Wikinews:Requests for CheckUser

Shortcut:
WN:RFCU
WN:CU

This is the place to request investigations requiring CheckUser permission.

This is the place to request investigations requiring CheckUser permission.

Caveats	CheckUser is a last resort for difficult cases, due to the effort involved, difficulty of interpretation of results and privacy issues raised. Use other methods first. Obvious sockpuppets may be treated as such without using CheckUser. DO NOT list non-disruptive "throwaway" accounts that only have a few edits. Data is kept for 90 days so we cannot compare against accounts that have not edited earlier. Block evasion: may be listed where the problem is ongoing. Routine 3RR violations: do not list unless there is: (a) an ongoing problem, (b) reasonable doubt as to whether sockpuppets are being used, and (c) disruption of editing that cannot be otherwise addressed. Vandalism: only for ongoing serious vandalism. Vote fraud: only if: (a) there is reasonable doubt about the validity of votes, (b) the vote or discussion has closed, and (c) the possible sockpuppet votes affect the outcome of the vote. Provide a link to the closed vote or discussion.
Procedure	DO NOT post long discussions about the merits of the check. If a compact, reasonable request, with the necessary diffs, cannot be made, then post it on WN:ALERT. List the request at the foot of the requests section. Clearly indicate the usernames or IP addresses you suspect. Use the format: {{Checkuser|USERNAME TO BE CHECKED}}. Clearly lay out the evidence for sockpuppetry. Explain how your request fits the POLICY. Sign the request.
Outcomes	Responses will be brief in order to comply with Wikimedia:Privacy policy; supporting data will not be provided. Results are not always clear due to the internal organization of some ISPs, and some users deliberately edit from unrelated IPs. The response to a request will be placed beneath the request. Old requests will be archived. Please check back here for responses. Possible outcomes: Confirmed, Inconclusive, Likely, Possible, Unlikely, or Unrelated.

Requests

Quacking like a cat

Can we confirm these are our cat-hater? (Created in a batch)

1. FecalMatter101 (talk · contribs)
2. Pooman365 (talk · contribs)
3. IHaveALargeDick (talk · contribs)
4. IEnjoyWeiners (talk · contribs)
5. IEnjoyMasturbating (talk · contribs)

--Pi zero (talk) 18:24, 25 August 2011 (UTC)

Confirmed. -- Cirt (talk) 20:42, 25 August 2011 (UTC)

Thanks! --Pi zero (talk) 21:42, 25 August 2011 (UTC)

These too please, Cirt :)

1. IEnjoyMaleBodyParts (talk · contribs)
2. ILikeGorillaPubes (talk · contribs)
3. EnterimageANUS (talk · contribs)

BarkingFish (talk) 20:39, 26 August 2011 (UTC)

• I've expanded the prior Steward-imposed block to 70.224.32.0/23 (six-month duration) as the prior block of a /24 stopped kitty crapping on the floor for about 5 days. If this impacts any "real" contributors, please overturn. If our feline friend has an entirely different range at xyr disposal, please block as-appropriate. --Brian McNeil / ^talk 16:41, 29 August 2011 (UTC)
  • Confirmed, yet again, three different confirmed and related IPs. -- Cirt (talk) 17:51, 30 August 2011 (UTC)

78.149.114.62

78.149.114.62 (talk · contribs) Made a clear attempt to sneak copyrighted material through the review process, but failed. (This was not a misunderstanding of the rules/law but a deliberate act, in this case, unlike most copyvios.) With no other contribs till today, I'm suspicious; this is someone who already knows a thing or two about the project. Can we see if we can link this to any troll accounts, or at least confirm open proxy use? Blood Red Sandman ^{(Talk) (Contribs)} 20:09, 13 September 2011 (UTC)

Nothing came up. Only edits to 2 different articles, Bomb blast in Delhi kills 12, injures 62 and British "Father of Pop Art" Richard Hamilton dies aged 89. -- Cirt (talk) 04:35, 25 October 2011 (UTC)

Old cats

Two old kitties accounts have been vandalizing their user talk pages. These are part of a set blocked on May 20. I've revoked remaining privs for the whole set, but note that apparently IP measures taken did not suffice. Can we do better?

The two:

1. Headphones turtle (talk · contribs)
2. Speed pappy anger english (talk · contribs)

Others in the set:

1. Cat Lover For Life (talk · contribs)
2. TurtlesBurning (talk · contribs)
3. Poopy Butt (talk · contribs)
4. K!tties Burning (talk · contribs)

--Pi zero (talk) 01:55, 15 October 2011 (UTC)

Confirmed, added an IP block. -- Cirt (talk) 04:38, 25 October 2011 (UTC)

Onewhohelps

Onewhohelps (talk · contribs) and his mobile account OWHMobile (talk · contribs) are likely socks of a known crosswiki troll. This user follows similar patterns off-wiki - mainly IRC spam and harassment. This user has been determined elsewhere to be w:User:Surasaman aka w:User:Thepoliticalmaster. Similar block exists on Outreachwiki. I've been informed of similar disruption to members of at least one non-WMF wiki. This user uses a variety of IP addresses, based on IRC evidence, and so cross-project CU collaboration may be in order. Blood Red Sandman ^{(Talk) (Contribs)} 16:24, 17 November 2011 (UTC)

1. Onewhohelps (talk · contribs)
2. OWHMobile (talk · contribs)
3. Indomenulis (talk · contribs)
4. MartinTiny (talk · contribs)
5. Lorenzo 93 (talk · contribs)
6. Shekharnwagh (talk · contribs)
7. Onomeasikele fane (talk · contribs)
8. Irecave (talk · contribs)
9. Hrd777 (talk · contribs)
10. MrZoolook (talk · contribs)
11. Tertseror (talk · contribs)

The above are Confirmed. Beginning coordination process with crosswiki CUs. Thank you for alerting us to this. ;) -- Cirt (talk) 17:48, 17 November 2011 (UTC)

Triplet spammers

The following accounts all showed up at the same time, posting faux-news "articles" (with no Wikinews formatting and no sources) ending with an unrelated paragraph containing spam links. (Actually, I think at least two of the three had the same spam links.) --Pi zero (talk) 09:40, 1 January 2012 (UTC)

1. Cathleenjones (talk · contribs)
2. Mileyjimm (talk · contribs)
3. Pam9 (talk · contribs)
4. Vickyrobertson (talk · contribs)

All above including added 4th one, are Confirmed. Blocked underlying IP for one week. -- Cirt (talk) 01:52, 2 January 2012 (UTC)

Kittiesonfire is Dantherocker1

Just an FYI heads up, the "Kittiesonfire" socks = Confirmed as Dantherocker1 from en.wikipedia. All related socks can be blocked on sight. Thank you for your time, -- Cirt (talk) 04:24, 7 January 2012 (UTC)

Feline rocker

Blocked two more:

1. 67.236.225.122 (talk · contribs) — replaced AAA with something about kitties; I blocked it for a week, fwiw.
2. Therockerkitten (talk · contribs) — indefblocked on sight.

--Pi zero (talk) 15:46, 8 January 2012 (UTC)

Another set:

1. ChokingOnMyBalls (talk · contribs)
2. SweatyKittyNuts (talk · contribs)
3. K!tt!3s0nf!r3_is_back! (talk · contribs)
4. WipingMyAss (talk · contribs)
5. MajorPoopFetish (talk · contribs)
6. FelineNutsack (talk · contribs)
7. Human nutsack2 (talk · contribs) --Pi zero (talk) 22:55, 9 January 2012 (UTC)

--Pi zero (talk) 14:08, 9 January 2012 (UTC)

• All above are Confirmed. -- Cirt (talk) 17:13, 10 January 2012 (UTC)

1. CatsBurningLikeFire (talk · contribs) --Pi zero (talk) 21:07, 10 January 2012 (UTC)

Confirmed, again. -- Cirt (talk) 21:26, 10 January 2012 (UTC)

1. CatBurningInFlames (talk · contribs) --Pi zero (talk) 00:35, 11 January 2012 (UTC)

Confirmed. -- Cirt (talk) 05:56, 11 January 2012 (UTC)

---

• IP claiming to be impacted by Kitty-blocking; can you take a look at the technical details? --Brian McNeil / ^talk 23:48, 25 January 2012 (UTC)
  • Most likely that is Dantherocker1 socking to post the request on that IP talk page. He's done it before multiple times in the past. -- Cirt (talk) 01:23, 26 January 2012 (UTC)
    • Confirmed that the user posting that was Dantherocker1. -- Cirt (talk) 02:18, 26 January 2012 (UTC)
      • Yeah, kinda thought it would be, but some HTTP headers do help. On which note, UK cellular company O2 had a screwup that left customers using mobile phones browsing (other than via a WiFi connection) posting the customer's phone number for nearly two weeks. Sadly, couldn't pick that up and run with it. A: COI B: Davos story. --Brian McNeil / ^talk 04:25, 26 January 2012 (UTC)

Multi-account spammer

I've blocked the following users, all of whom posted substantially the same advertising/spam to (usually their own) user pages. (Fegistered blocks indefinite; IP, a mere three days.)

1. Asd311045 (talk · contribs)
2. Asd557735 (talk · contribs)
3. Asd936312 (talk · contribs)
4. 46.115.36.34 (talk · contribs)

--Pi zero (talk) 23:31, 12 January 2012 (UTC)

Confirmed, blocked another IP. -- Cirt (talk) 00:16, 13 January 2012 (UTC)

Marciano

A user has just been threatening various users with wiki-watch.com, using the same modus operandi as the IP that was recently doing that cross-wiki over, supposedly, the Rocky Marciano article. The IP is globally blocked for six months for cross-wiki abuse. I'm wondering if any technical connection can be made between these. Also possibly related —I offer it for consideration if deemed appropriate— is the user who originally created the Marciano pages cross-wiki; xe hasn't gotten xyrself blocked anywhere but Wikispecies that I can see (there, indef without ability to edit own talk page, as a vandalism-only account), though I do note a somewhat suggestive similar predilection for edit summaries in ALL CAPS.

1. Wikiwatchcom (talk · contribs)
2. 64.107.88.66 (talk · contribs)
3. BakerMarciano (talk · contribs)

--Pi zero (talk) 17:44, 14 January 2012 (UTC)

Comment - No technical correlation between the above three yet. The last account has another account tied to its IP (not the one in the above list, another unrelated one), but I don't see any abusive editing with that account yet. Please do keep an eye on it, and feel free to post a re-check if there is further behavioral evidence on this wiki or from others. Thank you, -- Cirt (talk) 04:48, 15 January 2012 (UTC)

This IP seems to be claiming to be the same idiot (judging by the content of the vandalism). --Pi zero (talk) 01:22, 28 January 2012 (UTC)

1. 131.239.63.6 (talk · contribs)

• Confirmed match to BakerMarciano and Historicalguy --Cspurrier (talk) 05:06, 28 January 2012 (UTC)

SPA,… Spammer(s)

Three accounts, created in succession, and used to create SEO support-type for spammed links.

1. Hannahmiller (talk • contribs • deleted contribs • logs • block user • block log • checkuser)
2. Cleofellemorgan (talk • contribs • deleted contribs • logs • block user • block log • checkuser)
3. Angelamoore (talk • contribs • deleted contribs • logs • block user • block log • checkuser)

I'm keen to know if there is a shared underlying IP, if it has a history of this activity (I've seen this sort of SEO spam in the past few weeks - also a small volume). Lastly, this is a new spamming method for here, so a yes/no on "have other projects seen similar?" is something I'm curious on. Since WMF username captchas are pretty simple, it would concern me that a scripted spam run could hit us 3 times in an hour, and just be the tip of a wiki-spamming iceberg. --Brian McNeil / ^talk 09:21, 25 January 2012 (UTC)

• Confirmed, will confer with other CUs bout this. -- Cirt (talk) 01:25, 26 January 2012 (UTC)
• CommentThis is a interesting one. i see that Cirt has already put a block on that IP, so i will wait and see if there will be any more Brian | (Talk) | ^{New Zealand Portal} 06:14, 26 January 2012 (UTC)

Block-evading spammer

Identical mo, even same company site linked to; I indefblocked the first yesterday, then the second when it cropped up today. I see one of them has non-zero edits on another sister (en.wp), and has been indefblocked there. --Pi zero (talk) 15:21, 26 January 2012 (UTC)

1. Pubsonline (talk • contribs • deleted contribs • logs • block user • block log • checkuser)
2. Pub online (talk • contribs • deleted contribs • logs • block user • block log • checkuser)

• Confirmed, blocked a slew of IPs. -- Cirt (talk) 15:49, 26 January 2012 (UTC)

Spammers with same MO

Two accounts, created maybe five hours apart, each account immediately creating a user page containing only a spam link. That's a distinctive MO, twice in a quarter day. The two spam links are thematically similar, too. So I'd like to know if these two accounts have any technical connection. --Pi zero (talk) 15:36, 1 February 2012 (UTC)

1. Koiljh (talk • contribs • deleted contribs • logs • block user • block log • checkuser)
2. Orange55 (talk • contribs • deleted contribs • logs • block user • block log • checkuser)

Confirmed. -- Cirt (talk) 15:38, 1 February 2012 (UTC)

Katherine

1. Katherine8282 (talk • contribs • deleted contribs • logs • block user • block log • checkuser)
2. Katherine808082 (talk • contribs • deleted contribs • logs • block user • block log • checkuser)

Similar usernames, similar pattern of 13-year-old-girl-style edits. Are there any more of these lurking? Blood Red Sandman ^{(Talk) (Contribs)} 18:38, 2 February 2012 (UTC)

• Confirmed. Nothing else shows up at the time being. -- Cirt (talk) 22:52, 2 February 2012 (UTC)

Nauseous green

I've noted three users (two registered and an IP) recently that put me in mind of recently banned Viriditas, and would like to know whether technical connections can be made.

The IP and user Free Web Defence have in the past few days been resubmitting Viriditas's Black History Month article for review without improvement. Free Web Defense has no other edits here; elsewhere are two edits on en.wp, only one of which is publicly visible (spurious result from tool? edit to deleted page?), from late January — predating Viriditas's disruption here. In the case of Viriditas, I'm not prepared to dismiss suspicion of the account on that basis. The other registered user, Fkjsdnkjfndsjfsd, submitted a minimal article with ten sources, and did nothing when asked to repair misformatted source templates and questioned on the need for so many sources; the account was created yesterday and made some contributions to two Wikipedias — Filipino and Latin (appears to be an experienced user adopting a random-keystrokes username; keeping in mind, Viriditas claims to be based in Hawaii and, well, chose the username Viriditas). --Pi zero (talk) 17:35, 8 February 2012 (UTC)

1. 193.62.43.202 (talk • contribs • deleted contribs • logs • block user • block log • checkuser)
2. Free Web Defence (talk • contribs • deleted contribs • logs • block user • block log • checkuser)
3. Fkjsdnkjfndsjfsd (talk • contribs • deleted contribs • logs • block user • block log • checkuser)
4. Viriditas (talk • contribs • deleted contribs • logs • block user • block log • checkuser)

 Doing.... -- Cirt (talk) 18:03, 8 February 2012 (UTC)

Going to confer with other fellow Checkusers on this one. -- Cirt (talk) 18:30, 8 February 2012 (UTC)