Commons:Requests for checkuser

From Wikimedia Commons, the free media repository
(Redirected from Commons:RFCU)
Jump to: navigation, search

Shortcut: COM:CHECK, COM:RFCU

Does your request belong here?
This is the place to request sockpuppet checks or other investigations requiring CheckUser privileges. Checkuser is a last resort for difficult cases. Use other methods first. You can try posting on the administrator's noticeboard for example.
Please do not ask us to run checks without good reason:
These indicators are used by CheckUsers to allow easier at-a-glance reading of their notes, actions and comments.
Request completed
Artículo bueno.svg Confirmed Likely
Symbol possible vote.svg Possible Symbol unlikely.svg Unlikely
Symbol unsupport vote.svg Inconclusive Symbol unrelated.svg Unrelated
Symbol redirect vote.svg Completed Time2wait.svg Stale
Request declined
Declined Checkuser is not for fishing.
Checkuser is not magic pixie dust. 8ball The CheckUser Magic 8-Ball says
Cyberduck icon.png It looks like a duck to me Checkuser is not a crystal ball.
Information
Additional information needed Deferred to
 Doing… Pictogram voting info.svg Info
  1. Running a check will only be done to combat disruption on Commons, or as required to assist CheckUser investigations on other Wikimedia wikis.
    • Valid reasons for running a check include vandalism where a block of the underlying IP or IP range is needed, disruptive sockpuppetry, vote-stacking, and similar disruption where the technical evidence from running a check would prevent or reduce further disruption to Wikimedia projects.
  2. Requests to run a check with ambiguous reasoning will result in delays - please provide a rationale at the time you make the request
    • Show what the disruption to the project is, and why you believe the accounts are related.
  3. Requests to run a check on yourself will be declined
  4. The privacy policy does not allow us to make a check that has the effect of revealing IP addresses.
Outcome
Responses will be brief in order to comply with Wikimedia privacy policy. Due to technical limitations, results are not always clear. Check back regularly to see the outcome of your request. Closed requests are archived after seven days.
Privacy violation?
If you feel that a checkuser has led to a violation of the Wikimedia Foundation privacy policy regarding yourself, please refer the case to the Ombudsman commission.

If this page is displaying outdated contents even after you refresh the page in your browser, please purge this page's cache.

To request a check:

Cases are created on subpages of Commons:Requests for checkuser/Case.

Creating a request
  • Insert the name of the suspected sockpuppeteer (the main account or puppetmaster, not the sockpuppet!) in the box below, leaving out the "User:" prefix. Do not remove the text in the box, add to the end only.
  • Please explain/justify the request by saying what it is you suspect and why it is important that the check be carried out. Indicate the usernames you suspect, using {{checkuser}}. Please do not use this template in the section header, as that makes it difficult to read the account names. Include the diffs or links required to support the request and reason for it.
  • There are people to assist you and help with maintenance of the page. Just ask for help on the admin noticeboard if you really are stuck, or take your best shot and note that you weren't completely sure of what to say.
  • If a case subpage already exists, edit the existing page instead, either adding to the currently open section (if the case is not yet archived) or adding a new section to the top (if the case has been archived). When editing an existing case, be sure to list/transclude the subpage here.
Example
If you want to request a checkuser on User:John Doe, enter the text Commons:Requests for checkuser/Case/John Doe then click "Request a checkuser." You will be taken to a page where you can fill out the request. Please make your request there brief and concise.


Then transclude your subpage on the top of the list at Commons:Requests for checkuser and remove {{Checkuser requests to be listed}} from the top of the case subpage.

New requests[edit]

Newzealand123[edit]

Suspected related users[edit]

Rationale[edit]

This is a commercially operated, industrial-sized farm of confirmed sockpuppets. See en:Wikipedia:Sockpuppet investigations/Newzealand123/Archive, en:Category:Wikipedia sockpuppets of Newzealand123 and en:Wikipedia:Administrators' noticeboard/IncidentArchive840#User:NLZ06 - not quite clear what they're up to. Many of them have already been blocked (see Category:Sockpuppets of Newzealand123), but many have not. Since there are sockpuppets registered on Wikipedia but not used here, it stands to reason that there may be Commons-only sockpuppets as well, so I think a check is in order.

Additionally, several of the confirmed sockpuppets are not yet blocked on Commons, and a lot of the remaining files should be deleted. Most of the files have licenses that have supposedly been verified by OTRS, but given that this user has no problem breaking rules, forging other people's statements and telling blatant lies, I'm not satisfied that the permission e-mails have been properly scrutinized. I have also raised that issue at Commons:OTRS/Noticeboard#Files uploaded by Klokus (permanent link to the discussion as of right now). LX (talk, contribs) 18:48, 19 October 2014 (UTC)

Results[edit]

There are no definitely related accounts which are not already listed; for some suspect accounts the data is not conclusive enough to base any action one.

I'm going to block all listed accounts now. Uploads of all accounts still have to be reviewed. --Krd 15:55, 21 October 2014 (UTC)

There seems to be no evidence that any of the existing uploads have fake OTRS tickets. --Krd 16:48, 21 October 2014 (UTC)

Completed requests[edit]

Jim-Siduri[edit]

Suspected related users[edit]


Rationale[edit]

  • Apparently Jim-Siduri is a sockmaster using socks to promote his church or religion and to upload copyvios and fake permissions, and out of scope promo videos and images. We have obviously connected account editing and IP editing that is almost certainly related. The above accounts/IP have only a few edits each, and have only uploaded Siduri-related copyvio media, and/or participated in the same related DRs.

The following DRs are related:

I speedy closed the top 2 as copyvios, and was quickly accused of "misogyny and religious persecution" by 166.170.50.142. The others are a scope/sock upload issue, and I've left those open. The issue seems to have been a big socking problem on en.wiki, and is mentioned on Jimbo's talk, where it was quickly hatted: https://en.wikipedia.org/wiki/User_talk:Jimbo_Wales#User-created_free_video_versions_or_articles_and.2For_related_multimedia for being initiated by a sock/s.

Here's the SPI on en.wiki with quite a sockfarm: https://en.wikipedia.org/wiki/Wikipedia:Sockpuppet_investigations/Jim-Siduri/Archive. INeverCry 18:28, 29 September 2014 (UTC)

Results[edit]

  • The following are Artículo bueno.svg Confirmed socks of one another:
  • The following are Artículo bueno.svg Confirmed socks of one another:

Erotic tanzil bajwa[edit]

Suspected related users[edit]

Rationale[edit]

During one day, at least 4 users with similar bad name were created. All are blocked now. Please check, maybe there are some other users created from the same IP addresses, maybe they have also bad usernames.

This is my first request for checkuser. Sorry, if this is not a valid request. Taivo (talk) 13:35, 5 October 2014 (UTC)

Results[edit]

Symbol redirect vote.svg Completed There are no related accounts which are not already blocked. --Krd 13:40, 6 October 2014 (UTC)

Amgauna[edit]

Suspected related users[edit]

Rationale[edit]

  • Reason: So, after review the unblock request of the user above mentioned in meta (you can find all about the request here) and agree that the user should in fact remain blocked, the user found herself to vandalize my user talk page (both here and in pt.wiki where I also opened a CheckUser request in this page). The rationale for the check is that both IPs have traceroute to Rio de Janeiro, BR where the user claims she is from (see her talk page in meta). Béria L. Rodríguez msg 17:17, 6 October 2014 (UTC)

Results[edit]

  • CheckUser Declined per the Privacy Policy. Specifically, it is not allowable to publicly link an IP address to a named account except under limited circumstances. Also, CheckUser isn't going to give you much more information than you have already gathered. This case will need to be decided based on behavioral evidence. Tiptoety talk 18:16, 6 October 2014 (UTC)

Saabelms[edit]

Suspected related users[edit]

New 2014-10-14

Rationale[edit]

  • Reason: Both users created on October 3 but became active on October 8, used for image vandalism at File:Jennifer Lawrence by Gage Skidmore.jpg (uploaded private images from hacked Apple cloud storage). Request sleeper check to prevent further damage, other slepers may pick other high-use images. Denniss (talk) 22:26, 7 October 2014 (UTC)
New 2014-10-14
Another round of attacks on Jennifer Lawrence images. Even if they are not related a sleeper check needs to be done to rot out sleeping accounts prepared for further attacks. --Denniss (talk) 07:26, 14 October 2014 (UTC)

Results[edit]

  • Artículo bueno.svg Confirmed, as well as:
New 2014-10-14

Symbol unsupport vote.svg Inconclusive for the new accounts. --Krd 14:45, 21 October 2014 (UTC)

Alireza.fzd[edit]

Suspected related users[edit]

Rationale[edit]

Results[edit]

Data for suspect related users is no longer available, results for Alireza.fzd are Symbol unsupport vote.svg Inconclusive. --Krd 17:35, 8 October 2014 (UTC)

Please check Paydar93 (talk · contribs)! (last blocked Sockpuppet of Mazandiran in Persian Wikipedia!) --MehdiTalk 15:21, 12 October 2014 (UTC)
Results are still inconclusive, no further action required at this moment. --Krd 15:42, 12 October 2014 (UTC)

Menabrena[edit]

Suspected related users[edit]

Rationale[edit]

Results[edit]

Data for Alwongs is no longer available, so results are Symbol unsupport vote.svg Inconclusive. --Krd 06:51, 11 October 2014 (UTC)

SSR2000[edit]

Suspected related users[edit]


Rationale[edit]

  • Reason: Today, a few hours after I had notifed User:SSR2000 about deletion-requests for 5 of his uploads, he completely blanked his talkpage[1] without any further comment. Just 7 minutes later IP 42.76.19.203 posted a grossly insulting personal attack to my talkpage[2].
    I then remembered the same chain of events from November 4, 2013, where he also had removed a vandalism-warning by me from his talkpage[3] and only 10 minutes later IP 113.61.140.190 had posted an identical worded personal attack to my talkpage[4].
    When checking another series of 3 consecutive talkpage-blankings by User:SSR2000 in July 2014[5]], I found that the admin, who had posted the removed notifications, only 12 hours later was attacked by IP 42.78.168.161 again using the identical grossly insulting wording[6].
    Per WHOIS-information, the two 42.-IPs belong to the same provider, the 113.-IP to another provider in the same country.
    IMO, this user, who consistantly refuses any communication[7] with anybody on Commons and shows also vandalist behaviour[8],[9],[10],[11],[12], should be either indef- or longterm-blocked for his abusive behaviour and disruption of Commons. --Túrelio (talk) 19:24, 19 October 2014 (UTC)

Results[edit]

SSR2000 edits from a computer, using a variety of IPs recently. The IP's insult was placed from a mobile, so I can't tie it directly to SSR2000, but my instinct tells me that they are the same person. It seems to me that there is enough information to block SSR2000 and I have done so. .     Jim . . . . (Jameslwoodward) (talk to me) 10:13, 20 October 2014 (UTC)

2APERE[edit]

Suspected related users[edit]

Rationale[edit]

  • Reason: Similar user names, similar M.O. Both accounts are being used to upload copyright violations. Since the 2ATRNA account has been used to continue to upload multiple copyright violations in spite of a final warning, a block of the main account is due, and for that to be meaningful, the sock should be confirmed and blocked along with any additional sockpuppets. LX (talk, contribs) 22:07, 18 October 2014 (UTC)

Results[edit]

They are in the same city, but they have no IP overlaps and are not using the same computer. So, perhaps a sock, perhaps a friend? I would be inclined to wait a little before blocking -- but only a little. .     Jim . . . . (Jameslwoodward) (talk to me) 10:33, 20 October 2014 (UTC)

Pictogram voting comment.svg Comment with a look at both users WP contributions I suspect this users are part of a school (or other institution) project. The style of the created articles is too different for same users, the articles have been created in user namespace, the usernames are similar, there are other users on es.wp with similar article drafts related to Uruguay this month (es:Usuario:2APERE/Taller, es:Usuario:2ATRNA/Taller, es:Usuario:2AAR/Taller, es:Usuario:2Bperepere/Taller, es:Usuario:2BAcosta/Taller, es:Usuario:2aba/Taller, es:Usuario:2atupade/Taller, es:Usuario:2amena/Taller, some more see prefix search for "Usuario:2..." in es.wp. Some of the users have copyvio uploads too. If this is part of a collaboration / school project the initiators / teachers should give proper instructions about free content media. I noticed that es:User:Inumila edited some of the uncategorized, not easy to find drafts, maybe Inumila knows more. --Martin H. (talk) 18:07, 20 October 2014 (UTC)

Archives[edit]