Wikimedia Meta-Wiki

Steward requests/Checkuser/2012-07

< Steward requests‎ | Checkuser

Requests

Amazingloong@zh.wikipedia

Status:    Done
List of users
Amazingloong (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Bradleykong (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): Amazingloong was blocked for copyright violation. During his or her blocking, a suspicious account edited the article and their attitudes appear to be alike.Zhxy 519 (talk) 03:52, 2 July 2012 (UTC)
Unrelated  Unrelated Ruslik (talk) 08:45, 2 July 2012 (UTC)

Ef0987qy@en.wikiversity

Status:    Done

These spambots are undoubtedly related to Ef0987qy (talk • contribs • block • xwiki-contribs • xwiki-date (alt) • CA • ST • lwcheckuser) on en.wikipedia. Please consider investigating it and - if possible - blocking its underlying IP. Mathonius (talk) 11:50, 4 July 2012 (UTC)

Ef0987qy doesn't exist on en.wikiversity - it does exist on en.wikipedia, but you already mentioned that one. I think you meant Ef0960qy on mi.wiktionary. In any case, both are   Confirmed and I found more sockpuppets cross-wiki. All locked and an open proxy range globally blocked. Trijnsteltalk 14:41, 4 July 2012 (UTC)
Apologies, I must have made a mistake. I meant Ef7906qy (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser). Thanks for the good work, Trijnstel. Mathonius (talk) 16:35, 4 July 2012 (UTC)

Ldje874j@mediawiki

Status:    Done

Please investigate this new account of the Chinese blogpost spammer at mediawiki.org (see here for a related request in June 2012). Mathonius (talk) 02:08, 5 July 2012 (UTC)

Done. It shares info with other spam accounts. No others found.‴ Teles «Talk ˱@ L C S˲» 02:34, 5 July 2012 (UTC)

IlhgbbOgqjvy@br.wiktionary

Status:    Done

These accounts might be - judging by their pattern usernames and the fact that they were all created within a few minutes - related. I'm (also) afraid they might be spambot. Please consider investigating them. Mathonius (talk) 16:13, 5 July 2012 (UTC)

The following accounts match this pattern:

Mathonius (talk) 16:44, 5 July 2012 (UTC)

I happened to see LkrdfbKdnule (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser) at incubator, which suggests there could be many more of these. Mathonius (talk) 16:51, 5 July 2012 (UTC)

All   Confirmed as socks of one spambot. Ruslik (talk) 18:23, 5 July 2012 (UTC)

RudrockoHicks@mi.wikipedia

Status:    Done

Please investigate these pattern accounts. More may follow shortly. Mathonius (talk) 16:17, 5 July 2012 (UTC)

As well as:

Mathonius (talk) 16:23, 5 July 2012 (UTC)

Fyi, I've added something to the title blacklist. This group of accounts resemble this group, which Teles locked and investigated yesterday. Mathonius (talk) 16:34, 5 July 2012 (UTC)

As well as:

Mathonius (talk) 16:41, 5 July 2012 (UTC)

I blocked underlying IPs. Ruslik (talk) 19:19, 5 July 2012 (UTC)

李煌老师@zh.wikipedia

Status:    Done
List of users
超级理科生刘朋 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
WP：LHLS (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
高考成绩要公布了 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Kaishi01 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Luoqwer (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): 超级理科生刘朋, WP：LHLS, 高考成绩要公布了 are new puppet accounts of zh:User:李煌老师. zh:User:Makecat, an administrator thinks that Luoqwer isn't puppet accounts of zh:User:李煌老师 (see zh:Wikipedia:当前的破坏/存档/2012年4-6月#请求封禁这些账号). see Steward_requests/Checkuser/2012-06#氪跨拉乌@zh.wikipedia.

—The preceding unsigned comment was added by 2011wp (talk) 09:48, 3 July 2012

Title should be changed, but I don't know what should I write.--Justincheng12345 (talk) 11:09, 3 July 2012 (UTC)
What about this one? Trijnsteltalk 14:30, 3 July 2012 (UTC)
A more user:אנסאנסאנס (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)--2011wp (talk) 07:16, 5 July 2012 (UTC)
see below.--2011wp (talk) 07:23, 5 July 2012 (UTC)
A more user:Ideal_gas_equation (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)--59.41.119.197 07:55, 6 July 2012 (UTC)--2011wp (talk) 07:56, 6 July 2012 (UTC)

IhwvgySbliqy@ang.wikipedia

Status:    Done

These accounts match the pattern of this group (see also these two accounts) and may very well be spambots. I've only listed those that haven't been locked yet. Please consider investigating and perhaps locking them. Thanks, Mathonius (talk) 18:27, 6 July 2012 (UTC)

They all belong to same spam-bot as those in the 'IlhgbbOgqjvy' request above. All locked. Ruslik (talk) 15:48, 7 July 2012 (UTC)
Thank you very much. Mathonius (talk) 17:04, 7 July 2012 (UTC)

MazdakAbbedi@fa.wikipedia

Status:    Done
List of users
MazdakAbbedi (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Delta2000 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
جنگولک (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): A previous request has showed that Persian Wikipedia has a user who is systematically creating impersonating accounts. Today I blocked another impersonating account (MazdakAbbedi) and I'd like to cross check this to the previous impersonator (Delta2000) as well as a longtime troll (جنگولک). Huji (talk) 01:45, 8 July 2012 (UTC)

MazdakAbbedi is Jeromesearch, Barat moteasefam and Катякос laying on an open proxy I already gblocked, they seem to be some-way related to Delta2000 but not to جنگولک. --Vituzzu (talk) 08:28, 8 July 2012 (UTC)

Froklin@hi.wikipedia.org

Status:    Done
List of users
William bal klinton (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Sugandha (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): This user is hounding me since the very first day of his account creation. Inefficient to participate in any sensible discussion, he is repeatedly attacking me on my posts. Most of his edits are targeted on me. Now, a user (William bal klinton) has popped up out of the blue to mock me on the Village Pump (locally Chaupal) which is highly defamatory for me. Notice the signature style he is using <>< William ball klintonवार्ता and mine on Hindi Wiki: <>< Bill william comptonTalk. Actually, there are some users who are inspired with Indian nationalism and don't have bit of knowledge to write an encyclopaedia. Easy illustration of their sick ideology is that they think that "creating a featured article on a British topic would make India slave" and indirectly call me Queen's Servant, anti-Indian, anti-Hindi, etc. And, the most unfortunate thing is that a user without any knowledge of neutrality, copyrights, reliability of sources, deletion policy of local project and basic sense of manual of style is an administrator.--Bill william compton (talk) 05:02, 27 June 2012 (UTC)
  • Fishing  CheckUser is not for fishing Do you have diffs or other technical or behavioral evidence to indicate that these two people are the same person, other than that each one does not seem to like you? -- Avi (talk) 06:43, 27 June 2012 (UTC)
Besides the choice of signature styles, both the users give unnecessary indentation for a new section (Froklin William bal klinton), which is very unusual. Also, the writing style is similar.--Bill william compton (talk) 11:27, 27 June 2012 (UTC)

-- Avi (talk) 17:18, 9 July 2012 (UTC)

  • Avi, I am a novice in these matters, but can you shed further light as to how do you rule out the possibility of there being two/more different users (lets say from same family/home) editing from the same computer. Or is it irrelevant? Lovysinghal (talk) 05:23, 10 July 2012 (UTC)
    • I cannot rule that out, which is why I requested the HiWiki community to investigate further. All I can say is that the above 5 accounts share IPs and technical evidence, and that there are no other accounts which do so (at least in the past three months) so they are certainly related. Whether they are truly one person with sockpuppets or multiple people in the same dwelling sharing the same computer in the same residence is impossible to tell with Wikimedia software. Whilst it is not irrelevant, usually, people will self identify if they share a computer. As an aside, while I would have to pull all the data again to be sure, my recollection is that the timestamps of the edits are such that it indicates one person rather than multiple people, as best I recall. -- Avi (talk) 06:34, 10 July 2012 (UTC)

Đài_Loan_Mỹ_Việt_lợn@zh.wikipedia

Status:    Done
List of users
Đài_Loan_Mỹ_Việt_lợn (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
אנסאנסאנס (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
A900040a900040 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): see zh:WP:KAGE 2011wp (talk) 07:21, 5 July 2012 (UTC)
The following list of users looks   Confirmed sockpuppets:
  • אנסאנסאנס
  • Đài Loan Mỹ Việt lợn
  • 朱海军
  • CivilagainIII
  • Ideal gas equation
  • 超级理科生刘朋
  • 赵明毅教授
  • Guke9527
  • 方滨兴院士
  • 反网特
  • Kage-bot
  • 高考成绩要公布了
  • WP：LHLS
  • 氪跨拉乌
  • 英文（简体）
  • 挡的政策亚克西
  • Goe Juna
  • 苏州中学每况愈下
  • Atomsgivenanti
  • VeryVitalPerson
It is Rejected 

rejected to check A900040a900040 as it does not seem to show disruptive behaviour.

-- MA 19:54, 10 July 2012 (UTC)

CivilagainIII@zh.wikipedia

Status:    Done
List of users
CivilagainIII (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
赵明毅教授 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): see zh:WP:ZMY 58.62.197.233 07:23, 8 July 2012 (UTC)2011wp (talk) 00:53, 9 July 2012 (UTC)
I'd rather say from their edits the users are likely to be socks of User:李煌老师. Bencmq (talk) 09:08, 8 July 2012 (UTC)
I think this has already been answered in the above request. Both users appears to be related. -- MA 19:58, 10 July 2012 (UTC)

Pjatro@be-x-old.wikipedia

Status:    Done
List of users
Pjatro (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
178.123.180.55 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Ales-ne muxin (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): A request for deletion of a disputable notability article was filed by an anonymous user, than supported by several newly registered yet unconfirmed users. Also suspicious intersecting activity in be-x-old:Relikt Wizardist (talk) 19:32, 12 July 2012 (UTC)
  Confirmed that Pjatro = Ales-ne muxin. No comments on IP address, as always. Bencmq (talk) 19:58, 12 July 2012 (UTC)
Thank you. Sockpuppet Pjatro blocked indefinitely, its owner warned (reasonable amount of productive edits for the past time). Wizardist (talk) 20:23, 12 July 2012 (UTC)

Tayas@zh.wikipedia

Status:    Done
List of users
Tayas (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Okeout (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): Abusing multiple accounts: 1. Both accounts have voted "support" in zh:Wikipedia:優良條目候選/提名區 (nomination for good articles) for a movie article nominated by Okeout. 2. Block evasion by using the account Tayas while Okeout is being blocked. I suspect both accounts are operated by the same person becasue they repeatedly add the same contents in zh:Wikipedia:沙盒 (sandbox). Mewaqua (talk) 10:33, 13 July 2012 (UTC)
Possible  Possible, with both usernames operating from a very busy range. The ISP seems to have a whole series of proxies with numbers of users, including users with elevated rights, with the IPs and access times overlapping. Checkuser is not going to be a lot of help. — billinghurst sDrewth 11:02, 13 July 2012 (UTC)

D&S@pt.wiktionary

Status:    Done
List of users
OCU569 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Leonardo Melanino (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Leonardo Pereira Araújo (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): A new user has behaved just like the banned user today in his first edit. Please check OCU569 with these two confirmed sockpuppets so I can make sure it's him and know if there are more open proxies and IP ranges involved. See this request for more information. Thanks in advance, Defender (talk) 14:35, 13 July 2012 (UTC)
Possible  Possible, though I am leaning towards probably, though not all the way to likely; though no smoking gun. Same ISP, though enough variations to put some doubt, some matches on user agent, but no match for all three, but that could be browser upgrades. Better match between 2 and 3, than 1. — billinghurst sDrewth 16:24, 13 July 2012 (UTC)

Nobody60@de.wikiversity

Status:    Done
List of users
FritziWitzi (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Nobody60 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): In de.wikiversity there is a controversial discussion about changing the project roles. After removing the negative votes of three IP-user there were only one vote of a normal user left (User Nobody60) but one day after denying the IP-votes there was a vote by a new user (User FritziWitzi) so there is suspicion that FritziWitzi is a sock puppet. --Jan Luca (talk) 09:48, 14 July 2012 (UTC)
Unlikely  Unlikely/Inconclusive  Inconclusive Ruslik (talk) 15:02, 15 July 2012 (UTC)
Thank you. Jan Luca (talk) 13:35, 17 July 2012 (UTC)

Noooor@fa.wikipedia

Status:    Done
List of users
Noooor (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Delarama (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): Some users believe user:Noooor is another sock puppet of previously blocked user:Delarama because they have the same editing patterns and behavior. Thanks. -- Dalba(talk) 27 Tir 1391/ 16:39, 17 July 2012 (UTC)
It's very Likely  Likely they are sockpuppets of eachother. Another sleeper with no edits is fa:User:Haaaaafez. Trijnsteltalk 20:47, 17 July 2012 (UTC)

AlmaCsf@nl.wikisource

Status:    Done

This username matches this pattern. Please consider investigating this account. Mathonius (talk) 18:04, 17 July 2012 (UTC)

I locked that account as well as some others I found. They were created on dynamic ISPs in a large country (I assume you know which one). I did however, block a web host/proxy used. --Bsadowski1 (talk) 19:26, 17 July 2012 (UTC)

Cyrax Cyborg, MistrX & Co.@es.wikibooks

Status:    Done

On June 2, 2012 we noticed at es.wikibooks that a flood of new users —created the same day or in the same week— were creating requests for adminship for themselves or nominating one of those newly users. CheckUser later proved that it was an sock-master from es.wikipedia —now unbanned there— that tried to gain administrator access at various projects by deceiving the communities using sockpuppets to support himself in the RfAs. Evidence of that can be found here. The CheckUser performed at that time —which was not recorded here but requested through the ML if I remember correctly— discovered that the following accounts were owned by the same person:

  1. Denver200 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
  2. Bikkman (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
  3. BlueFen (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
  4. Brousel (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
  5. Stee (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
  6. Brunderick (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

Those accounts were subsequently blocked and the main account —if can be called that— extensively informed for the reasons of the block, and strongly admonished not to use —cross-wiki— sockpuppetry to cheat the communities.

However just today, and following the past modus operandi of the above mentioned accounts, the user b:es:Especial:Contribuciones/MistrX which registered today and has just two contributions in the project opened a nomination —RfA— b:es:Wikilibros:Candidaturas a bibliotecario/Cyrax Cyborg for the user b:es:Especial:Contribuciones/Cyrax_Cyborg with just seven edits in total in the project and that also registered today too.

In normal circunstances the RfA would simply be archived and the user adviced to gain more experience before standing again. However, and suspecting that there is probably a ban evasion I kindly request you to verify whether the users Cyrax Cyborg (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser) and MistrX (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser) can be the same as the ones mentioned above so the measures for violating the project policies and guidelines, such as further blocks, can be issued. It might be a coincidence, but MistrX@es stopped editting shortly after MOVIST@es was unblocked: unblock on 16-06-2012 - last edit on 15-06-2012. CC@es shows somewhat traits of advanced editting in spite of having registered just in June this year.

Thank you. — MA (audiencia) 22:05, 17 July 2012 (UTC)

Inconclusive  Inconclusive. I performed a check and I'd say meatpuppets for now. Details will be send to you privately. Trijnsteltalk 10:42, 18 July 2012 (UTC)

ShelliEin@strategy.wikimedia et cetera

Status:    Done

Please consider investigating this suspected spambot. Almost all new accounts on the strategy-wiki are spammers and this one matches a recent pattern.

Also suspicious are

And the last few weeks, small batches of spambots are being created at the Indonesian wikis. For example, I find the following very interesting:

Two of these match the above-mentioned pattern.

Please also take a look at id:s:Special:RecentChanges, there might be some spammers among those new accounts, especially:

The last two match this pattern.

Many thanks in advance. I hope this information helps. Mathonius (talk) 01:10, 19 July 2012 (UTC)

See #CarolynZrk@mediawiki.org as well. Mathonius (talk) 22:16, 19 July 2012 (UTC)

Please also take a look at:

Mathonius (talk) 23:55, 19 July 2012 (UTC)

Done with everything except for the Commons spambot. I blocked many web host/proxies involved. I also locked the accounts (except for the Commons one because it's not confirmed yet). --Bsadowski1 (talk) 02:37, 20 July 2012 (UTC)

Bswjx981@de.wikisource & Drafw594@de.wikinews

Status:    Done

Please check if these are related. I'm afraid they might be pattern spambots. Mathonius (talk) 23:03, 19 July 2012 (UTC)

Possible  Possible --Luckas msg 21:49, 20 July 2012 (UTC)

Pricehvmr48@ch.wikipedia

Status:    Done

Please check this pattern spambot and block its underlying IP (range) if possible. It belongs to the following group:

I'll also request a CU for two of these at Commons, see here. Mathonius (talk) 02:30, 21 July 2012 (UTC)

Done.‴ Teles «Talk ˱@ L C S˲» 02:42, 21 July 2012 (UTC)

Polosxyhns@oldwikisource

Status:    Done

Please investigate these pattern accounts. Mathonius (talk) 03:00, 21 July 2012 (UTC)

Fyi, I've added the pattern to the title blacklist. Mathonius (talk) 03:20, 21 July 2012 (UTC)
Done.‴ Teles «Talk ˱@ L C S˲» 06:36, 22 July 2012 (UTC)

Codename Protest@zh.wikipedia

Status:    Not done
List of users
Codename Protest (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Zhxy 519 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): Likely pretend to be another user(similar username of a discarded username "Codename Protector"). Close and hide many discussions in village pump deliberately without authorization,[1] also argued in such discussions in insult language by another username "Zhxy 519".184.75.35.50 08:11, 21 July 2012 (UTC)
Question: Why zh:User:Zhxy 519 needs to be checked? — MA (audiencia) 17:34, 21 July 2012 (UTC)
Strong Oppose ,It's an IP user, Probably unnecessarily apply Checkuser.--2011wp (talk) 13:43, 22 July 2012 (UTC)
  Not done We do not usually honour CU requests from unregistered users. Ruslik (talk) 16:10, 22 July 2012 (UTC)

Tn5632tnfr@miwiktionary

Status:    Done

Suspected spambots. --Ignacio   (talk) 03:56, 22 July 2012 (UTC)

At least the last one on the above list is a spambot, in addition to Air6644ntt (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser) at mediawiki.org.--Jasper Deng (talk) 06:01, 22 July 2012 (UTC)
and Inti5863jj (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser) at ti.wiktionary --Ignacio   (talk) 06:12, 22 July 2012 (UTC)
All locked. Ruslik (talk) 16:07, 22 July 2012 (UTC)

李煌老师@zh.wikipedia (11th)

Status:    Done
List of users
Xuanwang3881088 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
撒都好烦哈桑东方红搜狐法搜飞鸿 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Zhxy_512 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Moun_sòt_idiotas (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
第十次动员令主持人 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
时昭先生 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Where is KAGE? (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Jimnny_xu_wrk (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
2htreblA (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
WP：VIP (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): zh:WP:LHLS, well-known targets of serial vandalism2011wp (talk) 08:32, 19 July 2012 (UTC)

--2011wp (talk) 13:41, 22 July 2012 (UTC)

  1. 蘇州宇武宙文 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
  2. 你亦可以选择让其他人通过你的 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

--2011wp (talk) 07:22, 23 July 2012 (UTC)

  • 3 more users:
  1. Whenlaugh (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
  2. 打烂过滤器！ (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
  3. FilterAbuserwaterscale (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

--2011wp (talk) 07:45, 24 July 2012 (UTC)

  • 2 more users:
  1. TacekaM.rM (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
  2. 基米许万人坑 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

--2011wp (talk) 09:33, 24 July 2012 (UTC)

Results
  • All   Confirmed
  • New sock puppets:
    • Realrocksofcukinggood
    • 五百万个条目了
    • NewsheardWTF

— MA (audiencia) 10:36, 24 July 2012 (UTC)

Ronochen@zh.wikipedia

Status:    Done
List of users
Sdee (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Ronochen (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

Reason(s): Suspected sockpuppet because:

    1. Ronochen took part in Deletion Request for its first time, and gave comment to try to keep the article w:zh:2012年5月澳門電訊網絡故障事件 which is created by Sdee. [2]
    2. During the Deletion Request discussion, Ronochen said something to attack the deletion requester in w:zh:WP:DYKN. [3]
    3. After the Deletion Request discussion was closed for "no consensus", Ronochen even still complained that and said the article should be "kept" forever. [4]
Therefore, I suspect that Sdee was using Ronochen to disrupt the discussion in order to keep the article. Please check, thank you. --174.120.98.2 18:19, 21 July 2012 (UTC)
Please also check Inhins (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser), act similarly in the discussion and usually helps Sdee in DYK nominations. Past result shows that proxy is involved. Please also check whether underlying proxy is involved this time. Thanks.--CDIP No.150 repair meter 16:12, 22 July 2012 (UTC)
Oppose ,IP user apply Checkuser.--2011wp (talk) 00:11, 23 July 2012 (UTC)
Reply: Now the request is supported by Cdip150. --Makecat (talk) 01:55, 23 July 2012 (UTC)
Ronochen is   Confirmed, but Inhins is Unlikely  Unlikely. Ruslik (talk) 18:02, 23 July 2012 (UTC)

Haccpdq@zh.wikipedia

Status:    Done
List of users
Haccpdq (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Gh66keey (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Meneopg12 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Ttbadk (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Capcatw (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Ddtceh (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Univityeed (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): Those users above not only advert in article zh:朱明_(画家) but also edit the article in a "special" manner (removing RfD template, notability template, and etc.) Apparently there is a conflict of interest. Some of them are already blocked. Please check them therefore we can determine the relationship between them and decide what to do next. -Mys_721tx(talk) 08:49, 22 July 2012 (UTC)
The full list of   Confirmed socks:
Ddtceh
Ttbadk
Meneopg12
Haccpdq
Qglogaz
Gh66keey
Gh66ke
Univityeed
Vtpacv
Lgpabce
Bcdcaj
Cfabic
Flachon
Pabdktt
Z19yk88
Greeyat
Bakeyer
Yamaaholo
Hkcnsgt
Ctchkjpm
Kworkthk
Glaywho8
Gattpm
Builinkyogf
Capcatw
Qk5432hello1
Atmn5a
Cattac8
Cd593aw468
C11819155
Ruslik (talk) 15:56, 23 July 2012 (UTC)
Thanks!--Mys_721tx(talk) 21:05, 23 July 2012 (UTC)

Xiaojian54@incubator

Status:    Done

These two spambots are obviously related to the following accounts (on wikis that have local CUs). Please consider investigating them.

Thanks, Mathonius (talk) 07:32, 24 July 2012 (UTC)

Result:   Confirmed Also found socks below:
Babycandy@species

✒ Bennylin 12:13, 24 July 2012 (UTC)

Kl0925@zh.wikinews

Status:    Done

Suspected pattern spambots. Thanks --Ignacio   (talk) 01:18, 21 July 2012 (UTC)

  Confirmed--Shizhao (talk) 12:52, 25 July 2012 (UTC)

Wildfire@fa.wikipedia

Status:    Done
List of users
Wildfire (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
ANPATU (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Sistemos (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Hillocuper (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Bijangerd (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): We know that Sistemos, Hillocuper, and Bijangerd are sock puppets of user:Stetar and they have been blocked. Hillocuper and Wildfire have been created nearly the same date and time; Sistemos, Hillocuper, and Wildfire all have had suspicious edits in article fa:ارومیه. ANPATU and Wildfire both have participated in edit war against user:Farvartish and Wildfire is active after the day ANPATU became inactive. -- Dalba(talk) 3 Mordad 1391/ 16:17, 24 July 2012 (UTC)

  Confirmed:

  • Wildfire
  • Kiyaps
  • Bozorgan
  • جواد بیاتی
  • TuiJiani
  • Tuijian
  • Tupbashi
  • Arhamorrahemin
  • Arabalidoosti
  • Sistemus
  • Politicus
  • Lujali
  • Bijangerd
  • Saman.akbaryan
  • Mehrkhane
  • Nurani
  • Muslimsafi
  • Ahmadbahmani
  • Tala-mazandaran
  • Aliafshari235
  • Kashani.salar
  • Faranak373
  • Fatikhabnama
  • Sistemos
  • Hillocuper

Unrelated  Unrelated:

  • ANPATU

--Shizhao (talk) 14:28, 25 July 2012 (UTC)

Status:    Done

This appears to be a human spammer. All are spamming Miami-related stuff.--Jasper Deng (talk) 17:15, 25 July 2012 (UTC)

  Done locked socks --Jyothis (talk) 17:28, 25 July 2012 (UTC)

Hhpmrdofvc@crwikipedia

Status:    Done

Please consider taking a look at these recently created pattern (H[a-z]{3}rdo[a-z}{3}) accounts. Mathonius (talk) 21:58, 25 July 2012 (UTC)

  Done by PeterSymonds. Thanks, Mathonius (talk) 22:26, 25 July 2012 (UTC)

Velafqhdis5x@piwikipedia

Status:    Done

Please consider taking a look at these recently created pattern accounts. Mathonius (talk) 22:26, 25 July 2012 (UTC)

  Confirmed --Luckas msg 22:57, 25 July 2012 (UTC)

Jlhssjfgc@bxrwikipedia

Status:    Done

Please consider taking a look at these recently created pattern accounts. Mathonius (talk) 22:26, 25 July 2012 (UTC)

  Confirmed --Luckas msg 22:57, 25 July 2012 (UTC)

Xiangyu0088@strategywiki

Status:    Done

The following pattern accounts were created in (three?) batches, all on small wikis.

And the following accounts (which could be related to the above-mentioned):

As well as:

Mathonius (talk) 22:59, 25 July 2012 (UTC)

  Done, all related and locked. --Luckas msg 23:33, 25 July 2012 (UTC)

김경민@ko.wikipedia

Status:    Done
List of users
김경민 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Roks0905 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
낙화산 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): We agree this request. Please check this link. --Dynamic-Labor☭(U,T,C,M) 08:55, 25 July 2012 (UTC)
According to suggested discussion, 김경민 started featured article lifting discussion. But another account(Roks0905) is created after it started, only edited it. In addition, two account editing pattern is same(indent editing habit). Sotiale (Talk·Contribs) 10:39, 25 July 2012 (UTC)
김경민 had been once blocked permanently due to the bad use of multiple user accounts (sock puppetry). As he promised that he will not make more accounts to make trouble, he was unblocked and he is currently under close observation by Arbitration Committee. However, 윤성현 insisted that 김경민, Roks0905, and 낙화산 have very similar pattern of editing. For example, Roks0905 and 낙화산 prefer to make lots of indentation when they talk[5][6]. Also, those three users used offensive language on 윤성현's Talk page according to 윤성현.[7][8][9] Some people also support the 윤성현's request for the sockpuppet investigation. Ykhwong (talk) 10:45, 25 July 2012 (UTC)
I think this resquit is so fast so, I think wait 2 days (these days we will check more opnion) after check it.--DangSunM (talk) 21:06, 25 July 2012 (UTC)
I am 윤성현. Although user:DangSunM says wait for 2 days, but this is not right because the request has been up whatsoever. Consensus has been created in the request page of Korean Wikipedia, so I think it is okay to proceed the checkusing. -- Shyoon1 (talk) 00:30, 26 July 2012 (UTC)
I checkuser page don't have a time i'm sorry about misunderstanding--DangSunM (talk) 00:45, 26 July 2012 (UTC)
I also think it don't have any problems doing checkusing now. Please chech these users. --비엠미니 (talk) 02:07, 26 July 2012 (UTC)
Note  Note: I'm working on this request. — MA (audiencia) 11:36, 26 July 2012 (UTC)
  Confirmed — MA (audiencia) 13:24, 26 July 2012 (UTC)

GabrioleiDonn@bmwikipedia

Status:    Done

Please lock and investigate these pattern accounts (Gabri[a-z]le[a-z]D[a-z]nn). Mathonius (talk) 20:23, 25 July 2012 (UTC)

Done.‴ Teles «Talk ˱@ L C S˲» 00:04, 26 July 2012 (UTC)

RegineMarshall81@nlwiktionary

Status:    Done

Please check these pattern accounts. StephnieThompson85 (talk • contribs • block • xwiki-contribs • xwiki-date (alt) • CA • ST • lwcheckuser) on meta might also be related. Mathonius (talk) 23:26, 25 July 2012 (UTC)

The following pattern accounts on nl.wikt might also be interesting:

Mathonius (talk) 23:30, 25 July 2012 (UTC)

Also related could be:

Mathonius (talk) 23:46, 25 July 2012 (UTC)

Unrelated  Unrelated Ruslik (talk) 09:13, 26 July 2012 (UTC)

Haccpdq@zh.wikipedia 2

Status:    Done
List of users
Faacatk (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Swortyk (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Qwmzna (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Acadeerd (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Capcatw (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Tqacminf (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Yorktchany (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Eeodtipaz (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Ambcak (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Openeopk (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s):
Few more here, please also check them, thank!-Mys_721tx(talk) 03:54, 24 July 2012 (UTC)

116.231.0.0/16 socks:

already blocked:

  • Ssart3y
  • Faacatk

reported above:

  •   Confirmed Cap299s9 (same IP)
  •   Confirmed Swortyk (same pattern)
  •   Confirmed Qwmzna (same pattern)
  •   Confirmed Acadeerd (same pattern)
  •   Confirmed Tqacminf (same pattern)
  •   Confirmed Sfilines (same pattern)
  •   Confirmed Yorktchany (same pattern)
  •   Confirmed Rqlget (same pattern)
  •   Confirmed Eeodtipaz (same pattern)
  •   Confirmed Bapagjdjd (same pattern)
  •   Confirmed Addrya (same pattern)
  •   Confirmed Deerider (same pattern)
  •   Confirmed Ambcak (same pattern)
  •   Confirmed Openeopk (same pattern)
  •   Confirmed Dfhgtoa1 (same pattern)
  •   Confirmed Capcatw (already confirmed by Ruslik above)

✒ Bennylin 11:45, 24 July 2012 (UTC)

Thanks! --Mys_721tx(talk) 19:47, 27 July 2012 (UTC)

反滥权协会@zhwiki

Status:    Not done
List of users
反滥权协会 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
真理永不倒！！！ (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
锑锑的水大了 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
呜拉！玻色子！ (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
锂磺老湿 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): Makecat thinks that zh:User:反滥权协会 is a is a sock puppet of 李煌老师. 2011wp (talk) 01:04, 25 July 2012 (UTC)

Sorry but this request still lacks evidence. Why do you think those accounts are sockpuppets? Which disruption are those users performing? User-name pattern alone is not itself a reason to run a check. Other evidence should follow. Thanks. — MA (audiencia) 13:29, 26 July 2012 (UTC)

OK, I think that this request could be closed since all the above-listed user is now blocked by admin due to vandalism. So, CheckUser won't have any effect as they are already blocked. Thank you and please close this request. --HWChat - zhwp 14:18, 26 July 2012 (UTC)
I will close the request until new suspected sock puppet appears.--2011wp (talk) 00:08, 27 July 2012 (UTC)
  Not done, request withdrawn. Bencmq (talk) 06:59, 27 July 2012 (UTC)

Elias7414@oldwikisource

Status:    Done

Please consider checking this batch of pattern accounts. Mathonius (talk) 03:06, 26 July 2012 (UTC)

  Done and thanks. Pundit (talk) 01:23, 27 July 2012 (UTC)

방송내용정리@ko.wikipedia

Status:    Done
List of users
방송내용정리 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
해적사냥꾼 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
알려지지않은사용자 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
무안읍기득권박멸 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): We(Local Community) agree this request. Please check this link. --Dynamic-Labor☭(U,T,C,M) 10:45, 27 July 2012 (UTC)
  Confirmed Group A
알려지지않은사용자
무안읍기득권박멸
방송내용정리
  Confirmed Group B
해적사냥꾼
악마그림자
The relationship between the two groups are Inconclusive  Inconclusive.
-- Bencmq (talk) 04:04, 28 July 2012 (UTC)

Joce0045pj62@be.wikimedia

Status:    Done

Please checking pattern accounts. --Ignacio   (talk) 03:01, 28 July 2012 (UTC)

Done. Thank you for reporting.‴ Teles «Talk ˱@ L C S˲» 04:06, 28 July 2012 (UTC)
:). --Ignacio   (talk) 04:13, 28 July 2012 (UTC)

Jxtzpqfge@simplewiktionary

Status:    Done

Please consider checking these pattern (J[a-z]{5}fg[a-z]{1}) accounts. Thanks, Mathonius (talk) 02:06, 30 July 2012 (UTC)

Likely  Likely --Jyothis (talk) 03:05, 30 July 2012 (UTC)

Hqqurdgbmn@bxrwikipedia

Status:    Done

Please consider checking these recently created pattern (H[a-z]{3}rd[a-z]{4}) accounts. Are they related to Jxtzpqfge et cetera? Mathonius (talk) 03:04, 30 July 2012 (UTC)

These were created just now:

Mathonius (talk) 03:14, 30 July 2012 (UTC)

Related to the previous set above. --Jyothis (talk) 03:14, 30 July 2012 (UTC)

TamaraDvp@cawikisource

Status:    Done

These accounts match this pattern. Are they in any way related? Mathonius (talk) 02:42, 30 July 2012 (UTC) (edited at 04:39, 30 July 2012 (UTC))

  Done spambots — billinghurst sDrewth 14:13, 30 July 2012 (UTC)

M7o3neyp@zhwikipedia

Status:    Done

Are these pattern accounts related? Mathonius (talk) 04:17, 30 July 2012 (UTC)

yes, done — billinghurst sDrewth 14:24, 30 July 2012 (UTC)

HalseyHolden6@gotwikipedia

Status:    Done

And perhaps also the following:

Are these pattern accounts related? Mathonius (talk) 04:44, 30 July 2012 (UTC)

Yes   Done — billinghurst sDrewth 14:00, 30 July 2012 (UTC)

CarolynZrk@mediawiki.org

Status:    Done

Please check this suspected spambot. See #ShelliEin@strategy.wikimedia et cetera for a related request. Mathonius (talk) 22:16, 19 July 2012 (UTC)

locked by Barras — billinghurst sDrewth 10:39, 31 July 2012 (UTC)

DarbyNxp@ja.wikiquote

Status:    Done

Another one of those spambots... Mathonius (talk) 22:26, 19 July 2012 (UTC)

locked — billinghurst sDrewth 10:40, 31 July 2012 (UTC)

EliseAla@enwikiversity

Status:    Done

I haven't kept an eye on the various spambot patterns today, but is EliseAla another sock? It matches this pattern. Mathonius (talk) 16:48, 25 July 2012 (UTC)

Please also take a look at the following accounts:

Thanks, Mathonius (talk) 17:22, 25 July 2012 (UTC)

And please check the following accounts as well:

Mathonius (talk) 23:24, 25 July 2012 (UTC)

done — billinghurst sDrewth 13:06, 31 July 2012 (UTC)

Chinese blogpost spammer

Status:    Done

Please consider checking these socks of the Chinese blogpost spammer. Judging by these patterns, there might be more. Mathonius (talk) 16:53, 25 July 2012 (UTC)

See this CU request at Commons as well. Mathonius (talk) 17:00, 25 July 2012 (UTC)
Please also check Babycandy (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser), which spammed on simple.wikt and species. Mathonius (talk) 17:21, 25 July 2012 (UTC)
Another sock, Jenremhiah (talk • contribs • block • xwiki-contribs • xwiki-date (alt) • CA • ST • lwcheckuser), spammed at en.wikipedia. Mathonius (talk) 17:25, 25 July 2012 (UTC)
done — billinghurst sDrewth 13:01, 31 July 2012 (UTC)

DivijoQozofe@kiwipedia

Status:    Done

This account matches a well-known spambot pattern. Please consider checking it. Mathonius (talk) 21:29, 25 July 2012 (UTC)

previously locked by PeterSymonds. — billinghurst sDrewth 10:41, 31 July 2012 (UTC)
Retrieved from "https://meta.wikimedia.org/w/index.php?title=Steward_requests/Checkuser/2012-07&oldid=24907212"