Steward requests/Checkuser/2018-02

Please do not post any new comments on this page. This is a discussion archive first created in February 2018, although the comments contained were likely posted before and after this date. See current discussion.

Requests

Onpuryvgr@meta.wikimedia

Status: Not done

List of users: Myeuurn (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Baka Líte (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); 66.160.128.0/18 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); 72.0.0.0/6 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); 204.246.56.71 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); 151.18.0.0/16 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); 151.34.0.0/13 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); 151.65.0.0/14 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); 151.82.0.0/16 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); 195.206.3.188 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

CU log

Reason(s): Please, stweards, read all I've explained below in order to let you understand clearly. I'm opening a new request using my registered account and following instructions as well as possible. It's about a cross-wiki vandal (bs ca da el en es et fi fr hr hu it la lt pl pt sl sq sv tl tr). I'm 100% sure it's one person, it's sufficient and necessary just the overwhelming evidence. The 3 accounts (Onpuryvgr, Myeuurn & Baka Líte) are sock puppets; the first 2 IP ranges and the next IP are known US open proxies (AS6939 HURRICANE - Hurricane Electric, Inc., US); the other IP ranges and the last IP are from Northern Italy. In some wikis the proxies have been partially blocked (a few examples here) and probably that's why lately the user has started using socks and normal IPs. IP range 72.0.0.0/6 is actually an over-range concerning ranges 72.52.64.0/18 and 74.82.0.0/18, likewise IP range 151.34.0.0/13 concerns ranges 151.34.0.0/16, 151.36.0.0/16 and 151.38.0.0/16, and IP range 151.65.0.0/14 concerns ranges 151.65.0.0/16 and 151.68.0.0/16: I had to widen such ranges because a maximum of 10 users is allowed here (you can find in my talk page the full list of the IPs, belonging to these ranges and attributable to him, that I was able to find out). Both using open proxies and using sock puppets like this are against Wikipedian policies, but this user has also made inappropriate or even disruptive edits (some examples: removing section title - removing content - same as above - deforming content - deforming content - disrupting a wikiling - misrepresenting sources - same). The pages this user edits aren't edited that often, and it's strange that different IPs and accounts have suddently started editing them so often since last december, and in that cross-wiki way too. You might have noticed that this user is literally obsessed with final accents in Italian names and most of his edits are about that (in the case of Bertè/Berté both accents are considered correct (see) and you can find hundreds of thousands results for both on Google) so either he's sure to be the one right or he knows he isn't but keeps on anyway. All you have to do now is to check whether one or more of these IP ranges have been used by one or more of these accounts or not, and I hope that, if it'll be proved that it's like that, you'll take measures against this proxy user and sock abuser even when he uses regular IPs. In the following box I'll point out the analogy of some edits, done by different ranges and accounts, by providing lots of differences between revisions and comparing them to each others: in some cases it's so evident that you may find it even funny.

Examples of differences between revisions

As you see, the edits are identical, or very similar, and in the same pages of different wikis. I could have added lots more but it would have been useless, if you wish you can watch them by yourself checking the global contributions of the IPs I've listed in my talk page. Now the most funny fact arrives: this proves the sockmaster's identity, a registered user from Northern Italy whom I suspected to be the user behind all this even if I didn't include him in the request. Have a look:

Who are these users? 151.68.133.185 is one of the dynamic IPs included in the request obsessed with final accents in Italian names (please watch his global contributions). 195.206.3.188 is a static IP from the province of Brescia (where Ninonino lives) which was used to edit mostly pages of lmo.wikipedia or about Lombardy (often the same pages Ninonino edited in the past) but also to change final accents in Italian names (*cough*) (please watch his global contributions). This is what I think has happened: in that talk page he has written a message without controlling what his IP was, as soon as he realised that IP was compromising has deleted it, then he had to change net to write the message again with one of the usual IPs he's been using lately. Probably the static IP and the dynamic IPs are respectively from home and office or viceversa, but with such a carelessness he got unmasked by himself, even a child would realise it. The fact that he wanted to cancel his edit from IP 195.206.3.188 and write it with a different IP means that he didn't want IP 195.206.3.188 to appear in that talk page (unluckily for him it still appears in the page history). And why didn't he want it to appear? Because he didn't want IP 195.206.3.188 to be connected to the other IPs, proxies and socks! Why? Because 195.206.3.188 was the IP he's used lots of times as Ninonino! I told you it would be funny... :-) Well, I'm not requesting it right now, but after this request is done I'll request a check on Ninonino: the fact that such an old Wikipedian, with important roles in lmo.wiki, had the behaviour I've described before in order to deceive other users, is shameful and dishonourable, and if he really had thought he was doing good he wouldn't have used such methods to do it: I'm afraid he knew he was wrong and had to wear a mask so that nobody would realise that the user behind all this was him. If only he didn't make DAT error...

Jatharinan (talk) 11:31, 24 January 2018 (UTC)

Comment. None of these registered users have been blocked on any Wikimedia project so far. I am wondering what we should do here, but I can't think of anything else apart from blocking three proxy IP ranges or so. Furthermore, I see no grounds for checking the aforementioned IP ranges against a particular user atm. RadiX ∞ 21:42, 28 January 2018 (UTC)
I didn't think that one of the prior conditions for a request was that one or more of the accounts must have been blocked in a wiki. I'm requiring a check to verify that they have to be: the edits I've shown (some of the which were unequivocally inappropriate or disruptive, the others at least useless) were identical edited by proxies, accounts and IP ranges from Northern Italy; proxies and socks are also forbidden in this project; if a steward verifies the connection among each others, it'll be the prove that one user is the vandal behind all this. No need to declare publicly which single IPs have been used by each single account: if just each account have been using one or more of these IP ranges (both proxies and normal, which are related to each others because of their identical edits), then this will be a long term abuse, so that not just proxies but also accounts (socks) and the IP ranges used by the socks will be blocked, am I right? Jatharinan (talk) 10:24, 29 January 2018 (UTC)
Using sockpuppets is not forbidden, abusing them is. But currently I see no proof for such abuse. Or am I missing something? Trijnstel_talk 01:50, 2 February 2018 (UTC)
@Trijnstel: I do know that "abusing", not "using", sockpuppets is forbidden. The thing I don't know is which one of these legitimate uses was done of the listed sockpuppets. All I see is that Baka Líte, Myeuurn and Onpuryvgr were used in different wikis to restore the same edits made by proxies (see here, or here and here, or here and here, or here) and, "coincidentally", these socks were created after some of these proxies were blocked in some wikis and their edits reverted... Connect the dots. The sockmaster in these cases stopped using proxies and started using sockpuppets, in order not to be identified. Is this a legitimate use of sockpuppets? I hope I didn't miss anything. By the way, sockpuppets aside, no use of open proxies is allowed, at all. On my experience, usually, when a user edits from a proxy which is recognised as proxy by a sysop, the IP or IP range he's used is immediately blocked in the whole project, and the eventual accounts which made similar edits from that proxy are blocked "with an expiration time of indefinite", and their edits reverted. Can you tell me how is it possible, after all the proves I've brought here during the last month, that none of these actions has been taken yet, and it also seems to me that sysops are even looking for loopholes to avoid blocking this cross-wiki vandal? Is there something I don't know but sysops do know about this story? Jatharinan (talk) 9:11, 2 February 2018 (UTC)

I am wondering whether these accounts have been used abusively on local projects. The user mentioned at my talk page that local checkusers have managed to draw some conclusion based on it, but I still see no evidence of that. @Jatharinan: Would you please provide us with the necessary information? (links and/or diffs for local CU results). Thanks. RadiX ∞ 01:58, 2 February 2018 (UTC)
I will. First, read my reply to Trijnstel just over here. After that, I'll give you all the information you need. Jatharinan (talk) 9:11, 2 February 2018 (UTC) P.S. I have absolutely NO idea why my account was blocked by an Italian sysop, he must have thought I was another person who vandalised Italian wiki with an IP belonging to my range.

Not done reporting user is a troll who I'm starting reverting and (b)locking on sight. --Vituzzu (talk) 08:51, 2 February 2018 (UTC)

Yalakumwiang1@th.wikipedia

Status: Not done

List of users: Yalakumwiang1 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); 223.205.130.30 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); 223.205.132.149 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); 49.48.140.86 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); 49.48.143.165 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); 182.232.105.79 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); 49.48.143.165 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); 49.48.240.65 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); 49.48.147.195 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); 49.48.133.74 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

CU log

Reason(s): The user has vandalized Thai Wikipedia by mass page creation. Some of the pages are nonsense, and some are copy-pasting. Using the admin tool in the local wiki, I keep mass deleting and blocking, but the user keep comes up with another IP. So it would be beneficial to confirm that all of these user are the same person, so that measures can be discussed. Thank you. Horus (talk) 12:20, 31 January 2018 (UTC)

Not done We do not match accounts to IP addresses. Ruslik (talk) 18:24, 31 January 2018 (UTC)

@Ruslik0: How can you verify that IPs are actually connected to a user account? If not, can you suggest how to stop such abuse? --Horus (talk) 11:06, 1 February 2018 (UTC)

@Horus: Can't you create abuse filters and/or block IP ranges? Trijnstel_talk 01:51, 2 February 2018 (UTC)

Thanks for the idea. --Horus (talk) 04:36, 2 February 2018 (UTC)

Bodybuilder1991@en.wikiversity

Status: Not done

List of users: Bodybuilder1991 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Liftingthe (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Storyfellow (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); MrRowser (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); The_Aiki (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Tumbleman_2018 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); The_23canaries (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); El_Badboy! (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Kujilia (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

CU log

Reason(s): *Bodybuilder1991 already confirmed as Sci-fi/Michaelskater, connected with the Anglo Pyramidologist (AP) sock farm, Liftingthe admits being Bodybuilder1991, and see recent checkuser for (Storyfellow et al). MrRowser was a very weak suspect previously but from recent activity was clearly AP. The next three are disruptive impersonation socks, a known AP behavior, impersonating a known AP target. The last two are suspicion based on recent editing, was fast with news of high AP interest (created by him), which may be a coincidence.

Two brothers are actually behind the sock family, recently admitted, but they live not far from each other, sometimes sharing IP address, and are often involved with each other's issues. Open proxies are sometimes used.
I have IP evidence I am sending by email to the stewards list for privacy reasons. Thanks. Abd (talk) 01:15, 1 February 2018 (UTC)

Bibëri@sq.wikipedia

Status: Done

List of users: Bibëri (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Hatake (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

CU log

Reason(s): We have strong evidence to believe that Biberi is a sock of Hatake. They offended the blocking admin and in their first two days of editing they edited 15 articles that Hatake had edited, with editing skills of an experienced user. See also this report: [6]. Olsi (talk) 10:50, 10 February 2018 (UTC)

Confirmed as well as Joana poci and Fukingusername. Ruslik (talk) 19:57, 10 February 2018 (UTC)

@Ruslik0: Can you please complete my CU test because user Τζερόνυμο is using his "suspicions" to delete all my contributions. ΕρΚιλλ (talk) 16:15, 11 February 2018 (UTC)

Swzam@zh-classical.wikipedia

Status: Done

List of users: Swzam (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); 1tsmlne (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Itsyours (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Koosnaem (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Cakdoew (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Zhagzx (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Xojawedasiqwe (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); 张云飞 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); 簿名簿名簿名 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

CU log

Reason(s): After Swzam has been banned by me for three minutes, 1tsmlne, Itsyours, Koosnaem, Cakdoew and Zhagzx was created. Swzam's editing behavior and Xojawedasiqwe's editing behavior is simlar as 张云飞 and 簿名簿名簿名. WAN233 (talk) 05:14, 21 February 2018 (UTC)

张云飞 is

Stale. All other accounts as well as Nimdeebuku are

Confirmed. Ruslik (talk) 18:48, 21 February 2018 (UTC)

According to archives, should he be 小曹2015 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)? --WAN233 (talk) 00:49, 22 February 2018 (UTC)

Ninonino@meta.wikimedia

Status: Not done

List of users: Myeuurn (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Baka Líte (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

CU log

Reason(s): I am requesting stewards to check whether there is a connection between user "Ninonino" and one or both of the globally blocked accounts "Myeuurn" and "Baka Líte". These are two sockpuppets which were blocked together, another very likely sock is Fulgencio Kokomeci. It is proven that the person who used them has connected to proxies to log in and edit, one of the proxy IP ranges he used was 66.160.128.0/18, globally blocked together with the socks. Other IPs he may have used are dynamic IPs from ranges similar to 151.XX.0.0/16 and the static IP 195.206.3.188 which come from Italy. I am asking for this check to verify that the sockmaster is the Italian user Ninonino, I am going to show some differences between edits to clarify why I am sure he is the user behind the socks and the proxies.

Myeuurn is 66.160.188.86
Myeuurn is 151.34.69.186
151.34.19.233 is 66.160.178.43
151.68.133.185 is 195.206.3.188
151.82.52.48 is Ninonino
151.18.6.174 is Ninonino
195.206.3.188 is Ninonino's main IP: both the IP and the account's edits concern Italian accents over "e", Lombard dialect, places in Brescia province such as Concesio and Costorio, vegetal species, but overall Italian accents over "e", in particular about the comune of Portobuffolé with references to ISTAT (195.206.3.188 IS Ninonino)

In the light of this, I hope you will agree with me about the likelihood of this connection and that it is the case to at least give it a try and investigate: in case one of the IP or IP ranges that Ninonino used is shared with the globally blocked socks this suspect will be proven, while in case there is no connection it will be proven he is not guilty so he will not have to be suspected any more.

Tafareste (talk) 23:59, 25 February 2018 (UTC)

Not done meta has own checkusers. Ruslik (talk) 19:51, 27 February 2018 (UTC)

Hatake@sq.wikipedia

Status: Done

List of users: Flladitja (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Ch'hilli (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Hatake (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

CU log

Reason(s): User:Hatake (master) is a prolific sock creator in the Albanian wikipedia (sqwiki). As soon as he was banned with community decision, he socked under user:Perralla and user:Hormova. Once those two accounts were blocked (in the last two weeks), because of checkuser request here in Meta, two more accounts have been used, which I believe are socks as well (Flladitja and Ch'hilli): Both of the accounts seem to be really advanced with wikiscript in their first days of edits, and both heavily edit Hatake's articles (see report where each one of them, even though is less than 1 week old, is on at least 20 articles, edited by Hatake). Thank you in advance for your time. --1l2l3k (talk) 20:37, 26 February 2018 (UTC)

Confirmed Ruslik (talk) 19:56, 27 February 2018 (UTC)

Ronald Drooler@cs.wiktionary

Status: Done

List of users: Ronald Drooler (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Lenka64 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Danny B. (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Milda (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

CU log
Discussion: no local CU policy nor any special discussion regarding this case

Reason(s): Hello stewards, user Ronald Drooler at cs.wiktionary has very strange activity - firstly creating exact minimum edits for voting there, then voting in two sysop elections. I suspect that voting policy has been violated as this policy says one person can vote with one account only, as well as minimal number of edits to be able to vote. The user has only one checkable edit (as far as I can see without sysop rights), see [7]. Also see very strage reasonage for voting agains the candidate (proti in Czech): quotation: "Je třeba bránit místní lůze, jejíž chování mě odpudilo od dalšího přispívání", translation: "It is necessary to prevent the local rabble whose behaviour stopped me from editing". If he does not edit anymore (as he "stopped"), how come he knows about the voting? I suspect Lenka64 from sockpuppeting because she is a long time problematic user at Czech projects (Czech Wikipedia Arbitration Comittee accepted a remedy that explicitely banned her from being unpolite, see the case and also voted agains the candidate. If anything more is needed for this request, or you need to understand something Czech, I'd be happy to edit my request to address your neeeds. Please ping me in your reactions, so I will notice something happened here. Best, Martin Urbanec (talk) 18:17, 25 February 2018 (UTC) Sorry, I don't think it's sockpuppet of Lenka64, rather sockpuppet of these editors, who did not vote yet, but would like to vote more anonymously (maybe Danny B. or Milda). --Kusurija (talk) 15:06, 26 February 2018 (UTC)

Better translation: The rabble whose behaviour discouraged me from editing must be thwarted. --94.112.92.23 21:33, 26 February 2018 (UTC)

@Kusurija:: you cannot alter others' requests. If you want to add more names you can make a new request or add more names with another template. I trust Martin Urbanec's requests while I don't second requests from involved parties like you. Because of your falsification of Martin Urbanec request I performed two useless checks.

Unrelated but I'll share with Martin Urbanec my findings.

--Vituzzu (talk) 22:59, 28 February 2018 (UTC)