Steward requests/Checkuser/2018-02
Please do not post any new comments on this page. This is a discussion archive first created in February 2018, although the comments contained were likely posted before and after this date. See current discussion. |
Requests
Onpuryvgr@meta.wikimedia
- List of users
- Myeuurn (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
- Baka Líte (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
- 66.160.128.0/18 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
- 72.0.0.0/6 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
- 204.246.56.71 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
- 151.18.0.0/16 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
- 151.34.0.0/13 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
- 151.65.0.0/14 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
- 151.82.0.0/16 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
- 195.206.3.188 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): Please, stweards, read all I've explained below in order to let you understand clearly. I'm opening a new request using my registered account and following instructions as well as possible. It's about a cross-wiki vandal (bs ca da el en es et fi fr hr hu it la lt pl pt sl sq sv tl tr). I'm 100% sure it's one person, it's sufficient and necessary just the overwhelming evidence. The 3 accounts (Onpuryvgr, Myeuurn & Baka Líte) are sock puppets; the first 2 IP ranges and the next IP are known US open proxies (AS6939 HURRICANE - Hurricane Electric, Inc., US); the other IP ranges and the last IP are from Northern Italy. In some wikis the proxies have been partially blocked (a few examples here) and probably that's why lately the user has started using socks and normal IPs. IP range 72.0.0.0/6 is actually an over-range concerning ranges 72.52.64.0/18 and 74.82.0.0/18, likewise IP range 151.34.0.0/13 concerns ranges 151.34.0.0/16, 151.36.0.0/16 and 151.38.0.0/16, and IP range 151.65.0.0/14 concerns ranges 151.65.0.0/16 and 151.68.0.0/16: I had to widen such ranges because a maximum of 10 users is allowed here (you can find in my talk page the full list of the IPs, belonging to these ranges and attributable to him, that I was able to find out). Both using open proxies and using sock puppets like this are against Wikipedian policies, but this user has also made inappropriate or even disruptive edits (some examples: removing section title - removing content - same as above - deforming content - deforming content - disrupting a wikiling - misrepresenting sources - same). The pages this user edits aren't edited that often, and it's strange that different IPs and accounts have suddently started editing them so often since last december, and in that cross-wiki way too. You might have noticed that this user is literally obsessed with final accents in Italian names and most of his edits are about that (in the case of Bertè/Berté both accents are considered correct (see) and you can find hundreds of thousands results for both on Google) so either he's sure to be the one right or he knows he isn't but keeps on anyway. All you have to do now is to check whether one or more of these IP ranges have been used by one or more of these accounts or not, and I hope that, if it'll be proved that it's like that, you'll take measures against this proxy user and sock abuser even when he uses regular IPs. In the following box I'll point out the analogy of some edits, done by different ranges and accounts, by providing lots of differences between revisions and comparing them to each others: in some cases it's so evident that you may find it even funny.
Examples of differences between revisions
|
---|
As you see, the edits are identical, or very similar, and in the same pages of different wikis. I could have added lots more but it would have been useless, if you wish you can watch them by yourself checking the global contributions of the IPs I've listed in my talk page. Now the most funny fact arrives: this proves the sockmaster's identity, a registered user from Northern Italy whom I suspected to be the user behind all this even if I didn't include him in the request. Have a look:
Who are these users? 151.68.133.185 is one of the dynamic IPs included in the request obsessed with final accents in Italian names (please watch his global contributions). 195.206.3.188 is a static IP from the province of Brescia (where Ninonino lives) which was used to edit mostly pages of lmo.wikipedia or about Lombardy (often the same pages Ninonino edited in the past) but also to change final accents in Italian names (*cough*) (please watch his global contributions). This is what I think has happened: in that talk page he has written a message without controlling what his IP was, as soon as he realised that IP was compromising has deleted it, then he had to change net to write the message again with one of the usual IPs he's been using lately. Probably the static IP and the dynamic IPs are respectively from home and office or viceversa, but with such a carelessness he got unmasked by himself, even a child would realise it. The fact that he wanted to cancel his edit from IP 195.206.3.188 and write it with a different IP means that he didn't want IP 195.206.3.188 to appear in that talk page (unluckily for him it still appears in the page history). And why didn't he want it to appear? Because he didn't want IP 195.206.3.188 to be connected to the other IPs, proxies and socks! Why? Because 195.206.3.188 was the IP he's used lots of times as Ninonino! I told you it would be funny... :-) Well, I'm not requesting it right now, but after this request is done I'll request a check on Ninonino: the fact that such an old Wikipedian, with important roles in lmo.wiki, had the behaviour I've described before in order to deceive other users, is shameful and dishonourable, and if he really had thought he was doing good he wouldn't have used such methods to do it: I'm afraid he knew he was wrong and had to wear a mask so that nobody would realise that the user behind all this was him. If only he didn't make DAT error... |
- Comment. None of these registered users have been blocked on any Wikimedia project so far. I am wondering what we should do here, but I can't think of anything else apart from blocking three proxy IP ranges or so. Furthermore, I see no grounds for checking the aforementioned IP ranges against a particular user atm. RadiX∞ 21:42, 28 January 2018 (UTC)
- I didn't think that one of the prior conditions for a request was that one or more of the accounts must have been blocked in a wiki. I'm requiring a check to verify that they have to be: the edits I've shown (some of the which were unequivocally inappropriate or disruptive, the others at least useless) were identical edited by proxies, accounts and IP ranges from Northern Italy; proxies and socks are also forbidden in this project; if a steward verifies the connection among each others, it'll be the prove that one user is the vandal behind all this. No need to declare publicly which single IPs have been used by each single account: if just each account have been using one or more of these IP ranges (both proxies and normal, which are related to each others because of their identical edits), then this will be a long term abuse, so that not just proxies but also accounts (socks) and the IP ranges used by the socks will be blocked, am I right? Jatharinan (talk) 10:24, 29 January 2018 (UTC)
- Using sockpuppets is not forbidden, abusing them is. But currently I see no proof for such abuse. Or am I missing something? Trijnsteltalk 01:50, 2 February 2018 (UTC)
- @Trijnstel: I do know that "abusing", not "using", sockpuppets is forbidden. The thing I don't know is which one of these legitimate uses was done of the listed sockpuppets. All I see is that Baka Líte, Myeuurn and Onpuryvgr were used in different wikis to restore the same edits made by proxies (see here, or here and here, or here and here, or here) and, "coincidentally", these socks were created after some of these proxies were blocked in some wikis and their edits reverted... Connect the dots. The sockmaster in these cases stopped using proxies and started using sockpuppets, in order not to be identified. Is this a legitimate use of sockpuppets? I hope I didn't miss anything. By the way, sockpuppets aside, no use of open proxies is allowed, at all. On my experience, usually, when a user edits from a proxy which is recognised as proxy by a sysop, the IP or IP range he's used is immediately blocked in the whole project, and the eventual accounts which made similar edits from that proxy are blocked "with an expiration time of indefinite", and their edits reverted. Can you tell me how is it possible, after all the proves I've brought here during the last month, that none of these actions has been taken yet, and it also seems to me that sysops are even looking for loopholes to avoid blocking this cross-wiki vandal? Is there something I don't know but sysops do know about this story? Jatharinan (talk) 9:11, 2 February 2018 (UTC)
- I am wondering whether these accounts have been used abusively on local projects. The user mentioned at my talk page that local checkusers have managed to draw some conclusion based on it, but I still see no evidence of that. @Jatharinan: Would you please provide us with the necessary information? (links and/or diffs for local CU results). Thanks. RadiX∞ 01:58, 2 February 2018 (UTC)
- I will. First, read my reply to Trijnstel just over here. After that, I'll give you all the information you need. Jatharinan (talk) 9:11, 2 February 2018 (UTC) P.S. I have absolutely NO idea why my account was blocked by an Italian sysop, he must have thought I was another person who vandalised Italian wiki with an IP belonging to my range.
- Using sockpuppets is not forbidden, abusing them is. But currently I see no proof for such abuse. Or am I missing something? Trijnsteltalk 01:50, 2 February 2018 (UTC)
- I didn't think that one of the prior conditions for a request was that one or more of the accounts must have been blocked in a wiki. I'm requiring a check to verify that they have to be: the edits I've shown (some of the which were unequivocally inappropriate or disruptive, the others at least useless) were identical edited by proxies, accounts and IP ranges from Northern Italy; proxies and socks are also forbidden in this project; if a steward verifies the connection among each others, it'll be the prove that one user is the vandal behind all this. No need to declare publicly which single IPs have been used by each single account: if just each account have been using one or more of these IP ranges (both proxies and normal, which are related to each others because of their identical edits), then this will be a long term abuse, so that not just proxies but also accounts (socks) and the IP ranges used by the socks will be blocked, am I right? Jatharinan (talk) 10:24, 29 January 2018 (UTC)
Yalakumwiang1@th.wikipedia
- List of users
- Yalakumwiang1 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
- 223.205.130.30 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
- 223.205.132.149 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
- 49.48.140.86 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
- 49.48.143.165 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
- 182.232.105.79 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
- 49.48.143.165 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
- 49.48.240.65 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
- 49.48.147.195 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
- 49.48.133.74 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
- Not done We do not match accounts to IP addresses. Ruslik (talk) 18:24, 31 January 2018 (UTC)
Bodybuilder1991@en.wikiversity
- List of users
- Bodybuilder1991 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
- Liftingthe (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
- Storyfellow (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
- MrRowser (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
- The_Aiki (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
- Tumbleman_2018 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
- The_23canaries (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
- El_Badboy! (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
- Kujilia (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): *Bodybuilder1991 already confirmed as Sci-fi/Michaelskater, connected with the Anglo Pyramidologist (AP) sock farm, Liftingthe admits being Bodybuilder1991, and see recent checkuser for (Storyfellow et al). MrRowser was a very weak suspect previously but from recent activity was clearly AP. The next three are disruptive impersonation socks, a known AP behavior, impersonating a known AP target. The last two are suspicion based on recent editing, was fast with news of high AP interest (created by him), which may be a coincidence.
- Two brothers are actually behind the sock family, recently admitted, but they live not far from each other, sometimes sharing IP address, and are often involved with each other's issues. Open proxies are sometimes used.
- I have IP evidence I am sending by email to the stewards list for privacy reasons. Thanks. Abd (talk) 01:15, 1 February 2018 (UTC)
Bibëri@sq.wikipedia
- List of users
- Bibëri (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
- Hatake (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Swzam@zh-classical.wikipedia
- List of users
- Swzam (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
- 1tsmlne (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
- Itsyours (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
- Koosnaem (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
- Cakdoew (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
- Zhagzx (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
- Xojawedasiqwe (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
- 张云飞 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
- 簿名簿名簿名 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
- 张云飞 is Stale. All other accounts as well as Nimdeebuku are Confirmed. Ruslik (talk) 18:48, 21 February 2018 (UTC)
Ninonino@meta.wikimedia
- List of users
- Myeuurn (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
- Baka Líte (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): I am requesting stewards to check whether there is a connection between user "Ninonino" and one or both of the globally blocked accounts "Myeuurn" and "Baka Líte". These are two sockpuppets which were blocked together, another very likely sock is Fulgencio Kokomeci. It is proven that the person who used them has connected to proxies to log in and edit, one of the proxy IP ranges he used was 66.160.128.0/18, globally blocked together with the socks. Other IPs he may have used are dynamic IPs from ranges similar to 151.XX.0.0/16 and the static IP 195.206.3.188 which come from Italy. I am asking for this check to verify that the sockmaster is the Italian user Ninonino, I am going to show some differences between edits to clarify why I am sure he is the user behind the socks and the proxies.
- Myeuurn is 66.160.188.86
- Myeuurn is 151.34.69.186
- 151.34.19.233 is 66.160.178.43
- 151.68.133.185 is 195.206.3.188
- 151.82.52.48 is Ninonino
- 151.18.6.174 is Ninonino
- 195.206.3.188 is Ninonino's main IP: both the IP and the account's edits concern Italian accents over "e", Lombard dialect, places in Brescia province such as Concesio and Costorio, vegetal species, but overall Italian accents over "e", in particular about the comune of Portobuffolé with references to ISTAT (195.206.3.188 IS Ninonino)
In the light of this, I hope you will agree with me about the likelihood of this connection and that it is the case to at least give it a try and investigate: in case one of the IP or IP ranges that Ninonino used is shared with the globally blocked socks this suspect will be proven, while in case there is no connection it will be proven he is not guilty so he will not have to be suspected any more.
Tafareste (talk) 23:59, 25 February 2018 (UTC)Hatake@sq.wikipedia
- List of users
- Flladitja (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
- Ch'hilli (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
- Hatake (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Ronald Drooler@cs.wiktionary
- List of users
- Ronald Drooler (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
- Lenka64 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
- Danny B. (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
- Milda (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
- CU log
- Discussion: no local CU policy nor any special discussion regarding this case
Better translation: The rabble whose behaviour discouraged me from editing must be thwarted. --94.112.92.23 21:33, 26 February 2018 (UTC)
- @Kusurija:: you cannot alter others' requests. If you want to add more names you can make a new request or add more names with another template. I trust Martin Urbanec's requests while I don't second requests from involved parties like you. Because of your falsification of Martin Urbanec request I performed two useless checks.
- Unrelated but I'll share with Martin Urbanec my findings.
- --Vituzzu (talk) 22:59, 28 February 2018 (UTC)