Steward requests/Checkuser/2016-07



Hello, I am bg:User:The TV Boy. I would like to add one more account to be checked: bg:user:The FM Boy, which is created especially to parody my username, used on bgwiki - The TV Boy. This harassment towards me continues for almost a month now and I would like to thank Luchesar for drawing attention to this problem. This vandal group originally spawned from the accounts bg:User:Модернатор (Modernator) and bg:User:Хейтър (Hater), after these accounts were blocked in 2011 the group halted for a while, but returned the previous month with direct attacks towards me, as well as other TV based articles, such as bg:Диема Спорт, bg:Диема, bg:Булсатком, bg:Хоум Бокс Офис, and others. I would really appreciate your help for the problem. Thanks in advance! --The Wiki Boy (talk) 22:47, 5 June 2016 (UTC)
I should probably add as a background info that the associated anonymous edits come so far from one specific ISP, Vivacom / Bulgarian Telecommunications Company, which is known for using DHCP with easily changeable addresses throughout their services: mobile and fixed. I've been thus forced to block entire network ranges to stop the persistent vandalism; the blocks are listed here (I also wouldn't be surprised if the vandal(s) pop up from another one -- this particular ISP has quite many -- as they had done previously). — Luchesar V. ILIEV • T/C 11:04, 6 June 2016 (UTC)
Hello, is there a reason why the check is delayed so much? There are couple more users with the same edit pattern as the listed above, but we need to see the results from the check in order to decide what to do next.--The Wiki Boy (talk) 19:58, 9 June 2016 (UTC)
We are all volunteers and this includes the checkusers. The check will be done when it's done. Also, I'd appreciate if you first share things about "couple more users" on our RfAA rather than here (unless you have very good reasons to add them directly to the request, which -- I agree here -- has been the case with User:The FM Boy). Let's really not complicate this any more than it's necessary. — Luchesar V. ILIEV • T/C 21:04, 9 June 2016 (UTC)
Added User:Stefan012345672 too. I'm afraid this really resembles very much the schizophrenic case from five years ago. Some of the puppets then presented themselves as mere "bystanders", yet were making suspiciously similar edits to the other socks; others were playing "vigilantes", mixing combating the vandalism of other socks with their own acts of vandalism; and there were even "the really good guys", who got caught only by the CU. It's exactly this "multiple personality disorder" on behalf of the socks that makes these cases so complicated: if they were pure vandals, we would've blocked them right away without any need for a CU. In the end, I'll probably block them all only on the basis of "reasonable suspicion", but any corroborating evidence from the CU would definitely be much appreciated. — Luchesar V. ILIEV • T/C 08:47, 10 June 2016 (UTC)
Added User:Dimitur12344. Pretty sure Plovdiv 10 [stalktoy] – [cross-wiki edits] is also involved, but their last edits are from almost an year ago, so not CU-able. The Wiki Boy, were these (Stefan012345672 and Dimitur12344) the two "other" users you had been referring to? — Luchesar V. ILIEV • T/C 09:01, 10 June 2016 (UTC)
And another two, although the one named "АдМинистратор" is to be blocked anyway only because of the name: "Administrator" in Bulgarian. This is yet another flashback of the previous case: the ring master, Модернатор, was a play on the word "moderator" in Bulgarian. — Luchesar V. ILIEV • T/C 09:13, 10 June 2016 (UTC)
The other two that I was referring to are Ivan1234567891011 (talk • contribs • block • xwiki-contribs • xwiki-date (alt) • CA • ST • lwcheckuser), and bg:User:АдМинистратор. Can't add the "Ivan" user account to the check board because it says "max 10 users". The "Ivan" account showed up the previous week. Plovdiv 10 (talk • contribs • block • xwiki-contribs • xwiki-date (alt) • CA • ST • lwcheckuser) also seems to be an incarnation of user "Plovdiv12". Also, as Luchesar pointed out the account "АдМинистратор" showed up, paralleling the name of bg:User:Администратор, who was blocked last year because the name literally means "Administrator". I am pretty sure that one and the same person stands behind those accounts.--The Wiki Boy (talk) 12:33, 10 June 2016 (UTC)
And one more pop-up Триъгълник (talk • contribs • block • xwiki-contribs • xwiki-date (alt) • CA • ST • lwcheckuser) (Triangle).--The Wiki Boy (talk) 13:39, 10 June 2016 (UTC)
Indeed, the same edit pattern. Thx. — Luchesar V. ILIEV • T/C 13:43, 10 June 2016 (UTC)

And yet one more: Виваком [stalktoy] – [cross-wiki edits]. This one bears the name of the involved ISP I mentioned earlier, Vivacom (Виваком in Bulgarian) / Bulgarian Telecommunications Company, and the user states on their page that the account is operated by Vivacom employees. The edit pattern however is the typical one for the group. — Luchesar V. ILIEV • T/C 17:18, 11 June 2016 (UTC)

Another one, Ivan001234567 [stalktoy] – [cross-wiki edits]. Pretty sure this one comes from a different IP, because the original IP–at least the one I suspect to be behind most of these accounts (not going to put it here for reasons of privacy)–apparently got caught by the autoblock: it has never missed a day without (mixed vandal/semi-productive/"vigilante") edits since May 1st, yet after I started blocking some of the suspected socks, it suddenly ceased editing. I'll wait a bit more and then will block it directly and indefinitely (or for a pretty long period). As a bonus, whoever is behind the IP has also already admitted in their own words to being behind User:The FM Boy. But while I already feel pretty confident about the extent of the vandal group and their IP ranges, I'll still very much appreciate any additional confirmation from a CU. I'll also be grateful for any suggestions on additional IP ranges to block (beside the ones already listed here), especially if they are suspected open proxies (of which we already have quite a bunch of networks blocked due to rather heavy vandalism from different sources recently). Many thanks in advance again. — Luchesar V. ILIEV • T/C 12:26, 12 June 2016 (UTC)
Feminism has again been vandalised in the very same way as it was the first time this case caught my attention. I suppose this might be a retaliation for the blocks that I started to impose on the suspected socks. The address is from a different network (obviously, as the original ones are still blocked), but from the same ISP. I wouldn't be surprised if the aforementioned User:Ivan001234567 comes from that very block too (though not from the same very address, because of the autoblock; but as mentioned earlier, this ISP is known for using DHCP, which is very easily abused for vandalism: with each reset, the cable/DSL modem picks up a different address from the pool). — Luchesar V. ILIEV • T/C 13:33, 12 June 2016 (UTC)
Yet one more, Ivan00123456 [stalktoy] – [cross-wiki edits], which is quite obviously a sock. This might come from the IP I mentioned earlier, because one of the autoblocks expired a minute before the account was created (and it may have been the one that caught it). Because the topic becomes pretty long, here's a table with all suspected accounts (I'll be updating it with any new ones):
— Luchesar V. ILIEV • T/C 18:08, 12 June 2016 (UTC)
So, the vandal behind those socks apparently became nervous and sloppy and tried—rather stupidly—to gain access to my (sysop) account. This of course revealed their IP address and it turned out to be the one I had already been strongly suspecting and which seemed affected by the autoblock that I mentioned earlier. Needless to say, the IP is now blocked indefinitely. I'm pretty sure they'll try to continue with their vandalism from other addresses though, and therefore I'd be grateful if you don't mind me keeping the case open here. It's quite probable that I'll need your assistance if the vandal decides to retaliate by a new wave of massive vandalism. Thanks.
— Luchesar V. ILIEV • T/C 15:24, 16 June 2016 (UTC)
The vandal behind this sock puppet group turned out to be with IP <deleted>, identifying himself as "TV-FEN". So far there is a probability that he might try avoiding the block using other IP, but if you can still check if there are any other sock puppets that this IP registered that yet don't have edits, but might be used for vandalism in the future.--The Wiki Boy (talk) 16:31, 16 June 2016 (UTC)
That's not necessary. The IP is prohibited from editing even through registered accounts and the other accounts can simply be blocked based on their edit pattern. I'm rather more interested in open proxies that the socks might've used or any other network ranges indeed, so I can possibly (depending on the collateral damage estimate) block them too. — Luchesar V. ILIEV • T/C 17:00, 16 June 2016 (UTC)
I've also removed the IP from your post. It's visible in other places (e.g. the diff I provided earlier), and I feel we shouldn't make it more public than absolutely necessary. Sorry about this.
— Luchesar V. ILIEV • T/C 17:14, 16 June 2016 (UTC)

моля за отблокиране на мобилната мрежата на Виваком в БГ Уикипедия, тъй като повече няма да правим лоши редакции в нея. За фиксираната мрежа -оставете я така,тъй като не правихме ние вандализмите там. Пишем тук, защото няма как да пишем на заявките към администраторите.

С уважение,

бивши вандали от мобилната мрежа на БТК. 06:52, 20 June 2016 (UTC)

  Confirmed list of locked accounts

-- masti <talk> 15:37, 24 June 2016 (UTC)

Outstanding! Thank you very much, indeed! — Luchesar V. ILIEV • T/C 17:25, 24 June 2016 (UTC)
masti, could you please check these too? Or are they not connected?
Cheers, — Luchesar V. ILIEV • T/C 19:34, 24 June 2016 (UTC)


Special:Contributions/MariittsaUNI|contr]] · [[
Special:DeletedContributions/MariittsaUNI|deleted]] · block · log · block log · CA · guc · checkuser · lwcheckuser)

--masti <talk> 14:22, 25 June 2016 (UTC)

I have locked and two other accounts simmilar to the pattern used above (The * Boy) by the confirmed accounts on the lists above. But unlocked the later as they are not the part of the sockpuppet group. masti <talk> 21:09, 28 June 2016 (UTC)


Two more. The second one may in fact be unrelated, but the intuition strongly tells me from the edit pattern that it is, even though the tactics has apparently been changed:

masti, when you have time for it, could you also please review the things that I wrote you about off-wiki. Thanks! — Luchesar V. ILIEV • T/C 13:22, 27 June 2016 (UTC)

Apparently, they're active again...

— Luchesar • T/C 18:31, 30 June 2016 (UTC)

This one may either belong to the group above, or be part of the PavelStaykov group, more precisely connected with the recent sock Dulovokil146 [stalktoy] – [cross-wiki edits] (en:w CU):

— Luchesar • T/C 11:12, 1 July 2016 (UTC)

P.S. A second one added. This seems like an indication that they are part of the current investigation after all, rather than the one from en:w that I mentioned above. — Luchesar • T/C 12:24, 1 July 2016 (UTC)

Graaf_Statler@nl.wikiquote (2)

I do not see any evidence for use of proxies. The user has connected either through a fixed ADSL line or a public wi-fi network. You can try to range block Ruslik (talk) 17:19, 8 July 2016 (UTC)

Some more cross wiki insulting accounts

Done; I found no other accounts. The data from the creation is already too old. --MF-W 20:03, 1 July 2016 (UTC)
Thanks. It was just an idea, the chance to find another ones was too small - the accounts that have been editing today were created a long time ago and activated just today; I am sure there are some more ones, but we can get them only when reactivated.
By the way, I suppose all accounts have been operated by one person - ? If yes: it wouldbe good to note the range for the case, the vandal will start his harassment and insulting again.
Thanks. -jkb- 20:31, 1 July 2016 (UTC)
Yes indeed. I noted down the IP (they all just used one). --MF-W 15:26, 2 July 2016 (UTC)
Wau! -jkb- 15:33, 2 July 2016 (UTC)


  Confirmed Ruslik (talk) 13:23, 7 July 2016 (UTC)


I confirm that Νικόλας Παπαποστόλου 3, Νικόλας Παπαποστόλου 2 and Θεσσαλονικάρα belong to the same person. However I found no evidence that they are related to Γιάννης 10 and their socks. Ruslik (talk) 17:34, 8 July 2016 (UTC)
He was confirmed by duck test. --C messier (talk) 09:48, 9 July 2016 (UTC)


This request is unreasonable.. Both users are super active and really old and well known to the communityAmir (talk) 20:56, 2 July 2016 (UTC)
But I sent many reasons in persian lang to @Mardetanha:! -- 04:32, 3 July 2016 (UTC)
  Not done We do not accept CU requests from unregistered users. Ruslik (talk) 17:07, 8 July 2016 (UTC)
@Ruslik0:Why not? I'm active user in lots of projects but i couldn't sign this request with my username! U can ask a question about this request from @Mardetanha: -- 10:11, 11 July 2016 (UTC)

Tikeem pees at Oracle Arena@enwikisource



  • Group 1: ThisAccountIsblocked and ThisAccountIsblocked1
  • Group 2: Tikeem pees at Oracle Arena and HurricaneFan26
  • Group 1 and Group 2   Likely/  Confirmed related.
  • You'll be sent an email.

MarcoAurelio 12:08, 9 July 2016 (UTC)


You can just block them. Why do you need CU information? Ruslik (talk) 11:11, 11 July 2016 (UTC)
Yep, but maybe there's some sleppers there? But I am not quite sure. --Stang 14:42, 11 July 2016 (UTC)
  Confirmed. Esiymbro, 华丽的转身 and Dict2016 are   Possible. Ruslik (talk) 09:42, 12 July 2016 (UTC)


  •   Confirmed 500ГОДИНИСТИГАТ = Утигур
  • Dulovokil146 is   Unrelated to the named above as far as I can see.
MarcoAurelio 10:16, 26 July 2016 (UTC)
Thank you very much, that was indeed very helpful! — Luchesar • T/C 10:57, 26 July 2016 (UTC)

Strong lookpla@th.wikipedia

  • Strong lookpla, A.R.M.Y TH, Special A.R.M.Y. TH and Special A.R.M.Y. TH2 are   Stale.
  • As for the others,   Confirmed OVERDOSE EX'ACT = EXODUS EX'Act = Hello I Am EXO-L TH
MarcoAurelio 10:39, 26 July 2016 (UTC)

ΣΕ ΘΕΛΩ@el.wikipedia

2021..με τα τσαρούχια! is a sock of Κακός και Κάκιστος / Εύχρηστο Σπιρτόκουτο. Ruslik (talk) 12:59, 27 July 2016 (UTC)


  Confirmed Ruslik (talk) 17:49, 29 July 2016 (UTC)
Thank you for your prompt response. --Pafsanias (talk) 18:35, 29 July 2016 (UTC)


Susanoo-no-mikoto, Vimrahij, Brindavijay03, Devmahatma and Jaswanth11 are   Stale. Tsukuyo-yomi and Rivanya_Shithi are   Confirmed to belong to the same user. Ruslik (talk) 17:50, 30 July 2016 (UTC)
Thanks for the quick action. --AntanO 18:39, 30 July 2016 (UTC)