I wonder if the following are related as well:

Thanks in advance, Mathonius (talk) 09:53, 11 June 2012 (UTC)

Likely Likely I checked tiWP, meta and enWV and they all locate to the same broad ISP though across disparate IP ranges, and other circumstantial evidence would call this highly likely.  It looks like a duck to mebillinghurst sDrewth 12:07, 11 June 2012 (UTC)
Thank you! I've blocked it on meta, commons and en.v; I will request blocks on en.n and simple.wp. Mathonius (talk) 12:16, 11 June 2012 (UTC)

Saberzadmirza@glk.wikipedia

Unrelated Unrelatedbillinghurst sDrewth 12:15, 11 June 2012 (UTC)
Also with AminSanei or Sicapsi? they vote in that request.--AliReza (talk) 12:16, 11 June 2012 (UTC)
Unrelated Unrelated A little concerned about the approach here, you have requested of us to CU a local administrator. Some mindfulness should be used. — billinghurst sDrewth 12:37, 11 June 2012 (UTC)
Thanks, no problem--AliReza (talk) 12:54, 11 June 2012 (UTC)

Pinkdevil98@ca.wikibooks

 Confirmedbillinghurst sDrewth 12:41, 11 June 2012 (UTC)
Comment Comment: I've blocked both accounts locally and requested a lock for Pinkdevil98 (talk • contribs • block • xwiki-contribs • xwiki-date (alt) • CA • ST • lwcheckuser). Mathonius (talk) 12:48, 11 June 2012 (UTC)

X@frwiktionary

Thanks by advance. -- Quentinv57 (talk) 08:49, 12 June 2012 (UTC)

Likely Likely Whole spread of IP data, nothing specific in that /16 to say yes, though shares other data to indicate there is a likelihood that there is a match, and the geolocation could align. — billinghurst sDrewth 09:38, 12 June 2012 (UTC)
 Confirmed checked further xwiki. Matching on IP ranges, and UA. — billinghurst sDrewth 09:45, 12 June 2012 (UTC)
Thanks ! -- Quentinv57 (talk) 09:50, 12 June 2012 (UTC)

Suspected spambots (...(.)hare....)

Status:    Done

All of these accounts have been created recently. I'm afraid they might be spambots. Please investigate them and see if they're related. Thanks, Mathonius (talk) 15:02, 12 June 2012 (UTC)

I did not found any known spambot pattern. My advice would be the same that on your last request : it may be a new bot, so please keep an eye on them. But we don't have enough evidence to lock at this stage. Regards, -- Quentinv57 (talk) 16:36, 12 June 2012 (UTC)

Civilaut@fa.wikipedia

 Confirmed. No more sockpuppets found. Trijnsteltalk 20:49, 12 June 2012 (UTC)

جنگولک@fa.wikipedia

Inconclusive Inconclusive/Unlikely Unlikely Whilst both users access the internet through the same ISP, that is not surprising given how the internet is controlled in that area of the world. Their IPs are not necessarily related. Other technical evidence indicates that they are not necessarily the same person, although it is not impossible. Lastly علی رجبی edited last on April 16. -- Avi (talk) 17:33, 13 June 2012 (UTC)

Crazy_daisuke@zhwikip

Comment. This check will end directly linking an IP address with a registered user. Privacy policy does not normaly allow us to make such direct associations. If the IP is behaving in a prohibited way I suggest to block it or use other measures like (semi)protection on those articles under edit war. Thanks. —Marco Aurelio (audiencia) 10:46, 13 June 2012 (UTC)

Per Marco. -- Avi (talk) 17:38, 13 June 2012 (UTC)

I guess this is then a «not done» instead of a «done» above, right? :-) —Marco Aurelio (audiencia) 19:07, 13 June 2012 (UTC)

It doesn't matter, does it? Also, speaking generally, just because we try to protect the privacy of wikimedians, even vandals, does not mean to say that we do not try and protect the projects from those vandals 8-) . -- Avi (talk) 22:11, 13 June 2012 (UTC)

Changed back to a "not done" as "closed" refers to "in progress" and therefore the request won't be archived by the bot. Trijnsteltalk 22:24, 13 June 2012 (UTC)

Jytrkbags225 and Fryhbeats207@mediawiki.org

Status:    Done

I'm expecting some spam for Dr. Dre beats and Chanel handbags (or so) from these pattern accounts. Please consider investigating them. Mathonius (talk) 08:39, 15 June 2012 (UTC)

2x spambots, locked, and a local range block placed locally based on exploration, further data analysis also continuing — billinghurst sDrewth 14:23, 15 June 2012 (UTC)

Adgfrtj5k@mediawiki.org

Status:    Done

Please consider checking this Chinese blogpost spammer (see filter log). Thanks, Mathonius (talk) 08:39, 15 June 2012 (UTC)

Typical spambot, locked. — billinghurst sDrewth 13:59, 15 June 2012 (UTC)

Lujali@fa.wikipedia

Also Bijangerd. He edits in Pan Turkism page like Stetar--AliReza (talk) 22:28, 17 June 2012 (UTC)
Reviewing this. — MA (audiencia) 12:32, 18 June 2012 (UTC)
I've got some results which I'm not too sure about and have asked for review. — MA (audiencia) 13:25, 18 June 2012 (UTC)
Inconclusive Inconclusive Not the previous behaviour for this user, and looking at the range of the edits, it is a very busy space for editors (10s of users), and potentially a VPN access. The stewards will probably have a look at the editing IP range to see what other editing is taking place, however, at this stage I cannot recommend that we take further immediate action. — billinghurst sDrewth 14:13, 19 June 2012 (UTC)
Exactly my thoughts, tho I wanted to be sure. Thanks Billinghurst for your help. Closing this as "done". — MA (audiencia) 14:26, 19 June 2012 (UTC)

Việt Nam Dân Chủ Tiến Bộ Đảng@zh.wikipedia

Not done The first account is stale: it has not edited for more than 3 months. Ruslik (talk) 07:08, 17 June 2012 (UTC)

Motormovie@zh.wikipedia

Unrelated Unrelated Motormovie appears unrelated to any of the other users listed. -- Avi (talk) 16:41, 17 June 2012 (UTC)

Is that means other three accounts are related?-Justincheng12345 (talk) 04:39, 19 June 2012 (UTC)
The other 3 were proven to be socks long ago. Bencmq (talk) 04:53, 19 June 2012 (UTC)

Rlaalfo759@ko.wikipedia

Additional explanation: Hello. I'm an admin of Ko.wp and let me explain about this case. 4 targeted users repeatedly added unreferenced contents(possibly Original research) on ko:난다 난다 니얀다(Nanda Nanda Niyanda), and did not tried adding reliable source. ko:User:Djm03178 had notified to them, but their behavior were unchanged - actually they repeated same claim based on unreliable, original source - and they insulted other user reverting their edit. Maybe one of them attacked Djm03178 outside of wikipedia. Two of them(plus one another related account ko:사용자:Rkdwndus759) were blocked 6 months due to personal attack to reverter. --Mintz0223 (talk) 10:15, 19 June 2012 (UTC)
These five usernames all seem to have a relationship.
  • 강하은천적
  • Rkdwndus759
  • Rlaalfo759
  • 강주연짱
  • Kyounhee74
 Confirmedbillinghurst sDrewth 13:10, 19 June 2012 (UTC)

氪跨拉乌@zh.wikipedia

There are more than one group which contain  Confirmed sockpuppets with each other, and, in my judgment, it is Likely Likely that all groups are related:

-- Avi (talk) 17:00, 20 June 2012 (UTC)

Perispliced6@mediawikiwiki

 Confirmed with Sockeater. Kokino does not have an account in MediaWiki. — T. 05:38, 21 June 2012 (UTC)
And since Sockeater=Kokino=Animelover3 by previous CU, we have a sock of Animelover3.--Jasper Deng (talk) 05:47, 21 June 2012 (UTC)

Crosswiki spambots

Status:    Done

These accounts spammed yesterday and today. I've blocked all of them locally. They are - judging by their pattern usernames and the similar way they spam - probably related. Please check if a global IP block is possible/useful. Mathonius (talk) 18:06, 22 June 2012 (UTC)

Iqszmwext (talk • contribs • block • xwiki-contribs • xwiki-date (alt) • CA • ST • lwcheckuser) on en.wikisource might also be related, but that wiki has local CU's. Mathonius (talk) 19:02, 22 June 2012 (UTC)

All done. Except for Iqszmwext that was only locked, all of them were locked and checked . Thank you for reporting.‴ Teles«msg» 21:25, 22 June 2012 (UTC)

Maxdik@zhwiki

After a thorough check I can confirm both users are technically Unrelated Unrelated. You might wish to unblock user Maxdik. Trijnsteltalk 12:52, 26 June 2012 (UTC)
Thank you very much for your answer. I have unblocked Maxdik. I am going to caution my fellow Chinese Wikipedia administrators that requesting checkuser here is better than unilateral presumption.--Jusjih (talk) 13:29, 26 June 2012 (UTC)

Captaincollect1970@mediawikiwiki

 Confirmed. PeterSymonds (talk) 18:29, 25 June 2012 (UTC)

D&S@pt.wiktionary

The first account is Unrelated Unrelated to other three accounts. Ruslik (talk) 18:36, 26 June 2012 (UTC)

분당선정자역@ko.wikipedia

Results as follows:

  •  Confirmed group I
    • 분당선엠
    • 분당선죽전역
    • 노란분당선
    • 티파니가티파니
    • 분당선정자역
    • Ykhvong
    • 책만읽는달팽
    • 둥둥둥북을울려라
    • 위키백과의 비리를 밝혀내는 특검
  • Likely Likely group I
    • 도시의가치
    • YKHWWONG
    • 분당선죽전역
    • 황제매니아
    • 왕로리
    • 폴리를 없애자
  • Possible Possible group I
    • 최재윤님 (not blocked; please check contribs. before taking any action)
  • Likely Likely group II
    • 분당선66
    • 분당선6
    • 이상해
    • 부산김해갱전철
    • 캉씨매니아
    • 노란분당선
    • 리센슝
    • 항제숙종
    • 빨갱이퇴치
    • 분당선정자역
  • It is Likely Likely that Group I and Group II accounts are related.

Apologies if there's any duplicate in the list.

— MA (audiencia) 11:39, 28 June 2012 (UTC)

Amir a57@fa.wikipedia

All technically Unrelated Unrelated. PeterSymonds (talk) 16:20, 28 June 2012 (UTC)

Vinita8715@incubator

Status:    Done

This spambot is obviously related to Reyes8671 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser) at en.wikibooks. Please investigate it and block its underlying IP if possible. Thanks, Mathonius (talk) 03:02, 29 June 2012 (UTC)

Completed Completed and I informed the other checkusers. Thanks for informing us! Trijnsteltalk 16:12, 29 June 2012 (UTC)

特殊性關係@zh.wikipedia

 Confirmed.
Please also add to your list to block 沈榮光 (talk · contribs) Egbert Mei (talk · contribs), 宮本高正 (talk · contribs), Egbert Kenneth Yang (talk · contribs), Leearwen (talk · contribs), Yoshimura Michael Sanada (talk · contribs).
Maybes 林四維 (talk · contribs), Iamdog43 (talk · contribs), 游文茜 (talk · contribs).
There are other accounts earlier that may or may not be related that I have not listed. They are busy ranges. To note that your two /16 range blocks also will impede other users, which I assume you will know. — billinghurst sDrewth 14:13, 30 June 2012 (UTC)
Thanks. Range blocks were performed by other sysops, I will tell him. --Makecat (talk) 14:25, 30 June 2012 (UTC)