Steward requests/Checkuser/2013-01

From Meta, a Wikimedia project coordination wiki

Requests

Fête@frwiktionary

 Confirmed the following:
Secondaire
Fête
Phung
Phung Wilson
--Bencmq (talk) 10:24, 3 January 2013 (UTC)
Thanks. I locked all of them for long-term abuse. -- Quentinv57 (talk) 11:47, 3 January 2013 (UTC)
And his IPs? Ĉiuĵaŭde (talk) 15:25, 3 January 2013 (UTC)
Exposing his IP could violate the Privacy Policy, I will arrange for his IP to be blocked in private. Don't worry :) --Bencmq (talk) 02:57, 4 January 2013 (UTC)
Don't forget "his little brother"'s account : Jack514. V!v£ l@ Rosière /Murmurer…/ 23:17, 4 January 2013 (UTC)

Matthias Klostermayr@bar.wikipedia

Done, from tech view:
  • Unlikely Unlikely: Joe Watzmo, Bua333
  • Unrelated Unrelated: Matthias Klostermayr, Hellsepp, Schmei

--Shizhao (talk) 14:08, 4 January 2013 (UTC)

Marvel Avengers Alliance@zh.wikipedia

because this is wiki auto-transform,no Source code.I am sorry--Red16 (talk) 06:18, 1 January 2013 (UTC)
Could we have some more details on the attacks on other contributors and a list of pages where these accounts where used to violate the 3RR ? Thanks. -- Quentinv57 (talk) 18:21, 4 January 2013 (UTC)
This User,This account Marvel Avengers Alliance is his main account,now(dec.2012-jan.2013-). I Think his last main account is 法蘭克斯洛斯.
You can visit Marvel Avengers Alliance's user contribution and his talk page history.link about he attacks other wiki contributors.in edit summary,them all chineses.
for example,he curse user ArikamaI is a idiot.becasue user ArikamaI is TVB Project Counter-Vandalism Unit members.very Ugly.he cursed almost everyone of the TVB Project Counter-Vandalism Unit members.
This thing is a tag match.this user,one account is his main account (a period of time.this main account is always change) and if one account is main account,another account is puppet account.
This user use different account edit one wiki page,tag match with us. so you maybe look like no any account violate the 3RR in a days.This is false appearance.he ensure his any accounts no violate the 3RR in a days.if no account can use(a period of time),he will change to IP user.
We (I and another TVB Project Counter-Vandalism Unit members and some zhwp admin) think them (list user) all one user.
thanks.--Red16 (talk) 05:33, 5 January 2013 (UTC)

Many of the IPs resolve to the City University of Hong Kong, and so technical evidence will not be that helpful in those cases. However, in my opinion, based on the technical evidence:

-- Avi (talk) 17:21, 6 January 2013 (UTC)

OK,Thanks a lot--Red16 (talk) 02:41, 7 January 2013 (UTC)

Ggjjitiktuiyrttiree@zh.wikipedia

Comment Comment:User:李煌老师, local profile at w:zh:WP:LHLS, (outdated) record is kept at Wikipedia/zh/李煌老师. --Bencmq (talk) 07:17, 3 January 2013 (UTC)
Last check: Steward_requests/Checkuser/2012-12#Gjjitiktuiyrttiree@zh.wikipedia. Please also check 1.161.38.139 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser) with similar behaviour because somebody thinks I used the IP address. --Makecat 07:07, 4 January 2013 (UTC)
Done The following users are  Confirmed. Only the second one is not blocked yet.
  • Lenovotcldelhp
  • Lenovotcldellhp
  • Ggjjitiktuiyrttiree
  • Gjjitiktui
  • Gjjitiktuiyr
  • Gjjitiktuiyrt
  • Gjjitiktuiyrtt
  • Gjjitiktuiyrtti
  • Gjjitiktuiyrttir
  • Gjjitiktuiyrttiree
  • Gjjitiktuiyrttireee
  • Gjjitiktuiyrttireeee
  • Gjjitiktuiyrttireeeee
  • Goodtotal
Best regards, -- Quentinv57 (talk) 19:01, 4 January 2013 (UTC)
Lenovotcldellhp seems to be a legitimate contributor... --Bencmq (talk) 06:41, 5 January 2013 (UTC)
OK, so maybe leaving him unblocked is the best solution for now. But he is clearly  Confirmed per CU data. Regards, -- Quentinv57 (talk) 12:44, 5 January 2013 (UTC)

Zwyljy@zh.wikipedia

And most possible IP ranges:
114.137.0.0/16 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
114.136.0.0/16 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
61.219.0.0/16 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

--Makecat 01:39, 12 January 2013 (UTC)

It is Likely Likely that Groups 1 and 2 are related, and Unlikely Unlikely that those in Group 3 are related to Groups 1 & 2. -- Avi (talk) 04:30, 13 January 2013 (UTC)

Wkeh357we@mediawiki.org

Status:    Done

These pattern accounts have all been recently created and I think they might be spambots. Please investigate and, if necessary, lock them. Thanks, Mathonius (talk) 21:31, 10 January 2013 (UTC)

Locked. To also note that I did some actions against the account creations in titleblacklist, which can be removed at some point of time. — billinghurst sDrewth 03:16, 11 January 2013 (UTC)

Gbfy4566eh@mediawiki.org

Status:    Done

Are these recently created pattern accounts related? Could they be spambots? Mathonius (talk) 01:32, 12 January 2013 (UTC)

All locked.—Teles «Talk to me ˱@ L C S˲» 01:41, 12 January 2013 (UTC)

FODCOC@zh.wikipedia

-- Avi (talk) 04:34, 13 January 2013 (UTC)

Nextrateyui@zh.wikipedia

I don't see that any of these accounts are blocked, so I am not certain why they should be CU'd. I am not sure what you are looking to achieve by having them CU'd either. What is the benefit of having this undertaken? The benefit is not immediately obvious to me. Marking as Not done. — billinghurst sDrewth 13:19, 14 January 2013 (UTC)

Hw102050@zh.wikipedia

I am not inclined to undertake a CU request from an unknown person at an IP address. I am not certain what you think can be achieved. Marking Not done, request can be resubmitted. — billinghurst sDrewth 13:22, 14 January 2013 (UTC)

ജസ്റ്റിൻ വാണമടിയേൽ@ml.wikipedia

 Confirmed accounts 1 & 2. Inconclusive Inconclusive account 3. Anonymising service in use. I have spoke with fellow steward Jyothis, and we have decided the block the range from which the person is operating. I will leave you to determine whether you wish to block account 2. — billinghurst sDrewth 16:10, 18 January 2013 (UTC)
Thanks a lot. Just to be sure - you say that ജസ്റ്റിൻ_വാണമടിയേൽ and വാണമടിക്കാരൻ are the same person, right? -- Razimantv 16:12, 18 January 2013 (UTC)
Two accounts both operating in the same time and space. I am not good at the script, but they looked the same as presented. Paste follows.
  • ജസ്റ്റിൻ വാണമടിയേൽ
  • വാണമടിവീരൻ
billinghurst sDrewth 16:26, 18 January 2013 (UTC)
But those are same-person accounts. വാണമടിവീരൻ was renamed to ജസ്റ്റിൻ വാണമടിയേൽ. We are interested in വാണമടിക്കാരൻ -- Razimantv 16:29, 18 January 2013 (UTC)

Fête@fr.wiktionary (2)

Fête, Secondaire and 馮輝 are  Confirmed to belong to the same user.
Phung, Phung Wilson and Jack514 are Stale. Ruslik (talk) 11:14, 18 January 2013 (UTC)
Merci ! V!v£ l@ Rosière /Murmurer…/ 15:18, 18 January 2013 (UTC)

SallyIMHV@en.wikiversity

Status:    Done

Please consider investigating this spambot. I think it might be related to HomerHorn at the English Wikiquote (see its userpage there). I know for sure I've seen another one like these before, but I can't remember where. Anyway, I've requested a CU investigation for HomerHorn at the English Wikiquote (permalink) and I've asked them to share the results with the stewards, so these two spambots can be compared. Mathonius (talk) 04:40, 19 January 2013 (UTC)

I stumbled upon Ignacio956 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser) at id.wiktionary. Their pattern is similar: creating a userpage with a short introduction, then <br><br>, and a link to a page linking to the actual spam. For example, id:wikt:Ignacio956 led to [4], which led to quik4.com, which contained advertisements for car insurances, "build a shed" plans, coleslaw, etc. Mathonius (talk) 05:26, 19 January 2013 (UTC)
HomerHorn and SallyIMHV are  Confirmed
Ignacio956 can not be confirmed based on the CU evidence alone. The bot uses different proxies and UA strings but sometimes leaks xff informations.
Other possible accounts include:
DalePinkn
RufusGrub
CharlotteM
PoppyUGO
SkyeRawli
Torri40Y
DelbertSM
ColbyFisk
YasminNUPC
DanialWor
Lydia9567
Ruslik (talk) 10:55, 19 January 2013 (UTC)

Sergodavlianidze@ka.wikipedia

Thanks again.George Talk 07:10, 20 January 2013 (UTC)

Happyseeu@zh.wikipedia

Unrelated Unrelated Ruslik (talk) 09:14, 21 January 2013 (UTC)

Hathaw14x28@outreach

Status:    Done

Please consider investigating and/or locking (the rest of) this group of pattern spambots. Mathonius (talk) 10:35, 21 January 2013 (UTC)

Done. PeterSymonds (talk) 10:53, 21 January 2013 (UTC)

MittieMic@en.wikiversity

Status:    Done

These accounts belong to this group of spambots. Please consider investigating and/or locking them. Thanks, Mathonius (talk) 05:11, 22 January 2013 (UTC)

All checked and locked. You may want to check other accounts locked in case you want to log or something.—Teles «Talk to me ˱@ L C S˲» 06:11, 22 January 2013 (UTC)

Poqpcjapo@beta.wikiversity

Status:    Done

I wonder if these spambots are related. Please consider investigating them. Are the following accounts also related?

Mathonius (talk) 07:46, 22 January 2013 (UTC)

All  Confirmed. Ruslik (talk) 08:02, 22 January 2013 (UTC)

Amilton de cristo wikiversida@pt.wikiversity

Status:    Done

This account was created recently. Is it related to the following locked spam-only accounts?

Mathonius (talk) 16:02, 22 January 2013 (UTC)

Please also check Escritor amilton de cristo (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser). Mathonius (talk) 16:51, 22 January 2013 (UTC)

Amilton de cristo wikiversida is  Confirmed with Wikinoticias amilton de cristo, Likely Likely to be the same as the rest. --Bencmq (talk) 17:12, 22 January 2013 (UTC)

而我不知道啥皮九是誰@zh.wikipedia

Apparently, they are three different groups :
Group 1
  • 而我不知道啥皮九是誰
  • 而我不知道造猫是誰
  • 而我不知道時超是誰
  • 而我不知道陳停是誰
  • 而我不知道許偷真是誰
  • 而我不知道舞拉夸可是誰
  • Also related to : 亞洲電視盡早收檔,咪阻住晒!, 亞洲電視與香港 市民作對,反對發新免費電視牌, 亞視不倒之謎, ...
Group 2
  • Mafyac
  • AVSE
  • Also related to : 而我不知道茑邋跨嗑是誰, 而我不知道蔦邋跨課是誰, 九儒十丐, ...
Group 3
  • Fridaystarfs
  • Also related to : Elsbershi, Okeyes5, Hittiptop, ...
I don't have the time to put all socks here, but all of them are LTAs. I blocked the accounts who were definitely related to one of the above groups and sent you a fully detailed report about them, to keep the record. Regards, -- Quentinv57 (talk) 18:24, 22 January 2013 (UTC)

More disruptive accounts:

Lacocat (talk) 16:07, 22 January 2013 (UTC)

Dear Lacocat,
Here is the result of the check :
  •  Confirmed as part of Group 1 (see above)
    • 造猫去了那裡
    • 亞洲電視良心何在
    • 亞洲電視盡早倒閉吧
    • 亞太區最受歡迎女歌星梁佑嘉 are part of the first group.
  • Brantpaddy is not related to this, but seems to be an history on zhwp anyway...
    Likely Likely
    • 本出门前将做猫封了六个月
    • Cravix is impersonating!
    • 丁老師22
    • Yaohua200
  • 楚汉文学网 is not related to the ones above and doesn't seem to be a LTA... Anyway he created 凡学文汉楚 to try to bypass his block.
  • lnsuyn  Confirmed with AATGC and Likely Likely part of group 2.
  • As for Wildcursive, I don't have sufficient evidence now to proceed a checkuser on him. Can you provide some diffs showing that he may belong to one of these groups ? Regards, -- Quentinv57 (talk) 18:54, 22 January 2013 (UTC)
More:

--Shizhao (talk) 06:17, 23 January 2013 (UTC)

 Confirmed I emailed you the detailled results and the other blocked accounts I found. Regards, -- Quentinv57 (talk) 06:47, 23 January 2013 (UTC)
By the way, locking User:Lacocat for abusing multiple accounts and impersonation. -- Quentinv57 (talk) 06:53, 23 January 2013 (UTC)
thx--Shizhao (talk) 07:02, 23 January 2013 (UTC)

Hkji7u6i27@wikidata

Completed Completed: This is a chinese spambot, no more account.--Shizhao (talk) 06:29, 23 January 2013 (UTC)

Kssvrqilm@oldwikisource

Status:    Done

Are these simultaneously created pattern accounts related? Mathonius (talk) 02:45, 25 January 2013 (UTC)

{{doing}} Ruslik (talk) 08:05, 25 January 2013 (UTC)

The following accounts were created just now:

Mathonius (talk) 08:07, 25 January 2013 (UTC)

All confirmed and locked. Ruslik (talk) 08:28, 25 January 2013 (UTC)

Maybell45@nl.wiktionary

Status:    Done

These pattern spambots haven't been locked yet. Please consider investigating and/or locking them. See User:Mathonius/Reports/Ntsamr for more information. Thanks, Mathonius (talk) 03:05, 25 January 2013 (UTC)

 Confirmed and locked. Ruslik (talk) 09:12, 25 January 2013 (UTC)

Casonhet1953@rw.wikipedia

Status:    Done

Please consider investigating and/or locking these pattern accounts. I think they might be spambots. Mathonius (talk) 06:51, 25 January 2013 (UTC)

I've added the pattern to the title blacklist. Mathonius (talk) 06:57, 25 January 2013 (UTC)
All Locked Locked. Many thanks for the report and assistance, though I'm not sure that putting all spambot patterns in the title blacklist is the best idea... -- Quentinv57 (talk) 11:45, 25 January 2013 (UTC)
I agree. I temporarily put this specific pattern on the blacklist, because new accounts were rapidly being created and I thought the blacklisting might put an end to that. I've now removed the blacklisting. Thanks for the locking, blocking and CU'ing. Mathonius (talk) 12:04, 25 January 2013 (UTC)

최철훈@ko.wikipedia

Status:    Done

최철훈@kowiki was blocked because He/She ignored all discussion about his/her fake editing. After this, 김순연@kowiki appeared and did edit same field with same pattern. Because of same editing pattern, 김순연@kowiki also blocked. And recently, 정해임@kowiki started editing, but editing field isn't same(Of course, figure field is same but 최철훈/김순연 edited pages of baseball players). I highly suspect 정해임@kowiki is related to blocked users. The evidence is family relations map. 김순연@kowiki made himself/herself userpage and added his/her family relations map. See it (deleted edit because of non-public personal information). You can find '아들 : 최철훈(崔哲熏)'(en: son : 최철훈). 정해임@kowiki also make his/her userpage with family relations map, See it. You can find '며느리 : 김순연'(en: daughter-in-law : 김순연). Please consider investigating, thank you. --Sotiale (talk) 13:23, 25 January 2013 (UTC)

 Confirmed without any doubt. Regards, -- Quentinv57 (talk) 09:05, 26 January 2013 (UTC)
Great, thank so much :D --Sotiale (talk) 09:07, 26 January 2013 (UTC)

레즈큐읭@ko.project

There are two  Confirmed groups of accounts:
레즈큐읭
광해왕
게이큐읭
Geneticgirl
and
원앙마
Dor
하늘높이
남한민국
Gajwa
금박장식
Bongocha
바른정치
However, these two groups does not look connected to each other. Ruslik (talk) 06:56, 27 January 2013 (UTC)

Ancêtre@fr.wiktionary

The following users are  Confirmed :
  • 馮輝
  • Ancêtre
  • Secondaire
  • Fête
If someone could check his contributions cross-wiki, it would be great.
I have taken the necessary measures so he won't come back that soon ;-) -- Quentinv57 (talk) 11:12, 27 January 2013 (UTC)

太远太远太太@zh.wikipedia

Status:    Not done

This user was blocked indefinitely on Wikimedia Species as a vandalism-only account for blanking, adding nonsense and threat. After that, OhanaUnited (species bureaucrat) added a warning message on his talk page on zh.wikipedia. However, this user removed the warning and claimed his account was compromised and those vandalism on species are unrelated to him. Please investigate whether his account was really compromised or it's just an excuse. In addition, this user was blocked on Chinese Wikibooks for disruption but was unblocked after block review. --Makecat 08:40, 28 January 2013 (UTC)

 It looks like a duck to me -- Avi (talk) 20:52, 28 January 2013 (UTC)

StephanGa@mediawiki.org

Status:    Done

These spambots belong to this group. Please consider investigating and/or locking them. Thanks, Mathonius (talk) 18:16, 28 January 2013 (UTC)

Doing... Ruslik (talk) 19:17, 28 January 2013 (UTC)
All locked. Ruslik (talk) 19:34, 28 January 2013 (UTC)
LeandraKl on it.s has a different UA and no edits globally (but most likely a spambot, considering the pattern in the username and date of creation coinciding with that of another spambot); Spencer07 was locally blocked, as it doesn't have a SUL account. -- Mentifisto 19:21, 28 January 2013 (UTC)