(Go: >> BACK << -|- >> HOME <<)
Jump to content

Steward requests/Checkuser

Edit links
From Meta, a Wikimedia project coordination wiki
< Steward requests
This is an archived version of this page, as edited by Ruslik0 (talk | contribs) at 15:50, 24 September 2017 (→‎Ben Steigmann@en.wikiversity: +results). It may differ significantly from the current version.
Shortcut:
SRCU
Checkuser icons
These indicators are used by CheckUsers and stewards for easier skimming of their notes, actions and comments.
{{Confirmed}}:  Confirmed {{MoreInfo}}: MoreInfo Additional information needed
{{Likely}}: Likely Likely {{Deferred}}: Deferred Deferred to
{{Possible}}: Possible Possible {{Completed}}: Completed Completed
{{Unlikely}}: Unlikely Unlikely {{TakeNote}}: Note Note:
{{Unrelated}}: Unrelated Unrelated {{Doing}}: Doing...
{{Inconclusive}}: Inconclusive Inconclusive {{StaleIP}}: Stale
{{Declined}}:  Declined {{Fishing}}: Fishing CheckUser is not for fishing
{{Pixiedust}}: Pixiedust CheckUser is not magic pixie dust {{8ball}}: 8ball The CheckUser Magic 8-Ball says
{{Duck}}:  It looks like a duck to me {{Crystalball}}: Crystalball CheckUser is not a crystal ball

This page is for requesting CheckUser information on a wiki with no local CheckUsers (see also requesting checkuser access). Make sure to follow the following instructions, or your request may not be processed in a timely manner.

Before making a request:

  1. Make sure you have a good reason for the check. It will only be accepted to counter vandalism or disruption to Wikimedia wikis. Valid reasons include needing a block of the underlying IP or IP range, disruptive sockpuppetry, vote-stacking, and similar disruption where the technical evidence from running a check would prevent or reduce further disruption.
  2. Be specific in your reasons. Ambiguous or insufficient reasons will cause delays. Explain the disruption and why you believe the accounts are related, ideally using diff links or other evidence.
  3. Make sure there are no local checkusers.
  4. Please ensure that the check hasn't already been done:


How to make a request

How to make a request:

  • Place your request at the bottom of the section, using the template below (see also {{srcu}} help). 
    === Username@xx.project ===
{{CU request
 |status          = <!--don't change this line-->
 |language code   = 
 |project shortcut= 
 |user name1      = 
 |user name2      = 
 |user name3      = 
<!-- Max 10 users -->
 |discussion      = [[Example]]<!-- local confirmation link / local policy link -->
 |reason          = Reasons here. ~~~~
}}

    For example: 

    === Example@en.wikipedia ===
{{CU request
 |status          = <!--don't change this line-->
 |language code   = en
 |project shortcut= w
 |user name1      = Example
 |user name2      = Foo
 |user name3      = Bar
<!-- Max 10 users -->
 |discussion      = [[:w:en:Example]]<!-- local confirmation link / local policy link -->
 |reason          = Reasons here. ~~~~
}}
  • Specify the wiki(s) you want to perform the check on.
Cross-wiki requests
Meta-Wiki requests

Requests

All CUer @zh.wikipedia

Status:    Not done
List of users
PMDdeSN (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Alexander Misel (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Cdip150 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Jimmy Xu (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Kegns (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Lanwi1 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Mys 721tx (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): On w:zh:WP:VPM, User:PMDdeSN posted CheckUser's data publicly that it would be a violation of privacy agreement, so it need to check whether User:PMDdeSN is one of zh.wikipedia CUer. Maybe it would find nothing because it can be evade if someone know the principle of CheckUser. --Cwek (talk) 02:57, 21 September 2017 (UTC)[reply]
@Cwek: that's an ombudsman commission business you should contact ASAP. --Vituzzu (talk) 22:11, 21 September 2017 (UTC)[reply]
The ombudsman commission is aware of this incident and is looking into it. This shouldn't preclude further actions by CU in this matter if there is a clear and compelling reason to do so, however. Craig Franklin (talk) 02:26, 24 September 2017 (UTC).[reply]

Agadirhaha@commons

Tracked in Phabricator:
Task T174342
Status:    On hold
List of users
Agadirhaha (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): This user uploaded a video demonstrating IP address change to evade an ISP-level blackholing of Phabricator (gerrit:368775). We've identified a number of ISP addresses from public records for Maroc Telecom phab:Z567#10425, but need assistance in finding more ranges. Dispenser (talk) 18:11, 25 August 2017 (UTC)[reply]
Deferred Deferred to c:COM:RFCU. Hello. Commons has their own CheckUsers, you should request them on their request page. Regards, —MarcoAurelio (talk) 10:03, 26 August 2017 (UTC)[reply]
Is this still the case when Phabricator uses www.mediawiki.org for OAuth login? Dispenser (talk) 11:49, 26 August 2017 (UTC)[reply]
I cannot really answer that question because I do not know if OAuth logins leave CU trace. I think they don't, but I'll ping @Tgr (WMF) and BDavis (WMF) for clarification. In any case, I think Phabricator administrators can access IP data about users so if there's sockpuppetry problems over there maybe @AKlapper (WMF) and MModell (WMF) will be able to assist. —MarcoAurelio (talk) 09:53, 27 August 2017 (UTC)[reply]
Indeed they don't (although the user had to login to MediaWiki at some point, that you could look up). We can add something to the system logs if you think that would be important, feel free to open a phab task about it. Creating MediaWiki log records would be too much effort compared to how rarely it would be useful, IMO. (Also probably not something CUs should have access to, as OAuth authentication can be used for third-party logon and whatnot.) --Tgr (WMF) (talk) 20:26, 27 August 2017 (UTC)[reply]
Phab administrators can access IP data of users. If anything is wanted, please elaborate. In the case of Agadirhaha, I can see several IPs but no other users who used these exact IPs (might be WP0 anyway). Based on behavior in Phab I pesonally believe that mw:User:Vaporitoo, mw:User:Monadamat_almajanyat, mw:User:Said_raz, mw:User:Samurai_rider, mw:User:About_spindab, mw:User:Adriano_gagazoo, mw:User:Vampire_dracula, mw:User:Darcula, mw:User:Wikishopia, mw:User:Milanooooooooo, mw:User:Disponsable, mw:User:Skillboy_ghost are sock puppet accounts. --AKlapper (WMF) (talk) 10:25, 28 August 2017 (UTC)[reply]
I'll have a look at those on mediawiki. —MarcoAurelio (talk) 10:33, 28 August 2017 (UTC)[reply]
There are not conclusive results at mediawiki. They might be sockpuppets based on what they do, but so far the only connection I see is continental procedence, which is not much. The ranges are also crowded to do a safe IP range block. If someone else with more experience does want to have a look, feel free. —MarcoAurelio (talk) 11:27, 28 August 2017 (UTC)[reply]
@MarcoAurelio: Can you confirm any of Aklapper's previously seen /16 ranges? Dispenser (talk) 13:49, 3 September 2017 (UTC)[reply]
I've filed a phabricator task. Cleaning up phabricator requires console commands which is why a /8, /11s, and /12s are blackholed, but they still somehow got through two filters. Dispenser (talk) 13:04, 28 August 2017 (UTC)[reply]

Emanuel argento@it.wiktionary

Status:    Done
List of users
Emanuel argento (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
79.47.123.197 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): Block evasion. --Buggia 13:55, 8 September 2017 (UTC)[reply]
 Confirmed in my it.wiki's checkuser capacities. --Vituzzu (talk) 20:03, 8 September 2017 (UTC)[reply]

Wikipedia Zero abusers fishing

After today's account locking, I noticed Amadeu Gonçalves TAXI doesn't have an account on MediaWiki.org likely to Morocco 1 month ban there.

Is it possible to setup an abuser filter to tag accounts created here (Meta) as a WP0 user (or Moroccan IP or a proxy we blocked on Commons like Azure)? Is it possible to have an idea of where those accounts are created?

Dispenser (talk) 14:29, 12 September 2017 (UTC)[reply]

This account is not from Morocco. Ruslik (talk) 20:13, 12 September 2017 (UTC)[reply]
Ok, looked closer at User:Nemo bis block and see it was mid-June to mid-July so it couldn't have possibly been that. Relisting request at Meta:Requests for CheckUser information#Requests for Meta-Wiki only Dispenser (talk) 17:38, 13 September 2017 (UTC)[reply]
Checkmark This section is resolved and can be archived. If you disagree, replace this template with your comment. Dispenser (talk) 17:38, 13 September 2017 (UTC)[reply]

Hateegatestudio@th.wikipedia

Status:    Done
List of users
Hateegatestudio (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
ThaiMovieMedia (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
TPCNotePatipon (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Patipon Rattanaphan (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
DonutBigHead (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
PatiponDramatv (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Patipon99 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): There has been a similar pattern of vandalism made by the user excerpted here (please see the record for the entire list), with addition of false information repeatedly and in particular through the alleged sockpuppet. This check is meant to establish a solid proof whether these users are connected in some way, since normal user often reported new user matching the edit pattern without any confirmation that they are related, let alone being the sockpuppet of the master (Hategatestudio) --G(x) (talk) 12:43, 20 September 2017 (UTC)[reply]
Hateegatestudio, ThaiMOvieMedia, TPCNotePatipon are unreacheable by checkuser, EvilJohnTv, Herezuma, Tee Patipon, PATIPON191230, Patipon Rattanaphan, Yoshimusic.2017, DonutBigHead, Herenut123, PatiponManutd, DonutLegend, Dramatvoffcial, PatiponDramatv, Patipon99, Thaksin99, Patipon.2017, KiroszLol are  Confirmed --Vituzzu (talk) 22:09, 21 September 2017 (UTC)[reply]

Sci-fi-@en.wikiversity

Status:    Done
List of users
Sci-fi- (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Michael skater (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Jamenta 2 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Ben the Blissentia (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Ben_Steigmann_Blissentia (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Psychicbias (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Myerslover (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): Apparent impersonation, cross-wiki abuse. A Wikipedia sock puppet investigation was filed by Michael skater, an SPA with no other edits, against Psychicbias and Myerslover, which were accounts of the Wikipedia-blocked user Blastikus (real name, Ben Steigmann, also his Wikiversity user name), acknowledged by him to me privately. Only Psychicbias was not stale. Other accounts were included that were probably not Steigmann, but the filing itself was clearly an attack on a Wikiversity educational resource legitimately created by Steigmann, on a fringe science topic (which some hate). Michael skater claimed to be a Wikiversity user who did not want to disclose his name for fear of being attacked by Steigmann, but Steigmann was nondisruptive on Wikiversity and there was no ongoing dispute. Then a series of new accounts appeared on Wikipedia, purporting to be Steigmann, defiant and provocative, and, as well, linking to the Wikiversity resource. In the next sock investigation, these accounts were listed (only a few are listed above) and were tagged as socks of Blastikus, not by checkuser, based only on sock edits claiming to be Steigmann, and the active administrator then went to Wikiversity and requested action against Steigmann and the resource there, based on "cross-wiki disruption." Nobody in the discussions anywhere suspected that those intensely disruptive edits were not Steigmann, and he was blocked and the resource deleted. Steigmann was inactive and did not discover the situation until this week (per private communication). The user "Sci-fi-", also an SPA, in that discussion, misrepresented the Wikipedia checkuser results, and attacked a Wikiversity administrator, so he is suspected here of being involved in a scheme to disrupt Wikiversity through false flag disruption on Wikipedia. Steigmann had evaded his block, but had not been otherwise disruptive for years, anywhere, and there were only a handful of his actual edits involved. Please check if possible. Thanks. --Abd (talk) 23:34, 20 September 2017 (UTC)[reply]
I may be missing something but en.wiki SPI results were confirmed by a checkuser. If these accounts belonged to "Michael skater" I'd expect to see them tagged. --Vituzzu (talk) 22:00, 21 September 2017 (UTC)[reply]
The checkuser confirmed the socks listed in the second request were the same user, which is consistent with what I wrote above. "Michael skater" was not checked, as far as we know, in that later request, nor in the earlier one. He filed the earlier request. All the "Blastikus" accounts tagged were not tagged by checkuser from connection with the only non-stale Steigmann account, Psychicbias. What appears clear from my study is that Steigmann was not the set of socks reported in the second request. No new account was connected with Steigmann by checkuser, this was all based on assuming that an account that says "I am Steigmann" is necessarily Steigmann. Because there is a faction, that communicates off-wiki, attacking "pseudoscience" -- it's well known and fairly open -- it is possible that various persons took on various roles, but the possibility here is that Sci-Fi- editing Wikiversity, was also one or more of the fake Wikipedia Steigmann socks, or Michael skater. In addition, Michael skater claimed to have a wikiversity account that he did not want to reveal. That alone could be abusive sock puppetry, cross-wiki (all accounts are now global.) I am supporting a claim of impersonation, illegal and a clear violation of WMF policy. There is no claim here that Wikipedia checkuser results were incorrect, but checkusers did not assert that those socks were Psychicbias (recent!), only that they were connected, which is also what I've concluded.
I do not know if checkuser can help untangle the mess created, but it is possible that it can, and that is why I'm asking. One more piece of information which might help: Steigmann also acknowledged being 50.185.21.78 (talk • contribs • deleted contribs • logs • block user • block log • CentralAuth • AllContribs • checkuser • investigate)], which had a couple of self-reverted edits. --Abd (talk) 01:26, 22 September 2017 (UTC)[reply]
I had to ask if it was possible to reveal but well, also Michael skater was checked at time and nothing interesting was found, so the request will basically turn into a who is Sci-fi-? then fishing, which I don't use to do for non-blocked accounts. --Vituzzu (talk) 15:54, 22 September 2017 (UTC)[reply]
  • If I may, I'd like to add w:User:Mikemikev for geographic area/IP checks, see w:Wikipedia:Sockpuppet investigations/Mikemikev/Archive and this excerpt from Rationalwiki: "Note the above sock IP is the [...] internet sockpupeteer Mikemikev, who is also: RealBrandonPilcher, Brandon Pilchers, Krom Loser, Communist Scientist, EgalitarianJay, Ben Steigmann Blissentia, Antifa Scientist, John Fuerst and JohnFuerstwithhispantsdown (most on Human Varieties talk). On most those socks he is also impersonating people. [...] Antifascist (talk) 19:28, 21 October 2015 (UTC)". I hope this helps! --Marshallsumter (talk) 01:12, 22 September 2017 (UTC)[reply]
There is a discussion of this on Marshallsumter's Wikiversity talk page, I just found, but this is a complex mess; the request here is for some fairly simple steward cross-wiki checkuser work, and not for anything else. "Ben Steigmann Blissentia" is interesting; that was a RationalWiki account with only one edit in 2015. It may have been impersonation, not Steigmann. The Wikipedia account by the same name was just created to post in the mass Wikipedia impersonation of Steigmann. The faction possibly involved would have high interest in RationalWiki. --Abd (talk) 01:47, 22 September 2017 (UTC)[reply]
I checked on loginwiki, where Psychicbias and Myerslover are stale. The results are that: Ben Steigmann Blissentia, Blastikus the cat, Blastikus Cats, Spirit of Myers, Ben the Blissentia, Jamenta 2, Spirit of James 2, Gggtt Steigmann, Michael skater, Bigcheeses, Sci-fi-, Gavarn1982, AlienMan99, Braude194 and Atheistic guy are Likely Likely the same user. Ruslik (talk) 20:18, 22 September 2017 (UTC)[reply]
Correction. Braude1945 per Ruslik. --Abd (talk) 14:42, 23 September 2017‎
Done, if I can say so. Thanks! Sci-Fi and Michael skater nails it. This was impersonation and cross-wiki disruption of a vicious kind. As well, Gggtt was probably innocent. I'll notify the relevant administrators and look at the others. --Abd (talk) 20:42, 22 September 2017 (UTC)[reply]

Ben Steigmann@en.wikiversity

Status:    Done
List of users
Ben Steigmann (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Sci-fi- (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Bigcheeses (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): This is an extension of the Sci-fi-@en-wikiversity request above. Per Ruslik, Sci-fi- and Bigcheeses, et al. are likely the same user. What was not included in the original request is whether or not Ben Steigmann is also the same user. As the request is to unblock Ben Steigmann for having been impersonated, if possible, we should confirm that it was impersonation. Dave Braunschweig (talk) 14:37, 24 September 2017 (UTC)[reply]
Unlikely Unlikely I do not see any evidence that Ben Steigmann is related to other two accounts. Ruslik (talk) 15:50, 24 September 2017 (UTC)[reply]

See also

Cooperation requests for: comments (local) (global) · translation

Retrieved from "https://meta.wikimedia.org/w/index.php?title=Steward_requests/Checkuser&oldid=17258098"