Steward requests/Checkuser/2016-11



  Done Will see what we can find. --Jyothis (talk) 22:55, 13 September 2016 (UTC)

@Jyothis:   Progress report?MarcoAurelio 10:34, 24 September 2016 (UTC)
@Jyothis: Hello? I don't think you're handling this, right? —MarcoAurelio 13:47, 30 September 2016 (UTC)
Sorry about that - got caught up at work :( - I did half way and that was inconclusive. Let me re-start. --Jyothis (talk) 00:15, 12 October 2016 (UTC)
Still going through this. done with one part and doing the other. --Jyothis (talk) 14:43, 20 October 2016 (UTC)
Jyothis, thanks for not giving up on this case. I suspect that some of those may be meatpuppets (e.g. Тамаш Йеньо Секереш, which is the name of a different person, though still very closely related with the sockmaster), which makes an additional mess as the sockmaster is already likely using lots of proxies and might even know even better how to clear his tracks. On a side note, we're very close to electing local CUs, so we may finally ease a little bit the burden on you, guys (from conversations with other stewards I see that the socks get more and more knowledgeable and thus difficult to identify purely on technical grounds, especially without knowing much of the context).
— Luchesar • T/C 15:08, 20 October 2016 (UTC)
Yea I get that, but the issue is that it is pretty hard from a purely technical stand point and so far the checks has been inconclusive. I am trying to correlate as much as I can, but don't keep too much hope :) --Jyothis (talk) 00:46, 24 October 2016 (UTC)
Much appreciated, Jyothis! Take your time. — Luchesar • T/C 00:51, 24 October 2016 (UTC)

It appears that Eu Mpb Eu may be related to the existing blocked accounts. There are also a good number of IP based edits that goes with this set, but not planning to put that here.

  • Commons iliev
  • Iliev~bgwiki
  • Pavel Staykov 94
  • Патриотите
  • Станков Павел
  • Един Патриот
  • Bulgarieca
  • Мико Ибрикчиев
  • Ибрикчийско Конче
  • Джингиби2
  • Манаса ВодноКонче
  • Манафа Мико
  • Bulgariec
  • Мико Манафа

For the rest, I will leave it as   Inconclusive, as I have not seen compelling evidence that it is related, but someone who has more local knowledge and context on how this played out can review the list above and see if you can make further connections. Please let me know if you have any questions - I have marked the request as done, but do feel free to ping if you need additional info.

Also, thank you very much for being patient here--Jyothis (talk) 01:09, 31 October 2016 (UTC)

Jyothis, that's outstanding. Those accounts belong to a puppeteer who's been bugging us for years. At some point I did realize he had begun to impersonate another puppeteer "for the lulz", but Eu Mpb Eu is a surprise even to me. Then again, I've long also suspected that the guy might've been surreptitiously creating sleeper accounts, though when I shared this suspicion with my colleagues, their reaction was "eh, you've watched too many movies lately". :)) So, I think I owe you a beer if we happen to meet at a Wikimania or otherwise -- and the same of course goes for a few other stewards as well, who've helped in the past. Many thanks again, indeed!
P.S. May I contact you privately on IRC regarding possible IP ranges to block if the puppeteer becomes active again soon?
— Luchesar • T/C 04:37, 31 October 2016 (UTC)

Our playful vandal continues, this time in sister projects: in Bulgarian Wikisource as s:User:Чекюзър (cyrillic trasliteration of "Checkuser") and s:User:Бюрократът (cyr. transl. of "The Bureaucrat"), as well as in Commons as User:Илиев ибрикчиев (similar to those above). Spiritia 05:27, 1 November 2016 (UTC)

Luchesar - Sure. --Jyothis (talk) 11:55, 1 November 2016 (UTC)

Xwiki promotional spambots

Status:    Not done

We have have an absolute spambot bonanza of xwiki (attempted) spam for promotional codes and vouchers (visible inSpecial:AbuseLog). I have taken moves to blacklist the majority of the urls and I have COIBot monitoring others that are secondary. Have we undertaken some CU to identify the ranges and put some blocks in place? If not, can we please run a series of checks to better curb this in a proactive manner. Thanks.  — billinghurst sDrewth 09:24, 2 October 2016 (UTC)

What wiki are you talking about? Ruslik (talk) 20:20, 3 October 2016 (UTC)
  Not done Ruslik (talk) 17:54, 13 November 2016 (UTC)


KANENAS and TheDesertFox are   Likely the same user. IwannisE is   Unrelated. Ruslik (talk) 18:10, 13 November 2016 (UTC)


  Declined and   Deferred to pt:Wikipédia:Pedidos a verificadores Portuguese Wikipedia has local checkusers. If you can't edit that page, try posting on the talk page or ask any user of pt:Special:ListUsers/checkuser to know what to do in this case. —MarcoAurelio 19:06, 25 November 2016 (UTC)


  Done, Positive match for Devin-Henrickson and Armyboy2. Digital Sofware Development matches too. Linedwell (talk) 09:33, 27 November 2016 (UTC)