Jump to content

Wikipedia:Requests for checkuser/Archive15

Add links
From Simple English Wikipedia, the free encyclopedia

Aminnie and Jaleh B and Parissa Official and ip 109.8.146.123

[change source]

Referencing the Sockpuppet investigation started and in progress at the English Wikipedia, I checked user records and found Aminnie and the other accounts reported as being socks at EN, as well as the connected IP (which has been editing the Parisa Music Mixify and DJ Mixify articles here, sometimes alternately with Aminnie. I call duck on this lot. Quack :) DaneGeld (talk) 15:41, 14 November 2017 (UTC)[reply]

Note- has this been looked at yet please? I'm away at the moment in The Netherlands, so I'm not keeping up; the absence of notes leads me to believe it's been missed or still in progress. Any clues please? Thank you. DaneGeld (talk) 23:46, 18 November 2017 (UTC)[reply]
As has been mentioned to you before, you won't always get a comment back on RFCU cases. Secondly, just because they are socks elsewhere doesn't mean they fall afoul of socking here. Two of those accounts have yet to edit here. And editing as an account and an IP is not against the rules. -DJSasso (talk) 16:16, 20 November 2017 (UTC)[reply]

‎JBJGyZ and Gyurik Zita

[change source]

Looks like block evasion here; new account ‎JBJGyZ has been making almost identical bad edits (to the same article) as blocked vandalism-only account Gyurik Zita. J991 12:02, 2 November 2017 (UTC)[reply]

Difficult to check as CU info is not held for long periods of time. This one could be proved by the duck test--Peterdownunder (talk) 12:11, 2 November 2017 (UTC)[reply]

Oct252017Lulz and Oct252017three

[change source]

Both editing making the exact same threat on United Kingdom and United States, for which I'm requesting revdel. Both edits reverted and 4im issued as they're obvious socks of a couple Djsasso picked up on 23rd October, notes are at WP:AN. DaneGeld (talk) 21:19, 25 October 2017 (UTC)[reply]

Note: I indeffed both as vandalism-only accounts. --Auntof6 (talk) 21:34, 25 October 2017 (UTC)[reply]

Duck. Please add these to the same sockfarm as this and the others mentioned at WP:AN. Thanks DaneGeld (talk) 21:47, 3 November 2017 (UTC)[reply]

 Done--Peterdownunder (talk) 22:39, 3 November 2017 (UTC)[reply]

Randybeans918, Popcorn918 and Alex.ayer321

[change source]

All edits this person made are at the article The Holocaust. Popcorn918 self-confessed in this edit that "he's here as Randybeans918". Obvious duck, also both users end with the same number "918". theinstantmatrix (talk) 19:30, 19 October 2017 (UTC)[reply]

Also may want to check out user Alex.ayer321; this account is suspiciously created after getting indefinitely blocked as Popcorn918 and came back to the article to make vandalizing edits. theinstantmatrix (talk) 19:36, 19 October 2017 (UTC)[reply]

Popcorn918 is currently blocked as a vandalism only account. --Eurodyne (talk) 19:33, 19 October 2017 (UTC)[reply]
 Done. -DJSasso (talk) 11:20, 20 October 2017 (UTC)[reply]

Metromemed and TheMetroGanger

[change source]

First edits from both accounts were to Columbine High School massacre, all vandalism, some of it very unpleasant (example). Metromemed is described on its userpage as a "joke acc0(u)nt". Very ducky. DaneGeld (talk) 20:15, 17 October 2017 (UTC)[reply]

 Done Blocked as socks.--Peterdownunder (talk) 20:28, 17 October 2017 (UTC)[reply]

YahooBing and It's all yours

[change source]

Following earlier deletion and multiple warnings leading to a level 4 on User_talk:YahooBing, one such warning for creating Vandalism-only account, User:It's all yours turns up and recreates the exact same article. This is an obvious duck, especially with the edits on Category:Playground equipment with both removing Playground from the category, and PlyrStar93 putting it back. Have tagged It's all yours as a suspected sock. DaneGeld (talk) 20:14, 15 October 2017 (UTC)[reply]

While not a checkuser, both accounts are globally locked, and 1 has a local block already in place. I went on and blocked the other so the auto-blocks can help mitigate future attempts. -- Enfcer (talk) 20:22, 15 October 2017 (UTC)[reply]
Same user agent, but different IPs, which geolocate to the same city. Possible, but unlikely. Anyway: no sock farm from either of these user's Ips. --Eptalon (talk) 20:35, 15 October 2017 (UTC)[reply]
You should be aware that according to PlyrStar93, both of these users are part of an extended SPI case on en, and there is a confirmed sockmaster of Hoggardhigh, whose account is already locked on 5 other wikis. DaneGeld (talk) 20:47, 15 October 2017 (UTC)[reply]
Both are blocked, and they are the only user for the respective IPs they use. So we are all done here,IMO. --Eptalon (talk) 21:01, 15 October 2017 (UTC)[reply]

What's up now & Bad Bad Leroy Brown

[change source]

Both of these users have been blocked as VOA - unblock requests have been filed, and all those unblock requests have been lines from popular songs, The Saga Begins (Weird Al Yankovic), Basket Case (Green Day) and Ring of Fire (Johnny Cash). Smells kind of odd that both users are posting unblock requests just as lines from songs and I suspect they're both the same user. DaneGeld (talk) 21:27, 9 October 2017 (UTC)[reply]

Likely, but they are blocked at this point anyway so no action to be taken. -DJSasso (talk) 11:03, 10 October 2017 (UTC)[reply]

WikiVandal and SLBHwildcat5

[change source]

WikiVandal has removed user warnings from their talk page, in a similar manner as SLBHwildcat5 and also Single4Life, part of the BazBomber sockfarm. All of their contributions are vandalism, I have been through them all and am now in the process of tidying them and reverting them. DaneGeld (talk) 19:19, 24 September 2017 (UTC)[reply]

Note to CU, both of these users are currently subject to indefinite blocks. DaneGeld (talk) 21:13, 24 September 2017 (UTC)[reply]
Confirmed.--Peterdownunder (talk) 21:14, 24 September 2017 (UTC)[reply]

Fikadu K. Angasu and Oriental Theological College

[change source]

User:Fikadu K. Angasu was using their userpage as a G11 advert for the Oriental Theological College. I tagged this for QD and the user removed my QD tags, claiming they'd reworded the page so that it wasn't an advert. I warned them for removing QD tags on their userpage. Now, the Oriental Theological College has (mysteriously or not) arrived on the scene, and preceded to remove my G11 warning notice from Fikadu K. Angasu's talk page. My suspicion is that Fikadu K. Angasu is misusing another account with the intention of avoiding scrutiny and warnings. DaneGeld (talk) 09:19, 21 September 2017 (UTC)[reply]

I've blocked both users since it's an obvious case so there is no checkuser need. Only (talk) 10:18, 21 September 2017 (UTC)[reply]
 Done Confirmed as the same. -DJSasso (talk) 10:55, 21 September 2017 (UTC)[reply]

Single4Life and SLBHwildcat5

[change source]

Single4Life's very first edit to the site was to create the RFCU for Eurodyne and Auntof6, 2 edits later to comment on the very thread SLBHwildcat5 had been blocked because of. Add to that the edit summaries which matched those of SLBHwildcat5 "removing vandalism" from their talk page. I believe that Single4Life is a sock of SLBHwildcat5 committing block evasion. DaneGeld (talk) 08:41, 20 September 2017 (UTC)[reply]

Note: One of these users is currently indeffed. The other is under a 31-hour block. --Auntof6 (talk) 08:47, 20 September 2017 (UTC)[reply]
Thanks, Auntof6, I had noticed but I thought it best to flag here. It looks ducky to me. DaneGeld (talk) 08:49, 20 September 2017 (UTC)[reply]
Thanks, Danegeld. My note was more for the checkuser person who handles this. --Auntof6 (talk) 08:56, 20 September 2017 (UTC)[reply]
Both use the same IP Address, and the user agent matches; so likely one is the sock of the other. Note however, that the IP may be dynamically allocated, so blocking the ip indefinitely is probably not an option.--Eptalon (talk) 09:06, 20 September 2017 (UTC)[reply]
You can't block IPs indefinitely anyways. The max is a year. -DJSasso (talk) 11:39, 20 September 2017 (UTC)[reply]
@Eptalon: Is it likely enough to indef the other account? --Auntof6 (talk) 17:14, 20 September 2017 (UTC)[reply]
As I said: same user agent, same ip address. Suppose you live in the same family, and have a router that does network address translation: then all the users in your family will get the same ip address. Now if you and another person in your family use the same browser, we also have the situation outlined. Note that there is a whole Sock farm behind "SLBHwildcat5"; Single4Life is just another account in that farm. --Eptalon (talk) 17:24, 20 September 2017 (UTC)[reply]
Thanks. I have indeffed the other account. --Auntof6 (talk) 17:35, 20 September 2017 (UTC)[reply]

Eurodyne and Auntof6

[change source]

I read on the Administrators' Noticeboard that Eurodyne and Auntof6 are suspected socks. As far as I know, they have not been checked. Many users of the list of socks submitted by SLBHwildcat5 were blocked by one of these two admins. I suspect that they have been creating vandal accounts and blocking them in order to make themselves look better. Thanks, Single4Life (talk) 03:18, 20 September 2017 (UTC)Single4Life[reply]

Both are respected users, and administrators; looking at the times they edit, they are unlikely to be socks of one another. The bulk of AuntOf6's edits happen from 1h-4h (I assume GMT/UTC); Eurodyne has most edits during the afternoon/evening. (also GMT/UTC). I am not aware of the misbehaviour of either, so unless there's more convincing evidence; I guess this would be fishing. --Eptalon (talk) 07:49, 20 September 2017 (UTC)[reply]

Jeevitha Magandaran

[change source]

Both edited on List of national fruits, changing the entry for Malaysia to "Durian", IP claims to be the "Deputy Prime Minister of Malaysia", although this may not necessarily be true. I can't prove it one way or another, but believed that 60.54.68.129 and Jeevitha Magandaran may be one and the same person. DaneGeld (talk) 16:50, 10 September 2017 (UTC)[reply]

I don't think this is an issue that needs a checkuser. Should the behaviour of either become problematic, the user in question can be blocked. And no, I am not going to argue if red or green is your favorite color... --Eptalon (talk) 11:08, 18 September 2017 (UTC)[reply]

This is the future

[change source]

This is the future got blocked for vandalism and has since used these IPs above to continue the vandalism spree, Can a rangeblock or something be applied as this user isn't going to give up without a fight, judging by the IPs it seems to be from a specific device so rangeblocking shouldn't really affect anyone ?, Thanks, –Davey2010Talk 23:51, 8 September 2017 (UTC)[reply]

Partially struck as it could well be any device however as the front part is the same it must be either a specific device or just that particular area ?, Anyway thanks, –Davey2010Talk 00:07, 9 September 2017 (UTC)[reply]

Jsjjdjdjjfdhsdhdhdchchd

[change source]

These users have pretty similar usernames, consisting of random letters, or repeating letters. Their edits are all vandalism, with the exception of the redlinked user, adding the same I am gay and i am jealous about lesbians because they are very sexy than me. to the pages they edit. Both userpages have the same content. Pretty obvious. Zhangj1079 (T|C) 21:54, 6 September 2017 (UTC)[reply]

 Done Blocked. Failed the "duck" test (as well as a CU).--Peterdownunder (talk) 21:59, 6 September 2017 (UTC)[reply]
Thank you! Zhangj1079 (T|C) 22:00, 6 September 2017 (UTC)[reply]

Multiple IP addresses

[change source]

Additional: 107.77.204.228 (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · block log · SUL · CA · checkuser (log))

These IP addresses have multiple similarities between their edits - first, they're all vandalism; secondly, all the edit summaries have the same format, which consists of a section header followed by 4 tildes, as if they're trying to sign the edit summary; third, and most important of these, is that they're ALL adding the exact same edit (concerning lots of legal things, including the death of someone called Seth Rich) to every article they edit. I've personally reverted changes by two of these IPs, 63.139.112.253 and 50.77.104.17, featuring this vandalism (both those are blocked now, I believe), but also the other IPs featured with the same repeating edits on Mike Enzi. It's worth noting these IPs have only started editing since August 5th or there about. DaneGeld (talk) 20:43, 22 August 2017 (UTC)[reply]

This is a known long term vandal who abuses both here and the English Wikipedia. As such, I can implement some range blocks that mirror ones already implemented on the English Wikipedia.
Note, though, this is not a checkuser issue. First of all, the fact that these are the same user is quite obvious so there doesn't need to be any additional technical evidence to link these accounts together. Second of all, because these are IPs and not named accounts, there's nothing really that a checkuser can do that a regular admin can't. Only (talk) 20:13, 23 August 2017 (UTC)[reply]
I've misunderstood the details at the top of the page then, because it says that it can be used for "named users and IPs", so that is what I did. Does it mean that I have to have a named user to attach the IP addresses to? DaneGeld (talk) 20:16, 23 August 2017 (UTC)[reply]
Basically yeah, if you are trying to say an IP is the same as a named user. That being said, in those cases a CU won't confirm if they are the same user or not because we can't publicly match an IP to a user. -DJSasso (talk) 14:52, 7 September 2017 (UTC)[reply]

CraptasticSams

[change source]

Pretty obvious similarlity in usernames, and both accounts are indefinitely blocked as being vandalism only accounts. In addition, both accounts vandalized the user page of User:There'sNoTime and then reverted the user who reverted the vandalism. These edits have now been removed via RevisionDeletion, but they are still evident in the public page history. To me, this is pretty obvious, and therefore I think a CheckUser-imposed block on IP(s)/IP ranges might be warranted, at least temporarily. Catalan (talk) 00:36, 26 June 2017 (UTC)[reply]

Both are blocked, blocking an IP range is probably no use, unless more vandalism is detectzed. --Eptalon (talk) 20:23, 9 July 2017 (UTC)[reply]

Lenin.exe

[change source]

Both appear to be vandalism only accounts created shortly between each other and share overlapping interests in editing the same articles/same vandalism. See 1, 2, etc...garden variety duck sock. Chrissymad (talk) 13:00, 20 June 2017 (UTC)[reply]

 Done Certainly failed the duck test, and I did find another one too. However they are sourced from a large education network, and therefore without blocking a large range further vandalism could be expected on topics related to Marx, Lenin and Communism. --Peterdownunder (talk) 23:32, 9 July 2017 (UTC)[reply]

ABS-CBN Out

[change source]

These three accounts have appeared in the last 2 days and have the same edit patterns. They're tagging English Wikipedia administrators as blocked sockpuppets here (see the deleted history of User:NeilN, User:JamesBWatson, and User:DMacks. They're putting block notices on each other's pages ([1][2] and the deleted history of User:ABS-CBN Out). ABS-CBN Out ([3]) and PCMPAKurat ([4]) have also both taken the user talk page header of JamesBWatson and put it on their talk pages.

Definitely seems like there's a connection to this English sockpuppet case: https://en.wikipedia.org/wiki/Wikipedia:Sockpuppet_investigations/Christian2941/Archive, especially considering JamesBWatson blocked the sockmaster back in 2011. Only (talk) 11:37, 14 April 2017 (UTC)[reply]

All users listed as blocked, so I am not sure whether a checkuser is necessary.--Peterdownunder (talk) 21:47, 11 May 2017 (UTC)[reply]

Vandals doing similar edits

[change source]

These accounts have all been indeffed for the same kind of vandalism. I wonder if they are the same person, or at least in an IP range that could be rangeblocked. FWIW, some IPs, not listed here, made the same kind of edits. --Auntof6 (talk) 01:57, 12 April 2017 (UTC)[reply]

AKM20012017 and Car01 are socks of each other. Jakksdksss and Dinsnnssm are socks of each other. MEA8286, FuckIsraeliPeople, Skksksm, FuckPalestines, and Akskssj are socks of each other. And likely all 3 groups are socks per WP:DUCK and if I wanted to waste more time on it I could probably proove it but they are all globally locked anyways. -DJSasso (talk) 21:57, 13 April 2017 (UTC)[reply]
Also, the same attack message beginning with "I am... and I want to..." posted by AKM... was posted by these users:

««« SOME GADGET GEEK »»» (talk) 02:33, 12 April 2017 (UTC)[reply]

These match up as likely matches of the above as well -DJSasso (talk) 22:00, 13 April 2017 (UTC)[reply]

Thanks, User:Djsasso. Here's another one:

I've revdel'd this user's changes, but it is possible to suppress the user name, too? Several of these are offensive, but this one mentions another user (me) by name. --Auntof6 (talk) 23:56, 13 April 2017 (UTC)[reply]

And now we have:

That last username is certainly offensive but I could not see what the content of the edit was. ««« SOME GADGET GEEK »»» (talk) 18:17, 14 April 2017 (UTC)[reply]

I don't find that last user name ("I am going to change... ") offensive. Intended to annoy, certainly, but not offensive. We need to be careful what we label as offensive. That user's revdelled edits were of two types: one was blanking, the other was addition of sexual comments that mentioned an admin. --Auntof6 (talk) 18:33, 14 April 2017 (UTC)[reply]
And now GulfWar2001 (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · block log · SUL · CA · checkuser (log)) has admitted it.
More sockpuppet accounts have posted messages to my talk page and that of Auntof6:

Thanks Only for dealing with them. Now, time to take action. ««« SOME GADGET GEEK »»» (talk) 02:12, 15 April 2017 (UTC)[reply]

based on the edits, I see no connection between Shaka Do Thang 2 and the rest of these accounts. Only (talk) 11:31, 15 April 2017 (UTC)[reply]
Thanks. I've changed it to an account that does. ««« SOME GADGET GEEK »»» (talk) 17:57, 15 April 2017 (UTC)[reply]
Here are more:

Last updated by ««« SOME GADGET GEEK »»» (talk) 02:33, 6 May 2017 (UTC)[reply]

Are any of our checkuser people still checking these, or shall we ask User:Some Gadget Geek to stop adding to this request? I'm not sure continuing to check them serves much of a purpose now. --Auntof6 (talk) 03:25, 7 May 2017 (UTC)[reply]

We check if there is a problem, when all the accounts are blocked and locked, I am not sure what checking will achieve.--Peterdownunder (talk) 03:44, 7 May 2017 (UTC)[reply]
This User has vandalized United States and his revision has not been hidden yet: Isnnsnsns (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · block log · SUL · CA · checkuser (log)) ««« SOME GADGET GEEK »»» (talk) 02:55, 10 May 2017 (UTC)[reply]
@Some Gadget Geek: This page is not for reporting vandalism (please use WP:VIP for that) or requesting revdels. I have revdel'd this user's changes, but please use the appropriate page next time. --Auntof6 (talk) 03:20, 10 May 2017 (UTC)[reply]

Disruption from Italy

[change source]

There have been many just plain nasty changes from these IPs registered to Postemobile S.p.A. to the pages at Wikipedia:Simple talk and Wikipedia:Administrators' noticeboard. ««« SOME GADGET GEEK »»» (talk) 16:08, 8 April 2017 (UTC)[reply]

Not sure what you are looking to have done here. These are all IPs so not really something a checkuser is needed for. -DJSasso (talk) 11:43, 11 April 2017 (UTC)[reply]

Disruption on Saverio Fabbri (Actor)

[change source]

Removed RfD tag four times from as Username:Bach1988; once each as 94.254.129.29 and 95.160.154.146. Apparent admission to 95.160.154.146 being the same as Bach1988 on User talk:Bach1988. Rus793 (talk) 16:09, 27 January 2017 (UTC)[reply]

Also:

Per policy, I am not allowed to directly link IPs and usernames. Feel free to block the user, if edits are disruptive; when blocking an IP remember though: IPs are scarce, and may get re-used. (So: no long term blocks on IPs...). In short: some of the IPs above cannot be clearly linked to Bach being logged in, and may be used by others. --Eptalon (talk) 16:51, 12 March 2017 (UTC)[reply]
Retrieved from "https://simple.wikipedia.org/w/index.php?title=Wikipedia:Requests_for_checkuser/Archive15&oldid=6091808"