Jump to content

Wikinews:Requests for CheckUser/Archive 6

From Wikinews, the free news source you can write!

Immigration 'lawyers'

Confirmed--Cspurrier (talk) 21:45, 1 March 2014 (UTC)reply

Troll on AAA

This user has been trolling at AAA, and shows obvious stylistic similarities to the blocked user on whose behalf xe's spewing vitriol. --Pi zero (talk) 08:31, 2 September 2014 (UTC)reply

Comment I'd suspect time delay between block and this new account appearing may render local CU inconclusive. Whether the person undertaking CU can make the case for checks elsewhere is something I'll leave them to on the closed mailing list. --Brian McNeil / talk 08:44, 2 September 2014 (UTC)reply
Comment — I'm pretty sure it's the same person. Same peculiar convoluted writing style. I'd be very surprised if it was two different people. — Gopher65talk 14:49, 2 September 2014 (UTC)reply

Two similar vandals

These two fairly recent vandals have both used words that could be interpreted as death threats. We should know whether there's technical evidence linking them. (I'm also unsure who to inform of possible death threats but, now that there are two and they're so close together, I have a desire to report it to... somebody.) --Pi zero (talk) 00:16, 8 October 2014 (UTC)reply

Rangeblock check

Per issues Antandrus is having with cross-wiki stalking/harrassment, could a Checkuser confirm there's no collateral damage on the suggested rangeblocks? (See linked talk). --Brian McNeil / talk 02:21, 1 December 2014 (UTC)reply

DoneThere are no non-abusive edits from those ranges. There are however several auto-created users who appear to be unrelated. --Cspurrier (talk) 03:41, 8 December 2014 (UTC)reply

Kittiesonfire

Our multi-socking pal professes to have returned (see IP edits). Would appreciate the usual check for sleepers. There is one suspect username recently created which I'll pop in, too. BRS (Talk) (Contribs) 08:51, 25 January 2015 (UTC)reply

Done Sorry for the delay. No current socks associated with that ip.--Cspurrier (talk) 00:48, 21 June 2015 (UTC)reply

Multiple, suspiciously similar, new users

Noted the following users, with too-similar pattern on usernames. Does a CU to get an IP address show them all originating from a single source? If so, would propose blocking all bar first registered. Only reason I could see not to do so, if suspicions confirmed, would be if IP owned by an educational institution and browser idents differ sufficiently to conclude originate with separate computers behind a proxy. Given name component of new usernames looks like pulled from a list would not be surprised if this is bot activity. --Brian McNeil / talk 14:46, 28 January 2016 (UTC)reply

Confirmed Ip belongs to a dedicated server provider. Either a bot or a private proxy --Cspurrier (talk) 23:17, 28 January 2016 (UTC)reply

Batch of spam accounts

We've had quite a few spam accounts just lately characteristically creating pages with the spam information in the page name, typically with lots of spaces inserted to avoid abuse filters. This was a particular prolific bunch all at once, which I just finished cleaning up. --Pi zero (talk) 21:48, 20 April 2016 (UTC)reply

Confirmed They do seem to all be the same, but the ips are all over the place. It looks like they are using a large collection of compromised systems to edit. Other than adjust the abuse filter, it doesn't look like there is any thing we can do. --Cspurrier (talk) 02:10, 26 April 2016 (UTC)reply

Sharp troublemaker

This seems to keep cropping up, with the usual allegations of administrative abuse, and a flurry of misleading mage redirects/moves. Concerned that, unless nipped in the bud, will further disrupt the project. --Brian McNeil / talk 14:21, 31 May 2016 (UTC)reply

Done No fresh socks--Cspurrier (talk) 23:42, 31 May 2016 (UTC)reply

Phone-number spam

A complete list of these is provided below at #List (phone-number spam).

Lots of accounts popping up today; new ones get created after others are blocked, so it appears they're not coming from a small set of IPs. Would be nice if we could do something more effective than playing whack-a-mole with them.

... list of 17 that day ... 

--Pi zero (talk) 16:04, 6 April 2017 (UTC)reply

It seems the accounts are using various IPs, which are being globally blocked by a steward in Meta as the accounts are reported. —Alvaro Molina ( - ) 03:00, 7 April 2017 (UTC)reply
Good to know. --Pi zero (talk) 03:03, 7 April 2017 (UTC)reply
... 

Alvaro Molina ( - ) 06:36, 7 April 2017 (UTC)reply

Alvaro Molina ( - ) 07:02, 7 April 2017 (UTC)reply

Alvaro Molina ( - ) 07:30, 7 April 2017 (UTC)reply

Alvaro Molina ( - ) 07:40, 7 April 2017 (UTC)reply

--Pi zero (talk) 11:51, 7 April 2017 (UTC)reply

Alvaro Molina ( - ) 15:47, 7 April 2017 (UTC)reply

Alvaro Molina ( - ) 16:00, 7 April 2017 (UTC)reply

Alvaro Molina ( - ) 18:26, 7 April 2017 (UTC)reply

Alvaro Molina ( - ) 18:36, 7 April 2017 (UTC)reply

Alvaro Molina ( - ) 18:50, 7 April 2017 (UTC)reply

Alvaro Molina ( - ) 18:56, 7 April 2017 (UTC)reply

Alvaro Molina ( - ) 19:39, 7 April 2017 (UTC)reply

Alvaro Molina ( - ) 07:27, 8 April 2017 (UTC)reply

Inconclusive I have had a quick look at some of the accounts and IPs. There's some overlap but I'm not finding enough commonality to warrant rangeblocks. Trijnstel: I'm okay with a steward or another CU taking a second look to make sure I haven't missed anything. Thanks for the stewards/meta-folk for handling this spam quickly and stopping it from spreading cross-wiki. —Tom Morris (talk) 20:01, 11 April 2017 (UTC)reply

I think we should set up abuse filter that blocks for 24 hours if phone numbers, the words "Norton", "MSN", or "AOL" is used, and/or special characters are found. PokestarFan (talk) 19:15, 12 April 2017 (UTC)reply

@PokestarFan: I would agree, except that I don't know how to do abuse filters. I perforce figured out the one that was keeping me from doing administrative work on archived articles about Liverpool, but other than that I've never tangled with them. My feelings toward abuse filters are dominated by disapproval of the design decision that made them yet another specialized thing that requires a specialist to operate, and what time I don't pour into Wikinews review is poured into developing tools to bring more wiki tasks within range of nonspecialists (where all wiki tasks should be, by wiki philosophy). --Pi zero (talk) 19:25, 12 April 2017 (UTC)reply
@Pi zero: Ok. And we have more spambots. Check WN:AAA. PokestarFan (talk) 19:29, 12 April 2017 (UTC)reply


Also, I am creating 1 list ob bots to be used in multiple pages. PokestarFan (talk) 19:29, 12 April 2017 (UTC)reply

@PokestarFan: There are only two pages we've been listing them on. A shared list seems like a lot of trouble to go to for just two pages. --Pi zero (talk) 19:34, 12 April 2017 (UTC)reply
@Pi zero: Don't worry, I'm creating said list. PokestarFan (talk) 19:37, 12 April 2017 (UTC)reply

List (phone-number spam)

February 20, 2018

February 19, 2018

February 18, 2018

February 17, 2018

February 16, 2018

February 15, 2018

February 14, 2018

February 13, 2018

Update the list

IPs creating gibberish

I have seen a look at the block log, and it looks like several IPs are vandalizing. Are they connected? PokestarFan (talk) 02:12, 13 April 2017 (UTC)reply

Mikesanders70 and CaliforniaArtNews

Not a request per se, but it feels quite obvious these are socks and perhaps if there is one more Queen page, we should do something -- CUing might be a bit too much, but just letting others know. (CC @Green Giant:).
•–• 14:51, 6 August 2021 (UTC)reply

Confirmed
@Acagastya: I looked at their edits on other wikis and uncovered a small crosswiki promotional campaign. I’ve done a loginwiki check and found a third account (User:TheQNGalleryArticles) on the same IP address. All three are now locked. To answer your question, the suspicion of socking or spamming is sufficient for a CU. --Green Giant (talk) 19:35, 6 August 2021 (UTC)reply

Suspected lock evasion

Suspected global lock evasion. Both accounts posting similar, homophobic slurs.[1], [2]

Michael.C.Wright (Talk/Published) 14:07, 16 May 2024 (UTC)reply

They are both blocked here and globally locked. Pretty obvious, I don't see what I checkuser would tell us that the duck test wouldn't Me Da Wikipedian (talk) 20:54, 20 May 2024 (UTC)reply
I'm hoping to get the IP behind the accounts blocked from creating new accounts. Otherwise we just continue to play whack-a-mole. Michael.C.Wright (Talk/Published) 13:38, 22 May 2024 (UTC)reply
Note: Global stewards have effectively verified these accounts and also Trade me away im the sore (talk · contribs · page moves · block user · block log) are all sock puppets.[3] It would be helpful to have local, long-term, range blocks in place. Locally we can tolerate longer and wider blocks than are typical at the global level. --Michael.C.Wright (Talk/Published) 17:06, 22 May 2024 (UTC)reply

┌─────────────────────────────────┘
Inconclusive from the Checkuser but obviously the same behaviour. Two ranges locally blocked for a year. All accounts on these ranges (including the two above) were blocked indefinitely by the abuse filter. [24Cr][talk] 20:13, 28 May 2024 (UTC)reply

New request sent via email

I have sent a CU request to both Acagastya and Cromium using Wikimail and notified them both on their talk pages. Michael.C.Wright (Talk/Reviewer) 14:49, 31 December 2025 (UTC)reply

@Acagastya and @Cromium, you can disregard this request. I misinterpreted the registered account's actions. Sorry for the confusion.Michael.C.Wright (Talk/Reviewer) 16:20, 31 December 2025 (UTC)reply

Check User


The following discussion is preserved as an archive. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

No local CUs to action this request and confirmation already provided at Wikidata. It might be prudent to leave this archived discussion available until the associated deletion request is closed. Michael.C.Wright (Talk/Reviewer) 01:09, 24 February 2026 (UTC)reply

User:Tefepit and User:Kannotlogin. Sock of Quienton Declare. BigKrow (talk) 20:02, 22 January 2026 (UTC)reply

BigKrow, I am not a CU nor an admin, but as of today this wiki currently has no local checkusers. Please forward any future CheckUser requests to m:SRCU. Thanks. Codename Noreste (talk) 00:02, 24 February 2026 (UTC)reply
They were both already identified as socks at Wikidata. I don't believe either has violated any policy here with regards to sock use. Neither Tefepit nor Kannotlogin has made any contribution here since this notice and this notice were placed on their talk pages. At this point, I'm not sure what else needs to happen.Michael.C.Wright (Talk/Reviewer) 00:35, 24 February 2026 (UTC)reply
I think we should archive this request, mark this page with {{Historical}} or keep the top message about no local checkusers on Wikinews, and possibly protect this page indefinitely. Codename Noreste (talk) 00:36, 24 February 2026 (UTC)reply
There is also a deletion request associated with this CU request:
Roblox player uncovers cheating, awarded Guinness World Record
See also: Wikinews:Admin action alerts#Check UserMichael.C.Wright (Talk/Reviewer) 01:06, 24 February 2026 (UTC)reply

The above discussion is preserved as an archive. Please do not modify it. Subsequent comments should be made on the appropriate discussion page, such as the current discussion page. No further edits should be made to this discussion.