Wikimedia Meta-Wiki

Steward requests/Checkuser/2012-11

< Steward requests‎ | Checkuser
Latest comment: 11 years ago by Jasper Deng in topic Requests

Requests

Latest comment: 11 years ago50 comments28 people in discussion

Dhqi1rir57@outreach

Status:    Done

These pattern spambots have been active on Outreach recently. Please consider investigating them to see if a block of their underlying IP can help resolve this problem. Thanks, Mathonius (talk) 07:14, 1 November 2012 (UTC)

Also related might be the following spambots on Incubator:

Mathonius (talk) 07:27, 1 November 2012 (UTC)

  Done - some obvious OPs gblocked. -- Mentifisto 09:16, 1 November 2012 (UTC)

MorganLise@it.wikiversity

Status:    Done

The last two are undoubtedly related, see [1]. These are all spambots. Please consider locking and investigating them. Thanks, Mathonius (talk) 08:03, 1 November 2012 (UTC)

  Done. Blocked and locked. They where related, together with MorganLise22. -- Tegel (Talk) 08:29, 1 November 2012 (UTC)

Hnhkfk67yh@betawikiversity

Status:    Done

Please consider investigating and locking. I hope that more hidden spambot accounts are locked, thanks! Sotiale (talk) 23:09, 1 November 2012 (UTC)

Both now locked. One underlying range already gblocked for a few days, the others are too dispersed. -- Avi (talk) 05:11, 2 November 2012 (UTC)

Vsmv0jft75@outreachwiki

Status:    Done

Please consider investigating and locking these spambots. Thanks, Érico Wouters msg 18:21, 2 November 2012 (UTC)

  Locked and checked. Thanks for the report. Snowolf How can I help? 19:35, 2 November 2012 (UTC)

MahdiBot @si.wikipedia

Status:    Not done
List of users
MahdiBot (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): Engaging in Bot activities in a manner close to Vandalism. Repeats the same edit despite comments in the edit summary. Please check whether the user is registered to act as a Bot in Sinhala Wikipedia & please advice on the action to be taken. ශ්වෙත (talk) 07:48, 4 November 2012 (UTC)
The account has no bot flag. The issue was brought to the bot owner at his page. Please, continue the discussion there.‴ Teles «Talk ˱@ L C S˲» 08:13, 4 November 2012 (UTC)

Ljpmlzjuyo@ss.wikipedia

Status:    Done

I believe these almost simultaneously created pattern accounts are probably spambots. Please consider investigating them. Mathonius (talk) 02:28, 14 November 2012 (UTC)

All confirmed and locked. Ruslik (talk) 14:07, 14 November 2012 (UTC)

Xiamenpx@en.wikiversity

Status:    Done

and

Are these spambots related to each other? Mathonius (talk) 21:21, 14 November 2012 (UTC)

Group 1: yep, definitely   Confirmed. All sockpuppets are blocked and locked now. No new socks found.
Group 2: confirmed as well. There were more related sockpuppets which were already locked by now. I locked the remaining. Trijnsteltalk 22:29, 14 November 2012 (UTC)

Mpb eu@bg.wikipedia

Status:    Done
List of users
Mpb eu (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
White captain (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): Often blocked Bulgarian Wikipedia user who guess registered accounts to require their original research. --Izvora (talk) 21:40, 13 November 2012 (UTC)
  Unrelated-Shizhao (talk) 12:28, 14 November 2012 (UTC)
Can you please double check, since that account in Wikimedia Commons has been blocked a month ago with an expiry time of indefinite with reason "Abusing multiple accounts: Sockpuppet of user {{u|Mpb eu}}". The communication pattern of both users seems to be identical. Thanks in advance. →Spiritia 17:55, 14 November 2012 (UTC)
If this may help, please refer to the relevant discussion. →Spiritia 18:47, 14 November 2012 (UTC)
Could you, please, check for other socks? The discussion Spiritia is quoting is quite convincing for me and inclines me to think that the user is using other socks as well. −PetaRZ (talk) 21:18, 14 November 2012 (UTC)
  Note: both accounts weren't checkusered on commons (I didn't do it either), thus the block doesn't necessarily confirms it. Trijnsteltalk 22:13, 14 November 2012 (UTC)
That's why I said I'm convinced, not that it has been confirmed   −PetaRZ (talk) 23:10, 14 November 2012 (UTC)
Mpb eu not a global user--Shizhao (talk) 01:31, 15 November 2012 (UTC)
True, but the accounts were created on 10 and 11 November 2007 so I think they are from the same person. Trijnsteltalk 18:17, 15 November 2012 (UTC)
  Possible, but both user agent and IP different--Shizhao (talk) 01:57, 16 November 2012 (UTC)

CheckUser for suspected Sock puppetry - Help Required

Status:    Done

Hi Snowolf, I am Tahir Mahmood an Administrator on Urdu Wikipedia. We don't have a local CheckUser.

Can you please confirm the following as a Sock puppetry account of User:S.M.Samee (User has been blocked previously for the on English Wikipedia for the Same)

Reasons (Double Voting)

Voting for a project of S.M.Samee [2]

Specially this voting where he nominated himself (S.M.Samee) as as administrator, and (Sahlay - صالح) is arguing with other administrator for assigning him the administrator rights. [3]

--Tahir mq (talk) 11:26, 15 November 2012 (UTC)

  Confirmed Ruslik (talk) 11:26, 16 November 2012 (UTC)

Spambots on mw.org

Status:    Done

The first one is a typical Chinese spambot. The other two seem to be related to each other as suggested by autoblocks.--Jasper Deng (talk) 05:24, 17 November 2012 (UTC)

  Done --Bencmq (talk) 06:44, 17 November 2012 (UTC)

黃然煌@zh.wikipedia

Status:    Done
List of users
黃然煌 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Chesetongee (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
成知仁 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
舟自横 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Engdeta (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
斯宁是 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Kanyuhwan (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): They share similar editing behaviors on entries related to alumni of Nanjing University, which is obviously disrupting. More sockpuppets might need to be found out.Wcam (talk) 01:21, 18 November 2012 (UTC)
  Inconclusive seems to be a shared or recycled IP, and looks more like what we see for a university rDNS does not help). Many of the accounts mentioned have long history, and some of the accounts are very old so don't have CU data available. I don't believe that CU is particularly going to help on this occasion. The geo-location ip check doesn't locate to Nanjing, or even close. — billinghurst sDrewth 03:20, 18 November 2012 (UTC)

Heng711@zh.wikipedia

Status:    Done
List of users
Heng711 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
鄧子謙 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): 鄧子謙 has registered after Heng711 was blocked for edit warring and keeps edit warring on a similar set of articles. Liangent 06:45, 22 November 2012 (UTC)
Please provide example diffs. — billinghurst sDrewth 13:10, 23 November 2012 (UTC)
One example: [4][5]. --MakecatTalk 08:09, 25 November 2012 (UTC)
Completely   Unrelated. — billinghurst sDrewth 11:52, 26 November 2012 (UTC)

Excelruler@ko.wikipedia

Status:    Done
List of users
Excelruler (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Koreabodyguard (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Beautymissy (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Missrok (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Daiyan (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Nabimi (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
욍로리 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Xianjiangao (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Notekimm (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): Excelruler, Koreabodyguard, Beautymissy, Missrok, Daiyan, Nabimi These users contributes are very same pattern. And they have continually made unfamous joblist documents for long time. User 욍로리 is blocked indifinitely who have made endless sockpuppet. The following day come out user Xianjiangao. He insist to "I'm not 욍로리." But his contributes pattern likes 욍로리. And Notekimm user say to same user 욍로리 and himself. Notekimm insists indifinitely blocking to Xianjiangao. Plotunit (talk) 08:36, 26 November 2012 (UTC)
  Not done I know that I won't be doing a CU for someone not registered on the wiki to which the request is being undertaken. Please have a kowiki sysop endorse this request for it to be reopened. Thanks. — billinghurst sDrewth 11:41, 26 November 2012 (UTC)

I`m registered User. at local wiki, there is existing to formation of checkusing consensus. So, i request again to checkusing.--Altostratus (talk) 15:29, 26 November 2012 (UTC)

  Done two users here, one is your long term vandal
  •   Confirmed same user — Koreabodyguard, Daiyan, Beautymissy, Missrok, Nabimi. Note that Excelruler is an old account and no data exists.
  •   Confirmed 욍로리 ... same user — Xingjiangao, Thechrishong, Bravebones, 남준우, Thebravebones, Kenia12, Kyeonkweon — billinghurst sDrewth 16:00, 26 November 2012 (UTC)

정과@ko.wikipedia

Status:    Done
List of users
정과 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
게이큐읭 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): (google translate + minor edit) Both Users contributing time zone is not overlaping. Nevertheless, a lot of discussion in the comments, ko:토론:마이크로네이션, ko:위키백과:삭제 토론/이계덕 (2), [8], ko:위키백과토론:중재위원회, ko:토론:한나라당 (2012년), there are the same opinion most of overlap in the discussion. and recently, both users are personally requested at usertalk page to move from ko:마이크로네이션 to ko:초소형국민체- Altostratus (talk) 15:23, 26 November 2012 (UTC)
  •   Confirmed 정과 with previous problem child … previously blocked accounts 코리안파워 / Dragonwalk / Orora
  •   Possible JoJooYeon / Wallabsiu / Cheonhs / 내용있음 / D.Weaven — noting that they are accessing/editing from the same IP address, though different user agents, so quite possibly the IP address is shared by funnelled proxy, or gateway. I don't know enough about Korean ISPs, and their use of proxies to be able to advise. Due to the numbers and differences, I would recommend caution, and not to block these accounts without other confirmatory evidence.
  •   Unrelated 게이큐읭

To note that the records held by stewards for checkuser do not identify the original confirmed account with which to align this, so if your wiki has that information available it would be useful for our record keeping. — billinghurst sDrewth 16:46, 26 November 2012 (UTC)

For "possible" part, are those accounts possibly related to 정과?--NuvieK (talk) 18:28, 26 November 2012 (UTC)
I don't find any relation between 정과 or other confirmed accounts and the possibly related accounts. They might just use proxy server.--NuvieK (talk) 18:50, 26 November 2012 (UTC)

Obvious sockpuppetting on cswikiversity

Status:    Done

There is obvious sockpuppetting going on cswikiversity:

IP's of User:Michálek have been already globally blocked as open proxies. User:Docent Hlávka is obviously another sockpuppet.

— Danny B. 14:00, 18 November 2012 (UTC)

  Done--Vituzzu (talk) 15:12, 18 November 2012 (UTC)

ta.wikipedia.org

Status:    Done
List of users
Sitralega (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
T.shan56 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Kovaisarala (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): Similar comments tagetting one specific admin user, boardering on threats. They are targetting about 3 related articles. They refuse to provide any valid references for info they want to add to those articles, while always trying to impose their content/view points in the articles. Various community members have tried to engage them in a meaniful dialog, but they always resort to personal attacks and name calling. --Natkeeran (talk) 16:36, 28 November 2012 (UTC)
  Confirmed. The full list of socks:
Sitralega
Kovaisarala
T.shan56
Doreen Arul
Comment.theva
Lalapappa
Ruslik (talk) 18:38, 28 November 2012 (UTC)

Patternbots on Wikidata

Status:    Done
List of users
Ashley17Ashley1983 ([[
Special:Contributions/Ashley17Ashley1983|contr]] · [[
Special:DeletedContributions/Ashley17Ashley1983|deleted]] · block · log · block log · CA · guc · checkuser · lwcheckuser)
Eugenio5Eugenio1971 ([[
Special:Contributions/Eugenio5Eugenio1971|contr]] · [[
Special:DeletedContributions/Eugenio5Eugenio1971|deleted]] · block · log · block log · CA · guc · checkuser · lwcheckuser)
Jack14Jack1981 ([[
Special:Contributions/Jack14Jack1981|contr]] · [[
Special:DeletedContributions/Jack14Jack1981|deleted]] · block · log · block log · CA · guc · checkuser · lwcheckuser)
Alethea5Alethea1974 ([[
Special:Contributions/Alethea5Alethea1974|contr]] · [[
Special:DeletedContributions/Alethea5Alethea1974|deleted]] · block · log · block log · CA · guc · checkuser · lwcheckuser)
Carlota4Carlota1981 ([[
Special:Contributions/Carlota4Carlota1981|contr]] · [[
Special:DeletedContributions/Carlota4Carlota1981|deleted]] · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): These are suspected spambots, based on the pattern ([Name][two digits][Name]19[two digits]) what Special:Log/globalauth/Vituzzu and Special:Log/globalauth/Teles have been doing in the past day or so. Note that the links above are wrong because the template is linking en.wikidata.org - the correct domain is www.wikidata.org.--Jasper Deng (talk) 17:22, 29 November 2012 (UTC)
  Confirmed All above accounts (as well as Millie14Millie1971) belong to the same person. However they are different from the well known spambot that operates on mediawiki and other wikis. Ruslik (talk) 19:24, 29 November 2012 (UTC)
On suspicion of them being patternbots (having been created in rapid succession), and in light of these, Wiki13 and I have locally blocked all of the accounts.--Jasper Deng (talk) 19:52, 29 November 2012 (UTC)
Retrieved from "https://meta.wikimedia.org/w/index.php?title=Steward_requests/Checkuser/2012-11&oldid=24950699"