Wikinews:Requests for CheckUser

Shortcut:
WN:RFCU
WN:CU

This is the place to request sockpuppet checks or other investigations requiring CheckUser privileges by people with those privileges.

Operating Guidelines

Copied in part from Wikipedia's CheckUser -- this seems like a good CheckUser policy to begin with.

Introduction

CheckUser is an additional right that is granted to a small number of administrators. It is a delegation of a developer right that gives limited access to server logs of edits. Uses include identification of sockpuppets, block evasion, and use of open proxies. All usage of the privilege is logged and results may be shared with other projects via the private checkuser-l mailing list. The mailing list is covered by the Foundation's privacy policy, and checks may be executed as a result of reports from other wikis where vandalism or other disruption has occurred.

Caveats

1. Due to the effort involved, difficulty of interpretation of results and privacy issues raised, checkuser is a last resort for difficult cases. Use other methods first.
2. Obvious sock puppets may be treated as such without using checkuser.
3. Please do not list cases involving non-disruptive "throwaway" accounts that are only used for a few edits.
4. Data is kept for a limited time so we cannot compare against accounts that have not edited recently.

1. Block evasion: may be listed where the problem is ongoing.
2. Routine 3RR violations: do not list unless there is (a) an ongoing problem (b) reasonable doubt as to whether or not sock puppets are being used, and (c) disruption of editing that can't be addressed any other way.
3. Vandalism: only for ongoing serious vandalism.
4. Vote fraud: only where (a) there is reasonable doubt as to whether or not the votes are valid (b) the vote or discussion period has closed, and (c) the possible sockpuppet votes actually affect the outcome of a decision. Provide a link to the closed vote and discussion.

Procedure

• List your request in this section.
• Clearly indicate the usernames or IP addresses you suspect. This is not the place to post long disputes over the merits of the check. If a compact, reasonable request, with the necessary diffs, cannot be made, then post it on WN:ALERT.
• Use *{{Checkuser|USERNAME TO BE CHECKED}}
• You must clearly lay out the evidence for sockpuppetry.
• You must explain how your request fits the policy above.
• Sign your request.

Outcome

• Responses will be cursory in nature in order to comply with Wikimedia privacy policy; supporting data is not provided.
• Results are not always clear due to the internal organization of some ISPs, and the fact that technically savvy users sometimes deliberately edit from unrelated IPs.
• Responses to CheckUser requests will be placed beneath your request. Old requests will be archived. Please check back here for responses.

Archives

Requests

Quacking like a cat

Can we confirm these are our cat-hater? (Created in a batch)

1. FecalMatter101 (talk · contribs)
2. Pooman365 (talk · contribs)
3. IHaveALargeDick (talk · contribs)
4. IEnjoyWeiners (talk · contribs)
5. IEnjoyMasturbating (talk · contribs)

--Pi zero (talk) 18:24, 25 August 2011 (UTC)

Confirmed. -- Cirt (talk) 20:42, 25 August 2011 (UTC)

Thanks! --Pi zero (talk) 21:42, 25 August 2011 (UTC)

These too please, Cirt :)

1. IEnjoyMaleBodyParts (talk · contribs)
2. ILikeGorillaPubes (talk · contribs)
3. EnterimageANUS (talk · contribs)

BarkingFish (talk) 20:39, 26 August 2011 (UTC)

• I've expanded the prior Steward-imposed block to 70.224.32.0/23 (six-month duration) as the prior block of a /24 stopped kitty crapping on the floor for about 5 days. If this impacts any "real" contributors, please overturn. If our feline friend has an entirely different range at xyr disposal, please block as-appropriate. --Brian McNeil / ^talk 16:41, 29 August 2011 (UTC)
  • Confirmed, yet again, three different confirmed and related IPs. -- Cirt (talk) 17:51, 30 August 2011 (UTC)

78.149.114.62

78.149.114.62 (talk · contribs) Made a clear attempt to sneak copyrighted material through the review process, but failed. (This was not a misunderstanding of the rules/law but a deliberate act, in this case, unlike most copyvios.) With no other contribs till today, I'm suspicious; this is someone who already knows a thing or two about the project. Can we see if we can link this to any troll accounts, or at least confirm open proxy use? Blood Red Sandman ^{(Talk) (Contribs)} 20:09, 13 September 2011 (UTC)

Nothing came up. Only edits to 2 different articles, Bomb blast in Delhi kills 12, injures 62 and British "Father of Pop Art" Richard Hamilton dies aged 89. -- Cirt (talk) 04:35, 25 October 2011 (UTC)

Old cats

Two old kitties accounts have been vandalizing their user talk pages. These are part of a set blocked on May 20. I've revoked remaining privs for the whole set, but note that apparently IP measures taken did not suffice. Can we do better?

The two:

1. Headphones turtle (talk · contribs)
2. Speed pappy anger english (talk · contribs)

Others in the set:

1. Cat Lover For Life (talk · contribs)
2. TurtlesBurning (talk · contribs)
3. Poopy Butt (talk · contribs)
4. K!tties Burning (talk · contribs)

--Pi zero (talk) 01:55, 15 October 2011 (UTC)

Confirmed, added an IP block. -- Cirt (talk) 04:38, 25 October 2011 (UTC)

Onewhohelps

Onewhohelps (talk · contribs) and his mobile account OWHMobile (talk · contribs) are likely socks of a known crosswiki troll. This user follows similar patterns off-wiki - mainly IRC spam and harassment. This user has been determined elsewhere to be w:User:Surasaman aka w:User:Thepoliticalmaster. Similar block exists on Outreachwiki. I've been informed of similar disruption to members of at least one non-WMF wiki. This user uses a variety of IP addresses, based on IRC evidence, and so cross-project CU collaboration may be in order. Blood Red Sandman ^{(Talk) (Contribs)} 16:24, 17 November 2011 (UTC)

1. Onewhohelps (talk · contribs)
2. OWHMobile (talk · contribs)
3. Indomenulis (talk · contribs)
4. MartinTiny (talk · contribs)
5. Lorenzo 93 (talk · contribs)
6. Shekharnwagh (talk · contribs)
7. Onomeasikele fane (talk · contribs)
8. Irecave (talk · contribs)
9. Hrd777 (talk · contribs)
10. MrZoolook (talk · contribs)
11. Tertseror (talk · contribs)

The above are Confirmed. Beginning coordination process with crosswiki CUs. Thank you for alerting us to this. ;) -- Cirt (talk) 17:48, 17 November 2011 (UTC)

Triplet spammers

The following accounts all showed up at the same time, posting faux-news "articles" (with no Wikinews formatting and no sources) ending with an unrelated paragraph containing spam links. (Actually, I think at least two of the three had the same spam links.) --Pi zero (talk) 09:40, 1 January 2012 (UTC)

1. Cathleenjones (talk · contribs)
2. Mileyjimm (talk · contribs)
3. Pam9 (talk · contribs)
4. Vickyrobertson (talk · contribs)

All above including added 4th one, are Confirmed. Blocked underlying IP for one week. -- Cirt (talk) 01:52, 2 January 2012 (UTC)

Kittiesonfire is Dantherocker1

Just an FYI heads up, the "Kittiesonfire" socks = Confirmed as Dantherocker1 from en.wikipedia. All related socks can be blocked on sight. Thank you for your time, -- Cirt (talk) 04:24, 7 January 2012 (UTC)

Feline rocker

Blocked two more:

1. 67.236.225.122 (talk · contribs) — replaced AAA with something about kitties; I blocked it for a week, fwiw.
2. Therockerkitten (talk · contribs) — indefblocked on sight.

--Pi zero (talk) 15:46, 8 January 2012 (UTC)

Another set:

1. ChokingOnMyBalls (talk · contribs)
2. SweatyKittyNuts (talk · contribs)
3. K!tt!3s0nf!r3_is_back! (talk · contribs)
4. WipingMyAss (talk · contribs)
5. MajorPoopFetish (talk · contribs)
6. FelineNutsack (talk · contribs)
7. Human nutsack2 (talk · contribs) --Pi zero (talk) 22:55, 9 January 2012 (UTC)

--Pi zero (talk) 14:08, 9 January 2012 (UTC)

• All above are Confirmed. -- Cirt (talk) 17:13, 10 January 2012 (UTC)

1. CatsBurningLikeFire (talk · contribs) --Pi zero (talk) 21:07, 10 January 2012 (UTC)

Confirmed, again. -- Cirt (talk) 21:26, 10 January 2012 (UTC)

1. CatBurningInFlames (talk · contribs) --Pi zero (talk) 00:35, 11 January 2012 (UTC)

Confirmed. -- Cirt (talk) 05:56, 11 January 2012 (UTC)

---

• IP claiming to be impacted by Kitty-blocking; can you take a look at the technical details? --Brian McNeil / ^talk 23:48, 25 January 2012 (UTC)
  • Most likely that is Dantherocker1 socking to post the request on that IP talk page. He's done it before multiple times in the past. -- Cirt (talk) 01:23, 26 January 2012 (UTC)
    • Confirmed that the user posting that was Dantherocker1. -- Cirt (talk) 02:18, 26 January 2012 (UTC)
      • Yeah, kinda thought it would be, but some HTTP headers do help. On which note, UK cellular company O2 had a screwup that left customers using mobile phones browsing (other than via a WiFi connection) posting the customer's phone number for nearly two weeks. Sadly, couldn't pick that up and run with it. A: COI B: Davos story. --Brian McNeil / ^talk 04:25, 26 January 2012 (UTC)

Multi-account spammer

I've blocked the following users, all of whom posted substantially the same advertising/spam to (usually their own) user pages. (Fegistered blocks indefinite; IP, a mere three days.)

1. Asd311045 (talk · contribs)
2. Asd557735 (talk · contribs)
3. Asd936312 (talk · contribs)
4. 46.115.36.34 (talk · contribs)

--Pi zero (talk) 23:31, 12 January 2012 (UTC)

Confirmed, blocked another IP. -- Cirt (talk) 00:16, 13 January 2012 (UTC)

Marciano

A user has just been threatening various users with wiki-watch.com, using the same modus operandi as the IP that was recently doing that cross-wiki over, supposedly, the Rocky Marciano article. The IP is globally blocked for six months for cross-wiki abuse. I'm wondering if any technical connection can be made between these. Also possibly related —I offer it for consideration if deemed appropriate— is the user who originally created the Marciano pages cross-wiki; xe hasn't gotten xyrself blocked anywhere but Wikispecies that I can see (there, indef without ability to edit own talk page, as a vandalism-only account), though I do note a somewhat suggestive similar predilection for edit summaries in ALL CAPS.

1. Wikiwatchcom (talk · contribs)
2. 64.107.88.66 (talk · contribs)
3. BakerMarciano (talk · contribs)

--Pi zero (talk) 17:44, 14 January 2012 (UTC)

Comment - No technical correlation between the above three yet. The last account has another account tied to its IP (not the one in the above list, another unrelated one), but I don't see any abusive editing with that account yet. Please do keep an eye on it, and feel free to post a re-check if there is further behavioral evidence on this wiki or from others. Thank you, -- Cirt (talk) 04:48, 15 January 2012 (UTC)

This IP seems to be claiming to be the same idiot (judging by the content of the vandalism). --Pi zero (talk) 01:22, 28 January 2012 (UTC)

1. 131.239.63.6 (talk · contribs)

• Confirmed match to BakerMarciano and Historicalguy --Cspurrier (talk) 05:06, 28 January 2012 (UTC)

SPA,… Spammer(s)

Three accounts, created in succession, and used to create SEO support-type for spammed links.

1. Hannahmiller (talk • contribs • deleted contribs • logs • block user • block log • checkuser)
2. Cleofellemorgan (talk • contribs • deleted contribs • logs • block user • block log • checkuser)
3. Angelamoore (talk • contribs • deleted contribs • logs • block user • block log • checkuser)

I'm keen to know if there is a shared underlying IP, if it has a history of this activity (I've seen this sort of SEO spam in the past few weeks - also a small volume). Lastly, this is a new spamming method for here, so a yes/no on "have other projects seen similar?" is something I'm curious on. Since WMF username captchas are pretty simple, it would concern me that a scripted spam run could hit us 3 times in an hour, and just be the tip of a wiki-spamming iceberg. --Brian McNeil / ^talk 09:21, 25 January 2012 (UTC)

• Confirmed, will confer with other CUs bout this. -- Cirt (talk) 01:25, 26 January 2012 (UTC)
• CommentThis is a interesting one. i see that Cirt has already put a block on that IP, so i will wait and see if there will be any more Brian | (Talk) | ^{New Zealand Portal} 06:14, 26 January 2012 (UTC)

Block-evading spammer

Identical mo, even same company site linked to; I indefblocked the first yesterday, then the second when it cropped up today. I see one of them has non-zero edits on another sister (en.wp), and has been indefblocked there. --Pi zero (talk) 15:21, 26 January 2012 (UTC)

1. Pubsonline (talk • contribs • deleted contribs • logs • block user • block log • checkuser)
2. Pub online (talk • contribs • deleted contribs • logs • block user • block log • checkuser)

• Confirmed, blocked a slew of IPs. -- Cirt (talk) 15:49, 26 January 2012 (UTC)

Spammers with same MO

Two accounts, created maybe five hours apart, each account immediately creating a user page containing only a spam link. That's a distinctive MO, twice in a quarter day. The two spam links are thematically similar, too. So I'd like to know if these two accounts have any technical connection. --Pi zero (talk) 15:36, 1 February 2012 (UTC)

1. Koiljh (talk • contribs • deleted contribs • logs • block user • block log • checkuser)
2. Orange55 (talk • contribs • deleted contribs • logs • block user • block log • checkuser)

Confirmed. -- Cirt (talk) 15:38, 1 February 2012 (UTC)

Katherine

1. Katherine8282 (talk • contribs • deleted contribs • logs • block user • block log • checkuser)
2. Katherine808082 (talk • contribs • deleted contribs • logs • block user • block log • checkuser)

Similar usernames, similar pattern of 13-year-old-girl-style edits. Are there any more of these lurking? Blood Red Sandman ^{(Talk) (Contribs)} 18:38, 2 February 2012 (UTC)

• Confirmed. Nothing else shows up at the time being. -- Cirt (talk) 22:52, 2 February 2012 (UTC)

Nauseous green

I've noted three users (two registered and an IP) recently that put me in mind of recently banned Viriditas, and would like to know whether technical connections can be made.

The IP and user Free Web Defence have in the past few days been resubmitting Viriditas's Black History Month article for review without improvement. Free Web Defense has no other edits here; elsewhere are two edits on en.wp, only one of which is publicly visible (spurious result from tool? edit to deleted page?), from late January — predating Viriditas's disruption here. In the case of Viriditas, I'm not prepared to dismiss suspicion of the account on that basis. The other registered user, Fkjsdnkjfndsjfsd, submitted a minimal article with ten sources, and did nothing when asked to repair misformatted source templates and questioned on the need for so many sources; the account was created yesterday and made some contributions to two Wikipedias — Filipino and Latin (appears to be an experienced user adopting a random-keystrokes username; keeping in mind, Viriditas claims to be based in Hawaii and, well, chose the username Viriditas). --Pi zero (talk) 17:35, 8 February 2012 (UTC)

1. 193.62.43.202 (talk • contribs • deleted contribs • logs • block user • block log • checkuser)
2. Free Web Defence (talk • contribs • deleted contribs • logs • block user • block log • checkuser)
3. Fkjsdnkjfndsjfsd (talk • contribs • deleted contribs • logs • block user • block log • checkuser)
4. Viriditas (talk • contribs • deleted contribs • logs • block user • block log • checkuser)

 Doing.... -- Cirt (talk) 18:03, 8 February 2012 (UTC)

Going to confer with other fellow Checkusers on this one. -- Cirt (talk) 18:30, 8 February 2012 (UTC)

• The IP has now got the idea that rather than simply requesting review, xe'd replace the {{review}} template with {{publish}}. Xe did that to two aritcles this morning (Black History Month and another). I've given xem a three day block, but this behavior is so very like Viriditas that if it's a meatpuppet rather than a sockpuppet, it looks to be a meatpuppet with remarkably short strings. --Pi zero (talk) 13:06, 9 February 2012 (UTC)

1. 193.62.43.202 (talk • contribs • deleted contribs • logs • block user • block log • checkuser)
2. Free Web Defence (talk • contribs • deleted contribs • logs • block user • block log • checkuser)

These first 2 are the same, blocked as Confirmed. The others are less conclusive. Feel free to block on behavioral evidence as an admin judgment decision, as they appear to be using mobile phones to edit which obscures changing IPs somewhat. -- Cirt (talk) 16:17, 9 February 2012 (UTC)

• I've just whammed 77.28.104.213 (talk • contribs • deleted contribs • logs • block user • block log • checkuser) as clearly part of the same, if we can dig any new info out from that one would be cool. Blood Red Sandman ^{(Talk) (Contribs)} 22:34, 9 February 2012 (UTC)
  • Nothing much turns up, will confer with others. -- Cirt (talk) 23:33, 9 February 2012 (UTC)
• 193.62.43.202 and 77.28.104.213 are hacked mail severs acting as proxies. Fkjsdnkjfndsjfsd's ip also appears to be a proxy. From a technical match perspective, Viriditas may not be the same user as the others, however given the near perfectness of the lack of overlap and the response to Cirt I would lean towards them being carefully done socks of Viriditas --Cspurrier (talk) 23:07, 11 February 2012 (UTC)