Meta:Requests for CheckUser information/Archives/2018

66.160.178.43

Status:    Not done

I'm asking here (meta) for a check because the user is a cross-wiki vandal (bs ca da el en es et fi fr hr hu it la lt pl pt sl sq sv tl tr). A Portuguese sysop has already blocked one of his IPs, the one I'm reporting as first, because it was an open proxy. Unfortunately only one IP of the range 66.160.128.0/18 (AS6939 HURRICANE - Hurricane Electric, Inc., US) was blocked, while lots of other IPs on the same range are still used by him. Furthermore this is not the only range he's using, because the same proxy provides other ranges too, 72.52.64.0/18 and 74.82.0.0/18. All these IPs are being used to make the same edits in different wikis. Such edits are also being done by recently registered users who make almost only these edits, I have no doubt he's the same person, even if I may have missed a few IPs or sockpuppets around the wikis. I have to add one more thing: I'm sorry to have observed that the only real (not hidden by a proxy) IPs he's used belong to Italian IP ranges, such as 151.34.0.0/16 and 151.36.0.0/16, which makes this vandal an Italian, Italian as me. Last but maybe least too, adding such information to the fact that in certain cases those same edits have been done some time ago by an Italian registered user, Ninonino, as shown here and here, and to the fact that this user's last edits were made about one month ago (dec. 4th, 7th and 15th) in the same days the vandal made his, makes me think that this user might be the sockmaster, but since I'm not sure about this last point I'm not including him in the check request. If this is not the right place for a cross-wiki check request, please tell me the most correct place to make it, thank you. 151.64.176.253 18:20, 9 January 2018 (UTC)

Checking IPs with accounts are against CheckUser Policy. — regards, Revi 11:07, 13 January 2018 (UTC)

I'm not sure I've understood what you mean: are you saying that "checking relations between IPs and accounts" (i.e. "checking if a certain account has been used by a certain IP") is "against CheckUser Policy"? I thought that was just one of the very aims of checkusers. Perhaps you meant something else I couldn't get... 151.64.173.224 11:59, 13 January 2018 (UTC)

-revi is right. We ain't permitted to link accounts to IP addresses except very exceptional circumstances which don't appear to be the case here. —MarcoAurelio (talk) 14:51, 15 January 2018 (UTC)

Mmm, let's say it's ok. Then it's possible al least to link different IPs to each others, right? Since the accounts are just 2 and the wikis where they're editing are just 3, could we remove them from the check and focus on the IPs which are at the moment 22 editing in 16 wikis? Maybe I'll make a 2 single requests for the suspected socks in 2 of the 3 interested wikis, as proxies are involved and in some wikis some ranges have already been blocked. 151.64.189.174 15:15, 15 January 2018 (UTC)

  Not done. This is the page for requesting a check on Meta, and non of the users or IP-addresses has any edits here. And as others has explained above, linking users and IP-addresses is not according to the policy. -- Tegel (Talk) 15:56, 16 January 2018 (UTC)

I understand. Is it possible at least to leave this request here until the one in the other page is solved? It's just because here it's possible to add all the new IPs I find, while there the limit is 10. 151.64.164.185 18:36, 16 January 2018 (UTC)

OK, now I ask the IP's to stop editing this request. This is closed as not done already. Stryn (talk) 15:50, 23 January 2018 (UTC)

All right. The only reason I didn't stop it's because, as I said, here I was able to add all the new IPs I couldn't add in the other page where the limit is 10. I think I'll just create a new request there and stop editing this. 151.64.176.18 16:00, 23 January 2018 (UTC)

This section was archived on a request by: —MarcoAurelio (talk) 11:24, 4 February 2018 (UTC)

User:Assoc and User:Cosine02

Status:    Done

The second account was renamed to User:Stang, who is an admin on chinese wiki. Assoc creates it. He had previously used the account to support language proposals. He stopped after warnings on talk page. Now the new account Cosine02 is now supporting language proposals. --Artix Kreiger (Message Wall) 04:31, 3 February 2018 (UTC)

@Artix Kreiger: Both are clearly ducks of someone, though I don't know who is the master of both. --Liuxinyu970226 (talk) 05:10, 3 February 2018 (UTC)
This is getting increasingly weird. Please also check Umweltheizung (talk contribs deleted contribs logs block user block log CentralAuth AllContribs checkuser) --MF-W 13:35, 3 February 2018 (UTC)

┌──────┘
From a strictly technical point of view, the following accounts appear to be related:

  • Assoc
  • 北京漫游谷信息技术有限公司
  • Cosine02
  • 神奇超龙
  • 仙子精灵
  • 未开发国家
  • Wong128tw
  • 破坏光线

Stang is definitelly off the hook without the need of a check as per Special:Diff/17705312 and the rename logs. As for Umweltheizung I've not checked them. It seems to be a different kind of user and there's apparently nothing common in them but to have editted the talk page of the LangCom. —MarcoAurelio (talk) 11:24, 4 February 2018 (UTC)

101.86.89.233 and 180.159.145.125

I checked those IPs. According to whatismyipaddress.com ([1][2]) and infosniper.com ([3][4]), both IPs come from Shanghai. Not just that, either the edits look similar to each other, or they are merely votes without argument:

I'm unsure whether the IPs are related to the above report, so I just create this separate report instead. --George Ho (talk) 08:18, 7 February 2018 (UTC)

@George Ho: You can hate IP votes, which I also hate. However, how do you think CU requests that are affecting IP users are likely to be handled? --Liuxinyu970226 (talk) 02:27, 9 February 2018 (UTC)
How is this request no different from that one? These above IPs made edits, unlike the ones without edits. Nevertheless, I can understand privacy concerns about using CUs to check IPs. If the request can be taken, I guess investigation will be private. Otherwise, it may likely be rejected. --George Ho (talk) 04:10, 9 February 2018 (UTC)
  The CheckUser Magic 8-Ball says to merge with the section above as we're talking about the same kind of disruption. —MarcoAurelio (talk) 10:06, 12 February 2018 (UTC)
This section was archived on a request by: —MarcoAurelio (talk) 17:42, 12 February 2018 (UTC)

Arepticous

Status:    Not done

Same rationale as the top request, the new account had registered in December, after Wikientertain was proposed by User:Arepticous. The account has edited only on Meta, with the goal of finding projects and supporting them. The account supported the same type of wiki (social wikis) and had supported the same wikis as the other socks. The account's first edits were to his/her user pages and their user talks, with a striking similarity between the messages. Doesn't seem terribly obvious, though best to check. Thanks, Zhangj1079 talk 00:52, 2 January 2018 (UTC)

@Vituzzu:MarcoAurelio (talk) 14:51, 15 January 2018 (UTC)
@Vituzzu: re-ping. —MarcoAurelio (talk) 10:03, 12 February 2018 (UTC)

I'm sadned my call for assistance hasn't received any response for months. —MarcoAurelio (talk) 09:48, 29 April 2018 (UTC)

This section was archived on a request by: —MarcoAurelio (talk) 09:48, 29 April 2018 (UTC)

Jatharinan

Status:    Not done

@RadiX, Ruslik0, and Tegel: I've read that "an editor's IP addresses may be checked upon their request, typically to prove innocence against a sockpuppet allegation". That's what I'm requesting. My account on meta, Jatharinan, was blocked because it was identified with a troll IP. This IP made a vandalism in it.wikipedia on the 31st of January, which was deleted by an Italian admin, but he wasn't blocked. After I'd logged in my account on the 2nd of February my account was globally blocked by another Italian admin. That was a mistake, since I haven't made that vandalism, and I don't understand on which bases I could have been identified with that troll. We had just one thing in common: the IP range, a common Italian IP range. Is "any registered used editing from a certain IP" for definition "any anonymous user editing from the same IP range"? I don't think this kind of identification is the rule here. The vandalism in that page about a Turkish cake had nothing to do with my actions here, apparently (as it was deleted so I don't know in what it consisted), so if the so called duck test is worth something you should check it, since you can view deleted edits: I'm sure it had really nothing to do with the socks I'd reported as Jatharinan, nor with final accents on Italian names. I'm asking for this CU request to prove that the IP I had when I last logged in before being blocked wasn't the same as the troll's, to prove my innocence. There's 1 chance over 65536 that the IP I had in that moment was the same the troll had 2 days before, if the check establishes that the IP is the same I'll accept the fact that I've just been very very unlucky and won't insist with the duck test, but if it establishes that the IP was different, as I think, I'm asking you to clean my reputation and unblock my account. This great mistake is the only reason why my CU request to stewards on meta about a cross-wiki vandal using proxies and sockpuppets was refused... 151.64.181.191 22:33, 16 February 2018 (UTC)

  •   Declined - long-term abuse. – Ajraddatz (talk) 17:24, 27 March 2018 (UTC)
This section was archived on a request by: —MarcoAurelio (talk) 09:48, 29 April 2018 (UTC)

AviaRobloxis

Status:    Done

Same vandalism of Global rename policy, CU them and more --Shizhao (talk) 06:35, 19 March 2018 (UTC)

User:AviaRobloxis are also blocked on English Wikipedia as VOA. SA 13 Bro (talk) 06:48, 19 March 2018 (UTC)
  Confirmed - locked both accounts and a couple of sleepers. – Ajraddatz (talk) 17:22, 27 March 2018 (UTC)
This section was archived on a request by: —MarcoAurelio (talk) 09:48, 29 April 2018 (UTC)

Liza Veniza

Status:    Done

A Russian-speaking vandal in Wikipedia in several languages and Meta-wiki; see user talk: Well-Informed Optimist #The Russian vandal (mostly in Russian) for background. Makes threats to certain users. Presumedly uses VPS, shell servers or other kinds of proxies to evade IP blocks. Please, expose and take down with global IP blocks all these troll houses because other abusers are likely operating from there. Incnis Mrsi (talk) 16:03, 26 March 2018 (UTC)
Sometimes uses proxies by Opera in 77.111.247.0/24; it resulted in one-month global block of 77.111.247.5 (talk contribs WHOIS block user block log guc checkip) and all the range is now under a short-term global block. Example from Wikipedia: fr:Special:Contributions/77.111.247.11. Incnis Mrsi (talk) 17:02, 27 March 2018 (UTC)

@Incnis Mrsi: Do you think that those LTA vandal maybe related to en:Wikipedia:Long-term abuse/Nikita or not? SA 13 Bro (talk) 17:10, 27 March 2018 (UTC)
I am aware of Никита-Родин-2002’s existence, and no – unrelated in any reasonable sense except the country and LTA in Wikimedia. They have very different mindset. Incnis Mrsi (talk) 17:17, 27 March 2018 (UTC)
I think that the accounts of "~ruwiking" do not belong to Liza Veniza, since the last account was followed by horrible insults, and deleted the content of the Jimbo Wales discussion page. And apparently, Liza Veniza did not write anything and Larry Sanger, and Jimbo Wales. Marshmallych ?! 05:11, 1 April 2018 (UTC)
Unsure where did Marshmallych get an idea about another, distinct vandal. Krassotkin~ruwwikingre demonstrated a familiar style and even distinctive phraseology of the Любимая_песчанка account series. Incnis Mrsi (talk) 05:48, 1 April 2018 (UTC)
  Inconclusive - account was using an open proxy, only another sock on the IP. Accounts can be blocked/locked based on behavioural evidence. – Ajraddatz (talk) 05:20, 1 April 2018 (UTC)
@Ajraddatz: thanks for your job. I hope you did not forget to globally block troll houses, if any new were discovered. Incnis Mrsi (talk) 05:48, 1 April 2018 (UTC)
I've been doing this for over four years now, I remember :-) – Ajraddatz (talk) 05:50, 1 April 2018 (UTC)
Incnis Mrsi. And one more answer, why I think that ruwiking accounts do not belong to Liza Veniza - because the original vandal, when creating new accounts, it creates new insults and threats in Russian. And the last three accounts just canceled the changes, and I think that this should not be the case from the original vandal. Marshmallych ?! 16:34, 1 April 2018 (UTC)

"~ruwiking" belongs to the you, Incnis Mrsi--Andrew Veniza (talk) 14:01, 14 April 2018 (UTC)

This section was archived on a request by: —MarcoAurelio (talk) 09:48, 29 April 2018 (UTC)

Pasha UA, Никита-Родин-2002, Liza Veniza & Vladislav Pavlov

Status:    Not done

Please check if someone belongs to the account of Liza Veniza from 3 of these people. Liza Veniza 一 this is the first account, which often became a threat to me and the participant Oleg3280. I just had doubts that Liza Veniza still belongs to someone.

  • I think account "Кубит, возвращайся на одноклассники" belong to Pasha UA
  • I think account "Litle Huesous" belong to Vladislav Pavlov
  • I think accounts "Х у й ебать открыто сасать" and "Jason Iron" belong to Liza Veniza

Marshmallych ?! 06:28, 7 April 2018 (UTC)

New account 一 Зелёный хуесос (talk contribs deleted contribs logs block user block log CentralAuth AllContribs checkuser). I think it Liza Veniza again. Marshmallych ?! 10:30, 7 April 2018 (UTC)
Addition:
  • See #Liza Veniza for discussion about Liza Veniza.
  • Incnis Mrsi on discussion about Liza Veniza proved that the Liza Veniza uses an open proxy by Opera VPN.
  • Threatens and offends several users in Russian. Diffs: 1, 2.
  • Cross-wiki vandalism.
  • Frequent block evasion.

Marshmallych ?! 20:01, 7 April 2018 (UTC)

What does this or that account do:
Pasha UA creates accounts with obscene words in Russian and sends insults, threats.
Никита-Родин-2002 is a popular russian vandal. One time he threatened one of the FANDOM'employees - Kuzura.
Vladislav Pavlov created account Tellarion Foldring for ban evasion on ru.wiki and 7 days after registering this account with the same account, it was written to me that I have crooked hands.
Liza Veniza threatens and offends Well-Informed Optimist, Oleg3280, and me on all wikis (especially Meta-wiki, Russian Wikinews, French Wikipedia).

I think account Liza Veniza belong to Pasha UA or Vladislav Pavlov. Marshmallych ?! 07:38, 8 April 2018 (UTC)

  •   Comment There is nothing against general Wikimedia rules about having sock accounts, those are local wiki rules, so such requests should be referred to local wikis. If you are talking about abuse, then deal with the abuse, not start fishing over accounts.  — billinghurst sDrewth 06:38, 7 April 2018 (UTC)
    • BillingHurst. I wrote here specially because some of the accounts do not exist on this or that wiki. Marshmallych ?! 06:43, 7 April 2018 (UTC)
      If they are abusing you report them as abuse, if that is the case it is not evident from your report. Requesting checkuser is a serious accusation and should always be supported with evidence, and never done casually. There has to be a purpose to get the IP.  — billinghurst sDrewth 07:50, 7 April 2018 (UTC)
  • Thanks for all users, who help cancel vandalism and global block this user. Sorry for my English. Oleg3280 (talk) 15:05, 7 April 2018 (UTC)

Marking these as   Not done and out of scope.

This is meta, and enquiring about accounts that have not edited here and are not in contravention of local rules should be clearly seen as a fishing exercise. Whilst I am no longer a local checkuser, blind Freddie should be able to see these as out of scope.

Please take crosswiki abuse issues to SRG, stewards will work out there whether they wish to checkuser more broadly.  — billinghurst sDrewth 08:08, 8 April 2018 (UTC)

This section was archived on a request by: —MarcoAurelio (talk) 09:48, 29 April 2018 (UTC)

Amaro Rodrigez

Status:    Done

This user keep editing the Requests for comment/Global ban for Yahadzija page, which the global ban RFC debates is already closed, see the view history records. Request for check the User:Amaro Rodrigez whether is the same person as User:Yahadzija or not. SA 13 Bro (talk) 20:07, 8 May 2018 (UTC)

  Confirmed by Vituzzu, account globally locked. SA 13 Bro (talk) 07:23, 11 May 2018 (UTC)
@SA 13 Bro: in fact, Vituzzu found that the acc evaded IP defence via a proxy, not “confirmed” it. Action were undertaken after my alert via off-wiki channels, in turn due to an obviously Yahadzija upload on Commons. Incnis Mrsi (talk) 08:29, 11 May 2018 (UTC)
@Incnis Mrsi: Vituzzu is also a check user on Meta local, it seemed that nobody had do some comment at here while I've make this report on few days ago, so I have decided to close this section to curtail down my report. Any other accounts on Meta local that is similar behavior as the master? If so, please provide the evidence, so I can strike away my confirmed comment. SA 13 Bro (talk) 09:12, 11 May 2018 (UTC)
This section was archived on a request by: SA 13 Bro (talk) 07:46, 11 May 2018 (UTC)

Virajmishra

Status:    Done

Adminor is an en.Wikipedia-confirmed puppet. नमन1 makes Virajmishra-related vandalism, possibly another puppet. Incnis Mrsi (talk) 19:22, 15 May 2018 (UTC)

This is my all accounts.नमन1 (talk) 19:25, 15 May 2018 (UTC)
CU completed independently of this request. – Ajraddatz (talk) 15:35, 24 May 2018 (UTC)
This section was archived on a request by: —MarcoAurelio (talk) 20:06, 14 November 2018 (UTC)

Cæsey

Status:    Done

This user has had the capacity to get the first account locked, the second blocked; though the information about specifics is not overtly public. They have started a third account which at this stage has not been problematic and seems to be patrolling. I asked the user to identify all their accounts, and this is their list. Can you please check for others, as the result of the veracity of their answer will guide me on my future actions.  — billinghurst sDrewth 07:22, 20 May 2018 (UTC)

Supplementary: This user has managed blocks at other wikis.  — billinghurst sDrewth 07:24, 20 May 2018 (UTC)

I have never used any accounts apart from these ones. —The preceding unsigned comment was added by Rufus Rose (talk) 07:42, 20 May 2018 (UTC)

Tangentially related: en:Wikipedia talk:Long-term abuse/My_Royal_Young #How many physical persons is My_Royal_Young? Incnis Mrsi (talk) 07:58, 20 May 2018 (UTC)

I know, I saw that. and just so you know, I'm not related to Principe Joeseph. nice idea though. I might as well not bother though. P. S. I did find the Principe ybarro thing through recent changes. Sincerely, Rufus R. (talk) 08:02, 20 May 2018 (UTC)

I don’t believe in a genuinely new user starting to edit from LTA user: pages and recent changes. This explanation is unsatisfactory. Incnis Mrsi (talk)
Maybe people should try to trust me for a change. See my user talk pages history. I see no more reason to continue here anymore except to disrupt, because I tried to be constructive, but failed. Goodbye. Rufus R. (talk) 08:25, 20 May 2018 (UTC)

I will stay for a while.

@Incnis Mrsi: You don't need to tell our CUs how to do their tasks, they are experienced and have contact with CU from all other wikis. Plus, if you have no evidence, putting forward your rumours/guesses are not helpful, and maybe worthwhile keeping quiet.  — billinghurst sDrewth 08:07, 20 May 2018 (UTC)
Done, completed separately from this request. – Ajraddatz (talk) 15:36, 24 May 2018 (UTC)
This section was archived on a request by: —MarcoAurelio (talk) 20:06, 14 November 2018 (UTC)

Basntarah

Status:    Done

See my talk page and Meta:Requests for CheckUser information/Archives/2018#Liza Veniza. Thanks. Oleg3280 (talk) 18:57, 23 May 2018 (UTC)

Basntarah (Баснтарах in Russian) is Liza Veniza's sock, look down at this diff. "Ишне Шлюха" — is Liza Veniza's word. Look here for verify. Marshmallych 08:31, 24 May 2018 (UTC)
I think, this is in inconclusive by IPs and confirmed by treatments. I think, Liza Veniza/Basntarah doesn't user IP 104.236.53.155 for this time. Marshmallych 08:33, 24 May 2018 (UTC)
"inconclusive by IPs" becuase I saw steward's logs, and LTA vandal uses the different IPs. Marshmallych 08:34, 24 May 2018 (UTC)

  Comment How can check-users compare three instances of the vandal going via different proxies? The only thing of use is whether the vandal has a permanent User-Agent, but generally I deem this request to have very little clue, as we already know whose edits are from a clear behavioural pattern. Incnis Mrsi (talk) 12:14, 24 May 2018 (UTC)

This section was archived on a request by: —MarcoAurelio (talk) 20:06, 14 November 2018 (UTC)

Unidentified cross-wiki impersonator

Status:    Not done
Note: additions by Cinemantique are out of scope of the original request – these accounts are ordinary Liza_Veniza for whom countermeasures are established and traits are well-known. Incnis Mrsi (talk) 06:50, 12 June 2018 (UTC)

The person under these accounts has two main traits:

  1. An explicit intent to impersonate another LTA;
  2. Ability to mimic some aspects of imitated vandals, especially attacks against chosen people and on specific wikis.

But a close scrutiny reveals that he repeats words from foreign languages like a parrot. c:Special:Contributions/LammyTrammy and cu:Special:Contributions/Duvallier Duval are clearly related, and I received some hearsay it could be Wikinger.

This series may (or may not) be related to each of several bizarre incidents happening recently.

Incnis Mrsi (talk) 10:19, 9 June 2018 (UTC)

Incnis Mrsi, Basntarah is genuine Liza Veniza. Napoleon Sorting is, for me, is suspected sock of Liza Veniza. Писос is is more looked like Liza Veniza's vandalism, like a "coime back". If here I tagged as <s>, here I think here is a impersonator:

False. Marshmallych 14:00, 9 June 2018 (UTC)

I think I am trolled you like here... Marshmallych 10:59, 9 June 2018 (UTC)

@Marshmallych: can you point to the “coime back” cliché by a clearly authentic Liza’s sock? Incnis Mrsi (talk)
Incnis Mrsi, I think, "coime back" is LV. I am agree impersonators are Duvallier Duval and LammyTrammy (officially Krassotkin~ruwiking). Marshmallych 14:00, 9 June 2018 (UTC)
I think we need a check. It is impossible to contribute normally to Russian Wikipedia. Very nervous situation is obtained. Mats and insults bothered. Thanks. Oleg3280 (talk) 11:21, 9 June 2018 (UTC)
@Oleg3280: note that the authentic Liza is also currently active – see fr:Special:Contributions/Limonnerq. It becomes hard to tell who is who in this mess. Incnis Mrsi (talk) 11:34, 9 June 2018 (UTC)

After https://meta.wikimedia.org/w/index.php?title=User_talk:Tegel&action=history&offset=201806121140&limit=6 and some off-wiki discussion the case has no more interest for me. The home IP range of the impersonator—no more “unknown”—is globally blocked. Vandalisms via proxies should be treated as vandalism, no matter who namely each vandal is. Incnis Mrsi (talk) 12:29, 12 June 2018 (UTC)

This section was archived on a request by: —MarcoAurelio (talk) 20:06, 14 November 2018 (UTC)

Bobo alcazar

Status:    Done

As @五月雨恋歌: mentioned in [11], there may be possible that sock voting is happened in this request page. --Liuxinyu970226 (talk) 04:21, 13 November 2018 (UTC)

@Liuxinyu970226:So,what should I do?--Bobo alcazar (talk) 10:58, 14 November 2018 (UTC)
大天王皇子 is   Stale and cannot be checked.
Bobo alcazar and 夕沈弦人 appear   Unrelated to me from a technical POV.
MarcoAurelio (talk) 10:38, 21 November 2018 (UTC)
This section was archived on a request by: —MarcoAurelio (talk) 11:12, 24 December 2018 (UTC)

Mmmmmmmmmmmmmmmmmmmmmmm120 and related accounts

Status:    Done

This is the LTA Manda and variations. Are we able to put in place a range block?  — billinghurst sDrewth 23:05, 22 December 2018 (UTC)

Results:
Group 1: Mmmmmmmmmmmmmmmmmmmmmmm120 = Atyunisi[1], Atyun, Wirjadisastra 1945 and Kebijakan pemblokiran.
Group 2: Mugi1324, HaRaya 19 and HaRaYa 1.
Group 1 and Group 2 are very   Likely the same.
No range block possible for now due to collateral, sorry.
MarcoAurelio (talk) 11:33, 24 December 2018 (UTC)
  1. where this account go, cannot find it anywhere in the logs
  2. This section was archived on a request by:  — billinghurst sDrewth 03:02, 25 December 2018 (UTC)