Steward requests/Checkuser/2012-11



Status:    Done

These pattern spambots have been active on Outreach recently. Please consider investigating them to see if a block of their underlying IP can help resolve this problem. Thanks, Mathonius (talk) 07:14, 1 November 2012 (UTC)

Also related might be the following spambots on Incubator:

Mathonius (talk) 07:27, 1 November 2012 (UTC)

  Done - some obvious OPs gblocked. -- Mentifisto 09:16, 1 November 2012 (UTC)


Status:    Done

The last two are undoubtedly related, see [1]. These are all spambots. Please consider locking and investigating them. Thanks, Mathonius (talk) 08:03, 1 November 2012 (UTC)

  Done. Blocked and locked. They where related, together with MorganLise22. -- Tegel (Talk) 08:29, 1 November 2012 (UTC)


Status:    Done

Please consider investigating and locking. I hope that more hidden spambot accounts are locked, thanks! Sotiale (talk) 23:09, 1 November 2012 (UTC)

Both now locked. One underlying range already gblocked for a few days, the others are too dispersed. -- Avi (talk) 05:11, 2 November 2012 (UTC)


Status:    Done

Please consider investigating and locking these spambots. Thanks, Érico Wouters msg 18:21, 2 November 2012 (UTC)

  Locked and checked. Thanks for the report. Snowolf How can I help? 19:35, 2 November 2012 (UTC)

MahdiBot @si.wikipedia

The account has no bot flag. The issue was brought to the bot owner at his page. Please, continue the discussion there.‴ Teles «Talk ˱@ L C S˲» 08:13, 4 November 2012 (UTC)


Status:    Done

I believe these almost simultaneously created pattern accounts are probably spambots. Please consider investigating them. Mathonius (talk) 02:28, 14 November 2012 (UTC)

All confirmed and locked. Ruslik (talk) 14:07, 14 November 2012 (UTC)


Status:    Done


Are these spambots related to each other? Mathonius (talk) 21:21, 14 November 2012 (UTC)

Group 1: yep, definitely   Confirmed. All sockpuppets are blocked and locked now. No new socks found.
Group 2: confirmed as well. There were more related sockpuppets which were already locked by now. I locked the remaining. Trijnsteltalk 22:29, 14 November 2012 (UTC)

Mpb eu@bg.wikipedia

  Unrelated-Shizhao (talk) 12:28, 14 November 2012 (UTC)
Can you please double check, since that account in Wikimedia Commons has been blocked a month ago with an expiry time of indefinite with reason "Abusing multiple accounts: Sockpuppet of user {{u|Mpb eu}}". The communication pattern of both users seems to be identical. Thanks in advance. Spiritia 17:55, 14 November 2012 (UTC)
If this may help, please refer to the relevant discussion. Spiritia 18:47, 14 November 2012 (UTC)
Could you, please, check for other socks? The discussion Spiritia is quoting is quite convincing for me and inclines me to think that the user is using other socks as well. −PetaRZ (talk) 21:18, 14 November 2012 (UTC)
  Note: both accounts weren't checkusered on commons (I didn't do it either), thus the block doesn't necessarily confirms it. Trijnsteltalk 22:13, 14 November 2012 (UTC)
That's why I said I'm convinced, not that it has been confirmed  PetaRZ (talk) 23:10, 14 November 2012 (UTC)
Mpb eu not a global user--Shizhao (talk) 01:31, 15 November 2012 (UTC)
True, but the accounts were created on 10 and 11 November 2007 so I think they are from the same person. Trijnsteltalk 18:17, 15 November 2012 (UTC)
  Possible, but both user agent and IP different--Shizhao (talk) 01:57, 16 November 2012 (UTC)

CheckUser for suspected Sock puppetry - Help Required

Status:    Done

Hi Snowolf, I am Tahir Mahmood an Administrator on Urdu Wikipedia. We don't have a local CheckUser.

Can you please confirm the following as a Sock puppetry account of User:S.M.Samee (User has been blocked previously for the on English Wikipedia for the Same)

Reasons (Double Voting)

Voting for a project of S.M.Samee [2]

Specially this voting where he nominated himself (S.M.Samee) as as administrator, and (Sahlay - صالح) is arguing with other administrator for assigning him the administrator rights. [3]

--Tahir mq (talk) 11:26, 15 November 2012 (UTC)

  Confirmed Ruslik (talk) 11:26, 16 November 2012 (UTC)

Spambots on

Status:    Done

The first one is a typical Chinese spambot. The other two seem to be related to each other as suggested by autoblocks.--Jasper Deng (talk) 05:24, 17 November 2012 (UTC)

  Done --Bencmq (talk) 06:44, 17 November 2012 (UTC)


  Inconclusive seems to be a shared or recycled IP, and looks more like what we see for a university rDNS does not help). Many of the accounts mentioned have long history, and some of the accounts are very old so don't have CU data available. I don't believe that CU is particularly going to help on this occasion. The geo-location ip check doesn't locate to Nanjing, or even close. — billinghurst sDrewth 03:20, 18 November 2012 (UTC)


Please provide example diffs. — billinghurst sDrewth 13:10, 23 November 2012 (UTC)
One example: [4][5]. --MakecatTalk 08:09, 25 November 2012 (UTC)
Completely   Unrelated. — billinghurst sDrewth 11:52, 26 November 2012 (UTC)


  Not done I know that I won't be doing a CU for someone not registered on the wiki to which the request is being undertaken. Please have a kowiki sysop endorse this request for it to be reopened. Thanks. — billinghurst sDrewth 11:41, 26 November 2012 (UTC)

I`m registered User. at local wiki, there is existing to formation of checkusing consensus. So, i request again to checkusing.--Altostratus (talk) 15:29, 26 November 2012 (UTC)

  Done two users here, one is your long term vandal
  •   Confirmed same user — Koreabodyguard, Daiyan, Beautymissy, Missrok, Nabimi. Note that Excelruler is an old account and no data exists.
  •   Confirmed 욍로리 ... same user — Xingjiangao, Thechrishong, Bravebones, 남준우, Thebravebones, Kenia12, Kyeonkweon — billinghurst sDrewth 16:00, 26 November 2012‎ (UTC)


  •   Confirmed 정과 with previous problem child … previously blocked accounts 코리안파워 / Dragonwalk / Orora
  •   Possible JoJooYeon / Wallabsiu / Cheonhs / 내용있음 / D.Weaven — noting that they are accessing/editing from the same IP address, though different user agents, so quite possibly the IP address is shared by funnelled proxy, or gateway. I don't know enough about Korean ISPs, and their use of proxies to be able to advise. Due to the numbers and differences, I would recommend caution, and not to block these accounts without other confirmatory evidence.
  •   Unrelated 게이큐읭

To note that the records held by stewards for checkuser do not identify the original confirmed account with which to align this, so if your wiki has that information available it would be useful for our record keeping. — billinghurst sDrewth 16:46, 26 November 2012 (UTC)

For "possible" part, are those accounts possibly related to 정과?--NuvieK (talk) 18:28, 26 November 2012 (UTC)
I don't find any relation between 정과 or other confirmed accounts and the possibly related accounts. They might just use proxy server.--NuvieK (talk) 18:50, 26 November 2012 (UTC)

Obvious sockpuppetting on cswikiversity

Status:    Done

There is obvious sockpuppetting going on cswikiversity:

IP's of User:Michálek have been already globally blocked as open proxies. User:Docent Hlávka is obviously another sockpuppet.

Danny B. 14:00, 18 November 2012 (UTC)

  Done--Vituzzu (talk) 15:12, 18 November 2012 (UTC)

  Confirmed. The full list of socks:
Doreen Arul
Ruslik (talk) 18:38, 28 November 2012 (UTC)

Patternbots on Wikidata

  Confirmed All above accounts (as well as Millie14Millie1971) belong to the same person. However they are different from the well known spambot that operates on mediawiki and other wikis. Ruslik (talk) 19:24, 29 November 2012 (UTC)
On suspicion of them being patternbots (having been created in rapid succession), and in light of these, Wiki13 and I have locally blocked all of the accounts.--Jasper Deng (talk) 19:52, 29 November 2012 (UTC)