Open main menu

Wikimedia Commons β

Commons:Requests for checkuser

Shortcut: COM:CHECK, COM:RFCU, COM:SOCK

Does your request belong here?
This is the place to request sockpuppet checks or other investigations requiring CheckUser privileges. Checkuser is a last resort for difficult cases. Use other methods first. You can try posting on the administrator's noticeboard for example.
Please do not ask us to run checks without good reason:
These indicators are used by CheckUsers to allow easier at-a-glance reading of their notes, actions and comments.
Request completed
Artículo bueno.svg Confirmed Likely
Symbol possible vote.svg Possible Symbol unlikely.svg Unlikely
Symbol unsupport vote.svg Inconclusive Symbol unrelated.svg Unrelated
Symbol redirect vote.svg Completed Time2wait.svg Stale
Request declined
Declined Checkuser is not for fishing.
Checkuser is not magic pixie dust. 8ball The CheckUser Magic 8-Ball says
Cyberduck icon.png It looks like a duck to me Checkuser is not a crystal ball.
Information
Additional information needed Deferred to
 Doing… Pictogram voting info.svg Info
  1. Running a check will only be done to combat disruption on Commons, or as required to assist CheckUser investigations on other Wikimedia wikis.
    • Valid reasons for running a check include vandalism where a block of the underlying IP or IP range is needed, disruptive sockpuppetry, vote-stacking, and similar disruption where the technical evidence from running a check would prevent or reduce further disruption to Wikimedia projects.
  2. Requests to run a check with ambiguous reasoning will result in delays - please provide a rationale at the time you make the request
    • Show what the disruption to the project is, and why you believe the accounts are related.
  3. Requests to run a check on yourself will be declined
  4. The privacy policy does not allow us to make a check that has the effect of revealing IP addresses.
Outcome
Responses will be brief in order to comply with Wikimedia privacy policy. Due to technical limitations, results are not always clear. Check back regularly to see the outcome of your request. Closed requests are archived after seven days.
Privacy violation?
If you feel that a checkuser has led to a violation of the Wikimedia Foundation privacy policy regarding yourself, please refer the case to the Ombudsman commission.

If this page is displaying outdated contents even after you refresh the page in your browser, please purge this page's cache.

To request a check:

Cases are created on subpages of Commons:Requests for checkuser/Case.

Creating a request
  • Insert the name of the suspected sockpuppeteer (the main account or puppetmaster, not the sockpuppet!) in the box below, leaving out the "User:" prefix. Do not remove the text in the box, add to the end only.
  • Please explain/justify the request by saying what it is you suspect and why it is important that the check be carried out. Indicate the usernames you suspect, using {{checkuser}}. Please do not use this template in the section header, as that makes it difficult to read the account names. Include the diffs or links required to support the request and reason for it.
  • There are people to assist you and help with maintenance of the page. Just ask for help on the admin noticeboard if you really are stuck, or take your best shot and note that you weren't completely sure of what to say.
  • If a case subpage already exists, edit the existing page instead, either adding to the currently open section (if the case is not yet archived) or adding a new section to the top (if the case has been archived). When editing an existing case, be sure to list/transclude the subpage here.
Example
If you want to request a checkuser on User:John Doe, enter the text Commons:Requests for checkuser/Case/John Doe then click "Request a checkuser." You will be taken to a page where you can fill out the request. Please make your request there brief and concise.


Then transclude your subpage on the top of the list at Commons:Requests for checkuser and remove {{Checkuser requests to be listed}} from the top of the case subpage.

RequestsEdit

MechQuesterEdit

Suspected related usersEdit

Rationale, discussion and resultsEdit

Reason: All blocked in en.Wikipedia as socks of the same person. Please, confirm that accounts belong to the same person, as I envisage future disputes or doubts in the case where yet another sock emerged. Importantly, confirmation by Commons officials—on a wiki known for independence of en.Wikipedia establishment—is warranted. Incnis Mrsi (talk) 10:36, 19 April 2018 (UTC)

  •   Declined - This is essentially a request to gather data so information will not be stale should a hypothetical disruptive account emerge in the future. Whatever MechQuester/Artix Kreiger has done on en.wiki, no evidence has been presented here related to disruption on the Commons ("Running a check will only be done to combat disruption on Commons, or as required to assist CheckUser investigations on other Wikimedia wikis." (emphasis added)(COM:RFCU) En.wiki does not require assistance in this matter.) Checkuser is a last resort for difficult cases; the Kreiger accounts are already blocked and MechQuester does not appear to be editing disruptively. Merely having multiple accounts is, in and of itself, not prohibited ("There must be a valid reason to check a user. Note that alternative accounts are not forbidden, so long as they are not used in violation of the policies" (Meta CheckUser policy)). A speculation of "future disputes or doubts" is not a valid reason and is tantamount to a variant of fishing. Checkusers on all projects are able to share information, so, even if a disruptive account emerged, running a "propriety" Commons check now would not be necessary. Эlcobbola talk 14:45, 19 April 2018 (UTC)

Kritkitty again and again and again and again and again and againEdit

Suspected related usersEdit

Rationale, discussion and resultsEdit

As always: behaviour consistent with previous sockpuppets, e.g. this file log. Non-vector SVG files with fake copyright information. Uploaded files are edited from an IP address in Thailand shortly after upload (listed above). Username follows the same TLA pattern as other recent sockpuppets. LX (talk, contribs) 08:39, 15 April 2018 (UTC)

2018-04-19Edit

Thank you, Эlcobbola. Please check the following as well:

LX (talk, contribs) 16:18, 19 April 2018 (UTC)

Angieboyer01Edit

Suspected related usersEdit

Rationale, discussion and resultsEdit

Copyright violations relating to the same set of celebrities including Ana Brenda Contreras, Angelique Boyer and Juliana Paiva. Similar interwiki footprints. The last two are already blocked as sockpuppets of one another, but Angieboyer01 is the oldest of these accounts. LX (talk, contribs) 15:05, 16 April 2018 (UTC)

林忠生Edit

Suspected related usersEdit

Fresh:

IPs:

Hunted down but relatively recent:

Probably stale:

Rationale, discussion and resultsEdit

Reason: Better known as Nipponese Dog Calvero. This LTA sockmaster has yet another surge of activity on Commons. Please, take down his IP ranges with hard blocks, because he can register accounts on other Wikimedia sites where his ranges are not (and will not be) blocked. Incnis Mrsi (talk) 12:44, 16 April 2018 (UTC)
BTW, what happens when an account registered abroad joins Commons from an IP under anon-only block? Incnis Mrsi (talk) 12:52, 16 April 2018 (UTC)

The IP ranges this LTA commonly uses are 223.136.0.0/16, 223.137.0.0/16, 223.140.0.0/16, 114.136.0.0/16. These ranges are too chaotic to hard block, but they are indeed under an extended soft block at enwiki and frequently get blocked (hard/soft) for short periods of time at zhwiki. -★- PlyrStar93. Message me. 17:16, 16 April 2018 (UTC)
超級支那色狼習近平 (talk contribs Luxo's SUL deleted contribs logs block user block log checkuser) if that would count at all. But almost all these accounts get locked the moment they are active. The master has also been abusing proxy/VPN IP's more recently on enwiki and zhwiki (I guess there are times all the common ranges get blocked and he is unable to get an unblocked IP through disconnect-redial or so). -★- PlyrStar93. Message me. 17:24, 16 April 2018 (UTC)

AuwallEdit

Suspected related usersEdit

Rationale, discussion and resultsEdit

Reason: These accounts keep uploading out-of-scope personal photos related to Auwal(l) Azare after they got deleted. The photos are only being used for self-promotion at other Wikimedia projects.

Most of what Auwall uploaded have been nominated for deletion. They are:

GAMI1 uploaded:

Salisuwebmaster uploaded:

There are probably some more that got deleted, or additional accounts that haven't been discovered. -★- PlyrStar93. Message me. 23:53, 15 April 2018 (UTC)

  Confirmed, blocked and nuked. --Krd 11:20, 16 April 2018 (UTC)

AcaPetrina1775Edit

Suspected related usersEdit

.dyn.telefonica.de, ordered older top, newer bottom:

Likely by another master, but intersected in user_talk:AcaPetrina1775 (possibly accidentally):

Rationale, discussion and resultsEdit

Reason: The titular account uploaded four hundred files from Latvian Wikipedia and argued against Jcb. When the account went blocked, dynamic IP was used by someone to post complains and evade IP blocks. Some earlier IP activity related to Latvia or mass uploads—possibly of the same person—can be observed as well. Incnis Mrsi (talk) 12:08, 13 April 2018 (UTC)

Sztojka kevin3Edit

Suspected related usersEdit

Already blocked:

Rationale, discussion and resultsEdit

Persistent and rather unimaginative troll from Hungarian Wikipedia. Previously discussed here:

I guess it's time to start assessing the possibilities of a rangeblock here. LX (talk, contribs) 11:10, 13 April 2018 (UTC)

I've blocked the three suspected accounts as they're ducks for each other and clearly up to no good. Guanaco (talk) 07:20, 16 April 2018 (UTC)
  •   Completed No sleepers and all accounts above blocked. There are multiple active ranges being used, so this is not a good candidate for a range block. (The three "new" accounts are   Confirmed.) Эlcobbola talk 20:38, 16 April 2018 (UTC)

2018-04-18Edit

Thanks, Эlcobbola. Please check, block and nuke these as well:

LX (talk, contribs) 16:29, 18 April 2018 (UTC)

2018-04-19Edit

Thanks, Эlcobbola. Please check, block and nuke this one as well:

LX (talk, contribs) 16:37, 19 April 2018 (UTC)

  •   Likely - blocked and nuked. Эlcobbola talk 16:44, 19 April 2018 (UTC)
    Also, we're at a point where the range jumping is limiting the usefulness of the CU tool. As these have all been ducks, it would be best simply to request blocks at COM:AN/B/COM:ANU and limit CU requests to accounts for which there is doubt/suspicion rather than quacking. Эlcobbola talk 16:49, 19 April 2018 (UTC)
    Thank you for the advice. I will take it to COM:AN/B from now on. LX (talk, contribs) 17:59, 19 April 2018 (UTC)

EaglezeroEdit

Suspected related usersEdit

Rationale, discussion and resultsEdit

Reason: Both of these accounts appear to be single purpose sock accounts used for creating disruptive deletion requests, an editing pattern we have seen from some persistent sock masters. Based on the pattern of editing, the user created NWWT to avoid being held to account for their behaviour as Eaglezero and based on the history of both accounts has other master accounts where they have prior experience editing across different Wikimedia projects. Checkuser data may help merge these sock accounts into a preexisting SPI case.

Refer to background case at Commons:Administrators' noticeboard/User problems#NWWT.

Edit patterns: Eaglezero raised a total of 27 DRS all on the single day of 31st March 2018, while NWWT has raised a total of 39 DRs and these were all created over two days 7th and 8th April 2018. These are identical behaviours making it likely that both accounts are part of a larger pattern of sock puppetry. (talk) 13:11, 9 April 2018 (UTC)

Please notice that just like Eaglezero, this IP got angry with one of my DRs (I mean they first participated in a DR that I had opened :) and then opened a series of DRs against files uploaded by this servant. --E4024 (talk) 15:23, 9 April 2018 (UTC)
  • Eaglezero and NWWT are   Unrelated. Handling will need to be based on behaviour. Эlcobbola talk 15:50, 9 April 2018 (UTC)
  • This is not a request, just trying to collect information in one place. AshFriday has refused to state they don't have socks. Eaglezero, Ash and NWWT have all shown similar behaviour by registering and raising numerous DRs in no more than a few days with copypasted rationale. NWWT raised DRs for metal music related photos (Nightwish and Metallica), Ash has issues with nudity. (and profanity) Eaglezero seems to raise DRs for images uploaded by E4024 and user Akbys. (sock of Jhony jhony ha ji) I don't know why. - Alexis Jazz 14:25, 10 April 2018 (UTC)
Well, as I said above, the IP I noted has similar attitude with Eaglezero. Indeed the problem lies somewhere else, I mean from my angle: I wish these two (I believe one person) told me openly what is their problem with me. Let's be honest. Anyhow, forget it. --E4024 (talk) 14:32, 10 April 2018 (UTC)
Further addition: In a much older discussion Ash stated "I'm not a sockpuppet". In that discussion Ash was also suspected of being an INC sock. - Alexis Jazz 14:37, 10 April 2018 (UTC)

MessinaEdit

Suspected related usersEdit

Rationale, discussion and resultsEdit

Reason: Somebody is creating lots of accounts to upload images of Pforzheim that (allegedly) are more than 100 years old, mostly stating that these are "own work". [1] [2] [3] [4] [5] [6] Only a few of their uploads are attributed correctly or almost correctly, as most often the source is still missing. Judging by the topics (scans from books or magazines about pre-war architecture in Baden-Württemberg), this reminds me of the behaviour of the globally banned user Messina (Category:Sockpuppets of Messina). Sitacuisses (talk) 05:18, 26 March 2018 (UTC)

@Sitacuisses: In case the result is positive, do you suggest to bulk delete all uploads, or is there anybody who will review files that look like pd-old and need double check?--Krd 07:13, 7 April 2018 (UTC)
Judging by the historical value that many of these images have, the uploads do deserve an individual review, and there were also a few that seemed OK from the beginning, and some of the descriptions have been improved in the meantime. But I don't feel like I'm able to perform this. Many of these files could at least be transfered to de.wp, since they were published more than 100 years ago. Also, some of the original books or newspapers have had digital copies published under free licenses by libraries or archives. E.g. a scan of "Hans Rott: Kunst und Künstler am Baden-Durlacher Hof bis zur Gründung Karlsruhes (1917)" can be found at HEIDI published under CC BY-SA 3.0 DE. Still, there would be some work left to select correct licenses, check sources etc. It's a pity that the uploader didn't do this correctly in the first place. --Sitacuisses (talk) 13:13, 8 April 2018 (UTC)
I understand, and I do not disagree. But, if we consider as fact that the images need review but there is nobody available who will review them, what is the remaining intention of this CU request, what do you suggest if found positive? --Krd 07:47, 10 April 2018 (UTC)
I'm neither familiar with the details of the Global Ban Policy nor with any method of moving files to de.wp. I don't know either if there still is a group of Messina's supporters at de.wp who are ready and able to fix the files. The main intention of this request is to stop the account hopping and send a message to Messina that he's not getting through with this sloppy and deceptive work. In case the files get deleted, maybe a list of the file names and sources could be useful (e.g. pasted to de:Diskussion:Pforzheim), so anybody would be able to re-upload those files that can be found under an adequate license. --Sitacuisses (talk) 13:26, 11 April 2018 (UTC)
Sounds reasonable. Please give me some time to make some preparations. --Krd 05:56, 13 April 2018 (UTC)
I added a second group of suspected accounts, these have Hebrew names in common. Evidence that points to Messina: Account hopping, poor grasp of the rules of categorization, occupation with archive material and Israel. Many of the categories added by these accounts to Photographs by Willem van de Poll are by far too general or refer to non-essential traits of the images. Just a random example: he added Categories Rivers, Painting and Ships. --Sitacuisses (talk) 13:59, 11 April 2018 (UTC)

MRYSOCKER2017Edit

Suspected related usersEdit

Added March 18–19 following another bunch of attacks:

Discovered and blocked April 2 by Jdx:

Less certain—tentative identification relies on this edit:

A remote guess—from this query and File:DWCL-new-logo-1.png (histlogsabuse log):

Rationale, discussion and resultsEdit

Reason: The vandal was able to register an acc at 11:40 (UTC) when all three known IP ranges were already blocked. It indicates that s/he is operating some IPs yet unknown to the community. Incnis Mrsi (talk) 14:14, 16 March 2018 (UTC)
P.S. The problem is older than I supposed initially. Special:Contribs/110.54.128.0/17 was used since this edit and up to February 15. Incnis Mrsi (talk) 16:35, 16 March 2018 (UTC)
The vandal also certainly has some connection to Obra19 (talk · contribs) due to Revision of File:BANGUI_WINDMILL,ILOCOS_NORTE_2.jpg and https://commons.wikimedia.org/w/index.php?title=Special%3ALog&type=newusers&user=Obra19 and also because Obra19 is likely based in the same country, Philippines. Of course, some connection does not mean “is necessarily the same person” – a productive user would very unlikely turn to a pure vandal. As a guess, “Jojodeladia” may be a nick of the vandal in question who was Obra19’s close friend in 2013. Incnis Mrsi (talk) 17:46, 16 March 2018 (UTC)

Internet search reveals “Jojo deladia” as the same person as Obra19, a photographer. Incnis Mrsi (talk) 19:47, 16 March 2018 (UTC)

Note that Moonrivers (talkcontribsblock logfilter log) has an extensive history of blocks in November–December 2017. Incnis Mrsi (talk) 19:47, 16 March 2018 (UTC)

The first six are likely related. The latter four are possible, but I can't say likely. I don't have time to follow up further. .     Jim . . . (Jameslwoodward) (talk to me) 13:20, 17 March 2018 (UTC)

What about the eleventh item? Six plus four give ten, not eleven. Incnis Mrsi (talk) 06:10, 18 March 2018 (UTC)

Please, check 7 new vandal accs added today. Incnis Mrsi (talk) 06:10, 18 March 2018 (UTC)

Check-users, please, take care about IP ranges used by registered socks observed on April 2. Incnis Mrsi (talk) 06:29, 2 April 2018 (UTC)

Please, check for sleeper accounts using updated list of IP ranges. Incnis Mrsi (talk) 09:23, 17 April 2018 (UTC)

Notes on 203.87.128.0/17Edit

On querying en.Wikipedians a fine structure of the range was revealed. All edits except from two narrow ranges—Special:Contribs/203.87.156.116/30 and Special:Contribs/203.87.171.160/28—are not from MRY. Incnis Mrsi (talk) 12:46, 19 March 2018 (UTC)


For older requests, please see Commons:Requests for checkuser/Archives