Meta:Requests for CheckUser information/Archives/2013

January

Spam

Status:    Done

This is probably our crosswiki spammer again, and I suspect that this will need to go to CU-l, but i'll start here.

Please see userpage for evidence. -- DQ (ʞlɐʇ) 08:10, 14 January 2013 (UTC)

IMHO positive: KristianMC & KaiukksW87. Both (b)locked. Thanks. -- MarcoAurelio (talk) 13:30, 14 January 2013 (UTC)

Kanoflower

Status:    Not done

Obviously, it's a sockpuppet of that vandal disrupting SRCU recently. --Makecat 12:48, 15 January 2013 (UTC)

Could you please list some recent accounts with similar behaviour? Thanks. -- MarcoAurelio (talk) 13:08, 15 January 2013 (UTC)
[1], see those IP edits. In addition, he is the target of my checkuser request on SRCU. --Makecat 13:13, 15 January 2013 (UTC)
We hardly ever link accounts with IP addresses because wmf:Privacy policy is rather clear with that. Anyway, the account is blocked and the page has been semiprotected. -- MarcoAurelio (talk) 13:22, 15 January 2013 (UTC)
These accounts are probably his sockpuppets, but they are already confirmed and haven't made a single edit on meta (registered according to CentralAuth). --Makecat 13:29, 15 January 2013 (UTC)
Not certain that there is now a lot of point. Locked account, where there was other vandalism on same page. We aren't going to find anything especially relevant and I considered and dismissed it in about that time period. — billinghurst sDrewth 14:49, 16 January 2013 (UTC)

February

March

April

TCY

Hi :) TCY (talk contribs deleted contribs logs block user block log CentralAuth AllContribs checkuser), former tresurer and executive director of Wikimedia France, posted twice lately at Talk:FDC portal/Proposals/2012-2013 round2/Wikimédia France/Proposal form, the second time to say his account must have been hacked to do the first edit. I would like to have all the intervention available concerning the 22:29, 31 March 2013 edit to have more information on who would hack an account to ask loaded questions to Wikimedia France. Léna (talk) 12:27, 5 April 2013 (UTC)

As far as I can see, the edit made on March 31st was done using a different IP and useragent then the two later edits where TCY claims his account was hacked. The unfortunate thing is that I have no "baseline" IP to compare to making it hard to determine if TCY is actually back in control of their account. I'll be emailing the CheckUser mailing list. Tiptoety talk 05:52, 6 April 2013 (UTC)
After reviewing with another CheckUser I am confident that TCY is back in control of his account. Tiptoety talk 06:13, 6 April 2013 (UTC)

Arusha bid sockpupets

All the accounts have been created in the month of March (between 4 and 11 of March) following a complain about the lack of team in the Wikimania 2014 Arusha bid, that until then had only be edited by the main account Francis Kaswahili. All the accounts only edit in the bid page and nowhere else, so I suspect that is a case of sock puppetry to prove a point (in this case try to show a higher base of supporters than the bid actually has). Thanks in advance. Béria Lima msg 17:18, 6 April 2013 (UTC)

Do you want to notify the user(s)? πr2 (t • c) 17:21, 6 April 2013 (UTC)
  •   Completed - something is going on here.

I can confirm that Francis Kaswahili (talk · contribs) is the same as Ahmedy29 (talk · contribs), Wikimania_Arusha_2014 (talk · contribs), Yohana_Ndalahwa (talk · contribs). Those share the same technical details.

Equator_Hotel_Arusha (talk · contribs) seems unrelated, same with Faraja Roy (talk · contribs) and A4ahmed99 (talk · contribs). Different technical details. -Barras talk 17:51, 6 April 2013 (UTC)

I see these accounts were blocked. Why assume these are sockpuppets and not teammates sharing a computer?
Beria: your initial complaint is not accurate. a) Wikimania Arusha 2014 was created in February. That account, along with Fmacdaniel, started to edit the bid page earlier than March 4. b) I see no particular complaint about lack of team in the first days of March; there were various questions about the team's experience, before and after, but specific questions about their wiki activity came later (and it's not clear to me that the bid lead even understood that concern). c) the accounts all sharing the same technical details are not included in the list of team members on the bid, so it doesn't seem to be a bad-faith effort to "show a higher base of supporters".
I find it likely that a number of users involved here are sharing computers. Since this bid consists of many non-editors, it is also likely that they were asked to create accounts over the course of the bid. It is certainly the case that most of them are presently only interested in editing articles related to the bid. (Though they are clearly reading other wikis, and sometimes editing on commons and en:wp; see CentralAuth). But no bad faith is required for any of that. The blocks and sock allegations are not necessary. SJ talk  23:16, 6 April 2013 (UTC)
Sj, I don't agree with what most of what you are saying here, but I understand your point. I kind of agree that it was premature to block before asking the user for an explanation. The other accounts weren't being used lately, only the main one. Multiple accounts are permitted by policy, so the user should be given a chance to explain. At this time, I would also ask you to try and separate the issue from Wikimania. This is a local wiki matter, if admins choose to block, it should be separate from the Jury's purview. Theo10011 (talk) 23:43, 6 April 2013 (UTC)
Right. I only mentioned the bid because it was the excuse used to run a CU in the first place.
Forgetting about which pages were being edited: I don't see enough evidence to merit a CU. I don't think we should run CU's based on a single person's request, unless there is a very good reason such as ongoing disruption. Any users so affected should be notified of what is happening. And even given the results of the CU, I see no foul play according to Meta policy; the accounts affected should be unblocked. SJ talk  01:21, 7 April 2013 (UTC)

May

June

NTSAMR spambot

One of the usual NSTAMR spambots. Please CU it, block the IP and/or block/lock any more spambots (if there). Trijnsteltalk 08:32, 17 June 2013 (UTC)

I've added more to the list (still incomplete though). Since Herby quit, could someone else take over his work of checking spambots please? Trijnsteltalk 09:18, 17 June 2013 (UTC)
This group has been done. I'll do the others later this afternoon. -Barras talk 10:37, 17 June 2013 (UTC)
Another group of spambots

Trijnsteltalk 09:18, 17 June 2013 (UTC)

Other spambots

Trijnsteltalk 09:18, 17 June 2013 (UTC)

  •   Done All checked and if needed blocked/locked. -Barras talk 15:31, 17 June 2013 (UTC)
More

(User creation log); 02:56 . . User account Fzbxza3696 (talk | contribs | block) was created ‎ (User creation log); 02:55 . . User account Oipkza0297 (talk | contribs | block) was created ‎ (User creation log); 02:55 . . User account Lwvsza1161 (talk | contribs | block) was created ‎ (User creation log); 02:55 . . User account Ycapza6093 (talk | contribs | block) was created ‎

Seems related to the second group above. PiRSquared17 (talk) 02:57, 23 June 2013 (UTC)

And more NTSAMR spambots:
Trijnsteltalk 14:08, 28 June 2013 (UTC)

Roland Baines vandal

See deleted contributions on English Wikipedia and on Meta - a sleeper check would be helpful; also note w:en:Wikipedia:Sockpuppet investigations/RJCola and Special:AbuseFilter/70. Also please lock accounts when done (I think all most CUs are stewards now?) --Rschen7754 08:47, 21 June 2013 (UTC)

No sleepers, however, very broad range... -Barras talk 11:52, 21 June 2013 (UTC)

More:

--MF-W 22:43, 22 June 2013 (UTC)

Also BocaRatonD (talk contribs deleted contribs logs block user block log CentralAuth AllContribs checkuser). --Rschen7754 02:06, 23 June 2013 (UTC)
Also the accounts like RolandBaines, RolandABaines, etc., and BFCola‎ (talk contribs deleted contribs logs block user block log CentralAuth AllContribs checkuser). PiRSquared17 (talk) 02:57, 23 June 2013 (UTC)
  • I blocked an underlying (and blockable) range now. -Barras talk 09:35, 23 June 2013 (UTC)

July

August

Spam on user talk page

Please check these three accounts. They all spammed on the same user talk page and there might be more around. Thanks. Trijnsteltalk 18:02, 2 August 2013 (UTC)

  Done - All on the same spammy /19. -Barras talk 22:30, 2 August 2013 (UTC)

userid confusion

1sfoerster can login to wikiversity and edit at wikibooks, but can not login at wikibooks or reset password from wikibooks --1sfoerster (talk) 13:27, 9 August 2013 (UTC)

And why do you tell us that here? -Barras talk 15:36, 9 August 2013 (UTC)

September

October

November

December