Meta:Requests for CheckUser information

←Requests and proposals

Requests for CheckUser information on Meta-Wiki (for other wikis please go to here)

Archives (current)→

Shortcut:
RfCU

This page allows you to request CheckUser information on Meta.

Procedure

Please read the CheckUser policy before asking for a check.
When adding new requests, please use the {{checkuser}} template to list the user names in question and {{checkip}} for IP adresses, which simplifies investigation.
List your request at the bottom of the "Requests for Meta-Wiki only" heading.
When asking for a check we need to know:
- why do you believe that the accounts are related (please present evidence for that with the help of diffs, etc.),
- why, if the accounts are related, they are being used abusively, in violation of policy; and
- why a block or other measures can't be justified without the need of technical evidence.

Important

Local checkusers
Note: To request checkuser access, see Steward requests/Permissions.
Note: To request information for other wikis, see Steward requests/Checkuser.

Checkuser icons
These indicators are used by CheckUsers and stewards for easier skimming of their notes, actions and comments.
{{Confirmed}}: Confirmed	{{MoreInfo}}: Additional information needed
{{Likely}}: Likely	{{Deferred}}: Deferred to
{{Possible}}: Possible	{{Completed}}: Completed
{{Unlikely}}: Unlikely	{{TakeNote}}: Note:
{{Unrelated}}: Unrelated	{{Doing}}: Doing...
{{Inconclusive}}: Inconclusive	{{StaleIP}}: Stale
{{Declined}}: Declined	{{Fishing}}: CheckUser is not for fishing
{{Pixiedust}}: CheckUser is not magic pixie dust	{{8ball}}: The CheckUser Magic 8-Ball says
{{Duck}}: It looks like a duck to me	{{Crystalball}}: CheckUser is not a crystal ball

SpBot archives all sections tagged with {{Section resolved|1=~~~~}} after 1 day.

Requests for Meta-Wiki onlyEdit

NeotarfEdit

Neotarf (talk • contribs • deleted contribs • logs • block user • block log • CentralAuth • AllContribs • checkuser)
Rivselis (talk • contribs • deleted contribs • logs • block user • block log • CentralAuth • AllContribs • checkuser)
80.113.23.194 (talk • contribs • WHOIS • block user • block log • guc • checkip)

This is a somewhat unusual request as it concerns a Checkuser decision on the English Wikipedia that has been contested here on Meta through the use of the listed IP address and the main account. Last month the Rivselis account was blocked on the English wikipedia as a suspected sockpuppet of Neotarf citing a "likely" result from Checkuser evidence. A week or so after that block occurred, Neotarf posted to the Rivselis talk page here on Meta to contest the action using the above IP address. Neotarf subsequently pointed to that IP address as proof the accounts were unrelated and badgered the blocking admin from English Wikipedia on his talk page here.

Looking into it, the IP address used shows signs of being an open proxy having been used on multiple Wikimedia projects in different languages, including Chinese, and has clearly been used by multiple users with different geographic profiles. One site identified the IP as a likely proxy. A "likely" finding may mean the accounts are unrelated and the IP is not definitively identified as a proxy server as some services suggest it might be a normal IP address. However, if Neotarf and Rivselis are the same person and the IP address is an open proxy then mutliple policies have been violated. Specifically, the use of an open proxy in this way would violate the policy on open proxies and if Neotarf is knowingly badgering a user with false allegations then that would violate the urbanity policy. However, whether a violation has occurred can't be reasonably determined without checking the above accounts and the IP address.--The Devil's Advocate (talk) 21:30, 28 July 2019 (UTC)

The Devil's Advocate: the en.wiki block was made taking into account the CU data from meta, because Neotarf is stale on en.wiki. That is to say, checking again on meta wiki would not yield any new information that was not already discussed between myself and a meta CU when the block was made. TonyBallioni (talk) 21:57, 28 July 2019 (UTC)

I am not familiar with CU, so I don't know if Neotarf being active a week after Rivselis might yield a more definitive result. For instance, if the IP identified by Neotarf is a valid one and used by Neotarf, but not Rivselis, that would be new information.--The Devil's Advocate (talk) 22:01, 28 July 2019 (UTC)

If what you’re asking for is what likely means it’s this: both accounts were using the same relatively stable IP in the same time frame on an ISP where sharing an IP close to someone else usually indicates a connection between accounts. There was a difference in UA, which is why this is likely and not confirmed, but because of the other technical details, multiple CUs agree that the UA doesn’t tell us much. The conclusion I reached in consultation with another CU from a different project upon reviewing the data was that it was likely the same person.

There also is behavioural similarity both pre and post-block, that make me believe this is very likely to be the same person. At the same time, CU is not a perfect tool, and the en.wiki ArbCom is able to review additional information that may be submitted in an appeal that CUs don’t have access to. I’ll shut up now and let meta CUs decide how to action your request, but it read as much a request for an explanation of my findings as it did a meta check, which is why I commented :) TonyBallioni (talk) 22:40, 28 July 2019 (UTC)

This is helpful, but I still think comment from Meta CUs is useful because the subsequent actions with the IP address above and the Neotarf account becoming active again occurred after the check. Possible there is new data to review that may confirm of refute the identification. It may change nothing. Either way, there is subsequent behavior here on Meta that would make renewed scrutiny desirable.--The Devil's Advocate (talk) 00:48, 29 July 2019 (UTC)

What subsequent behavior? Neither Neotarf or the IP have edited in over a month. The other account has no edits here, and considering it was registered 4 years ago there is probably no checkuser data available on it. Further, CU's cannot publicly link an IP or account. I don't see what caused this request or what, if any, legitimate reason there is for a metawiki checkuser to check Neotarf. Regards, Vermont (talk) 01:25, 29 July 2019 (UTC)

The request is based on what happened a month ago, but that behavior did come after the last check. No doubt there can be Checkuser information obtained on Rivselis from English Wikipedia. As far as the IP, Neotarf has claimed to be using that IP already. I am only asking to verify if it is a regular IP or a proxy, which a Checkuser may be better able to determine. Pretty sure I explained the legitimate reason for the check in my initial statement.--The Devil's Advocate (talk) 14:40, 29 July 2019 (UTC)

I'm not sure why you think a CheckUser would be better able to discern whether the IP is a proxy. If that is the only point of this, I can tell you with a high degree of certainty that the listed IP is a proxy. Vermont (talk) 15:35, 29 July 2019 (UTC)

That is not the only point, but I imagine a Checkuser can better discern it if they can see other details about who is using an IP address. If you are only going to comment here to try and inexplicably pick at this for some kind of weakpoint, then it is better you stop and let a Checkuser handle the request. As I said, there is data on English Wikipedia and it is more recent than the data from the last check with Neotarf also being active here since then and allowing for additional information from that account to check. One way or another, I trust a Checkuser can find if the new activity can reveal any data that better refines the previous result and make a determination as to whether Neotarf's behavior here on Meta warrants any action.--The Devil's Advocate (talk) 17:17, 29 July 2019 (UTC)

I will note that using open proxies is not against any policy or rule. (edit made using an open proxy) Vermont (talk) 22:04, 28 July 2019 (UTC)

Of course, which is why I said "in this way" as opposed to in any way at all. There are legitimate uses of open proxies. Seeking to falsely discredit another user's actions is not one of them.--The Devil's Advocate (talk) 22:20, 28 July 2019 (UTC)

Declined - The block and disruptive use of socks happened on enwiki. If enwiki CheckUsers want to cross-check data then they can always ask. Having looked at the behavioural evidence and technical data, I am satisfied with the "likely" conclusion and don't think that this new open proxy detracts from it. – Ajraddatz (talk) 19:54, 29 July 2019 (UTC)

Not sure this is really addressing my request unless you are saying you re-examined the data following this request. The issue involved conduct here by Neotarf on Meta after the last check. What happened on English Wikipedia is only relevant in that Neotarf's conduct here was related to that block. Would more recent activity by the account not reveal anything new? To clarify on the IP, are you saying that you reviewed it and determined it was a proxy IP?--The Devil's Advocate (talk) 21:01, 29 July 2019 (UTC)

I am saying that further checks would not be useful, and declining as such. – Ajraddatz (talk) 21:59, 29 July 2019 (UTC)

Meta:Requests for CheckUser information

Requests for Meta-Wiki onlyEdit

NeotarfEdit

See alsoEdit