Commons:Requests for checkuser

From Wikimedia Commons, the free media repository
(Redirected from Commons:RFCU)
Jump to: navigation, search

Shortcut: COM:CHECK, COM:RFCU, COM:SOCK

Does your request belong here?
This is the place to request sockpuppet checks or other investigations requiring CheckUser privileges. Checkuser is a last resort for difficult cases. Use other methods first. You can try posting on the administrator's noticeboard for example.
Please do not ask us to run checks without good reason:
These indicators are used by CheckUsers to allow easier at-a-glance reading of their notes, actions and comments.
Request completed
Artículo bueno.svg Confirmed Likely
Symbol possible vote.svg Possible Symbol unlikely.svg Unlikely
Symbol unsupport vote.svg Inconclusive Symbol unrelated.svg Unrelated
Symbol redirect vote.svg Completed Time2wait.svg Stale
Request declined
Declined Checkuser is not for fishing.
Checkuser is not magic pixie dust. 8ball The CheckUser Magic 8-Ball says
Cyberduck icon.png It looks like a duck to me Checkuser is not a crystal ball.
Information
Additional information needed Deferred to
 Doing… Pictogram voting info.svg Info
  1. Running a check will only be done to combat disruption on Commons, or as required to assist CheckUser investigations on other Wikimedia wikis.
    • Valid reasons for running a check include vandalism where a block of the underlying IP or IP range is needed, disruptive sockpuppetry, vote-stacking, and similar disruption where the technical evidence from running a check would prevent or reduce further disruption to Wikimedia projects.
  2. Requests to run a check with ambiguous reasoning will result in delays - please provide a rationale at the time you make the request
    • Show what the disruption to the project is, and why you believe the accounts are related.
  3. Requests to run a check on yourself will be declined
  4. The privacy policy does not allow us to make a check that has the effect of revealing IP addresses.
Outcome
Responses will be brief in order to comply with Wikimedia privacy policy. Due to technical limitations, results are not always clear. Check back regularly to see the outcome of your request. Closed requests are archived after seven days.
Privacy violation?
If you feel that a checkuser has led to a violation of the Wikimedia Foundation privacy policy regarding yourself, please refer the case to the Ombudsman commission.

If this page is displaying outdated contents even after you refresh the page in your browser, please purge this page's cache.

To request a check:

Cases are created on subpages of Commons:Requests for checkuser/Case.

Creating a request
  • Insert the name of the suspected sockpuppeteer (the main account or puppetmaster, not the sockpuppet!) in the box below, leaving out the "User:" prefix. Do not remove the text in the box, add to the end only.
  • Please explain/justify the request by saying what it is you suspect and why it is important that the check be carried out. Indicate the usernames you suspect, using {{checkuser}}. Please do not use this template in the section header, as that makes it difficult to read the account names. Include the diffs or links required to support the request and reason for it.
  • There are people to assist you and help with maintenance of the page. Just ask for help on the admin noticeboard if you really are stuck, or take your best shot and note that you weren't completely sure of what to say.
  • If a case subpage already exists, edit the existing page instead, either adding to the currently open section (if the case is not yet archived) or adding a new section to the top (if the case has been archived). When editing an existing case, be sure to list/transclude the subpage here.
Example
If you want to request a checkuser on User:John Doe, enter the text Commons:Requests for checkuser/Case/John Doe then click "Request a checkuser." You will be taken to a page where you can fill out the request. Please make your request there brief and concise.


Then transclude your subpage on the top of the list at Commons:Requests for checkuser and remove {{Checkuser requests to be listed}} from the top of the case subpage.

Requests[edit]

Sivakrishna r nair[edit]

Suspected related users[edit]

Rationale, discussion and results[edit]

Reason: Same nickname root 'Sivakrishna'; Sivakrishna 149 cleaned Sivakrishna r nair talk page; Sivakrishna149 continue Sivakrishna 149 work; Sivakrishna 149 and Sivakrishna149 share the same habits of uploading copyrighted photos of en:Deepti Sati. It might be genuine old-account-credential-lost-so-creation-of-new-account act but there are interactions; It could be a way to avoid sanctions for repeated copyvios. --Lacrymocéphale (talk) 08:59, 25 April 2018 (UTC)

Auwall[edit]

Suspected related users[edit]

Rationale, discussion and results[edit]

Reason: Auwal1 uploading image containing the text "Auwal Azare"; WAYA11 uploading File:WAYA11.jpg which is the same person shown on the images previously deleted. -★- PlyrStar93. Message me. 19:10, 23 April 2018 (UTC)

Aless56[edit]

Suspected related users[edit]

Rationale, discussion and results[edit]

Same as last time: Uploading logos of Italian political parties tagged as screenshots of free software. LX (talk, contribs) 16:34, 23 April 2018 (UTC)


Ven0m2014[edit]

Suspected related users[edit]

Rationale, discussion and results[edit]

Reason: The sockmaster was repeatedly removing deletion tags and a COM:AN/B report. Once the file was deleted, they proceeded to upload the same image as Ariells2 and Korrelln. Túrelio blocked these two socks, and then the third sock was created and removed the AN/B report again. Requesting that a checkuser look at the underlying IPs and apply a rangeblock if possible. Guanaco (talk) 21:16, 21 April 2018 (UTC)

An experienced sockmaster having grasp of proxies. Don’t expect a decisive victory. Incnis Mrsi (talk) 21:54, 21 April 2018 (UTC)
  • Artículo bueno.svg Confirmed for all, but accounts are on four ranges; a range block would not be effective in this case. Эlcobbola talk 22:12, 21 April 2018 (UTC)
Me thinks this should be enough for a global ban of the sockmaster. --Túrelio (talk) 22:19, 21 April 2018 (UTC)
Stewards are slow to react. Incnis Mrsi (talk) 09:43, 22 April 2018 (UTC)
IMO the bigger problem is that Mediawiki software does not prevent the sequential 8 times upload of 99.9 % identical copies of a copyvio. --Túrelio (talk) 10:28, 22 April 2018 (UTC)

Further socks:

The master and known socks locked by the steward -revi. Please, search IPv4 addresses and IPv6 ranges to find sleepers. Incnis Mrsi (talk) 13:06, 23 April 2018 (UTC)

Now in archive: [1]. --Túrelio (talk) 06:07, 25 April 2018 (UTC)

+ Lero456 (talk contribs Luxo's SUL deleted contribs logs block user block log checkuser)

Please, search
188.19.48.0/20 (talk contribs WHOIS RBL tools luxo's crossblock block user block log checkuser)

for accounts registered in the last two days. See ru:Special:Contribs/188.19.57.246, fr:Special:Contribs/188.19.48.0/20, and it:Special:Contribs/188.19.57.246. Incnis Mrsi (talk) 14:31, 23 April 2018 (UTC)

+ 85.132.107.187 too. 188.170.72.61 14:42, 23 April 2018 (UTC) + 185.216.34.172? 188.170.72.61 14:52, 23 April 2018 (UTC)

Both IPs reported to stewards, see m:Steward requests/Global #Global block for 85.132.107.187 for details.

Update April 24[edit]

Please, check for sleepers on all known IPs. Incnis Mrsi (talk) 08:38, 24 April 2018 (UTC)

Update April 25[edit]

Incnis Mrsi (talk) 18:40, 25 April 2018 (UTC)

YuRi YuZi[edit]

Suspected related users[edit]

Rationale, discussion and results[edit]

Similar interests, similar user pages with similar broken English, similar interwiki footprint, both users make mobile web edits. Master of Rubik's Cube was created less than two weeks after YuRi YuZi was blocked for a year on Commons. Master of Rubik's Cube is messing with other people's comments on User talk:YuRi YuZi and blanking out notices of ongoing deletion discussions from files uploaded by YuRi YuZi. Optimus Prime, the leader of the Autobots is already confirmed to be a sockpuppet. LX (talk, contribs) 08:22, 21 April 2018 (UTC)

  • Optimus Prime, the leader of the Autobots: Artículo bueno.svg Confirmed by enwiki checkusers. I've blocked it indefinitely. Uploads are all deleted or nominated.
  • Master of Rubik's Cube: Cyberduck icon.png It looks like a duck to me, blocked indefinitely. Uploads are all deleted or nominated.
I also reblocked the master indefinitely, and I will go through their uploads. Guanaco (talk) 08:46, 21 April 2018 (UTC)

Eaglezero[edit]

Suspected related users[edit]

Rationale, discussion and results[edit]

Reason: Both of these accounts appear to be single purpose sock accounts used for creating disruptive deletion requests, an editing pattern we have seen from some persistent sock masters. Based on the pattern of editing, the user created NWWT to avoid being held to account for their behaviour as Eaglezero and based on the history of both accounts has other master accounts where they have prior experience editing across different Wikimedia projects. Checkuser data may help merge these sock accounts into a preexisting SPI case.

Refer to background case at Commons:Administrators' noticeboard/User problems#NWWT.

Edit patterns: Eaglezero raised a total of 27 DRS all on the single day of 31st March 2018, while NWWT has raised a total of 39 DRs and these were all created over two days 7th and 8th April 2018. These are identical behaviours making it likely that both accounts are part of a larger pattern of sock puppetry. (talk) 13:11, 9 April 2018 (UTC)

Please notice that just like Eaglezero, this IP got angry with one of my DRs (I mean they first participated in a DR that I had opened :) and then opened a series of DRs against files uploaded by this servant. --E4024 (talk) 15:23, 9 April 2018 (UTC)
  • Eaglezero and NWWT are Symbol unrelated.svg Unrelated. Handling will need to be based on behaviour. Эlcobbola talk 15:50, 9 April 2018 (UTC)
  • This is not a request, just trying to collect information in one place. AshFriday has refused to state they don't have socks. Eaglezero, Ash and NWWT have all shown similar behaviour by registering and raising numerous DRs in no more than a few days with copypasted rationale. NWWT raised DRs for metal music related photos (Nightwish and Metallica), Ash has issues with nudity. (and profanity) Eaglezero seems to raise DRs for images uploaded by E4024 and user Akbys. (sock of Jhony jhony ha ji) I don't know why. - Alexis Jazz 14:25, 10 April 2018 (UTC)
Well, as I said above, the IP I noted has similar attitude with Eaglezero. Indeed the problem lies somewhere else, I mean from my angle: I wish these two (I believe one person) told me openly what is their problem with me. Let's be honest. Anyhow, forget it. --E4024 (talk) 14:32, 10 April 2018 (UTC)
Further addition: In a much older discussion Ash stated "I'm not a sockpuppet". In that discussion Ash was also suspected of being an INC sock. - Alexis Jazz 14:37, 10 April 2018 (UTC)

Messina[edit]

Suspected related users[edit]

Rationale, discussion and results[edit]

Reason: Somebody is creating lots of accounts to upload images of Pforzheim that (allegedly) are more than 100 years old, mostly stating that these are "own work". [2] [3] [4] [5] [6] [7] Only a few of their uploads are attributed correctly or almost correctly, as most often the source is still missing. Judging by the topics (scans from books or magazines about pre-war architecture in Baden-Württemberg), this reminds me of the behaviour of the globally banned user Messina (Category:Sockpuppets of Messina). Sitacuisses (talk) 05:18, 26 March 2018 (UTC)

@Sitacuisses: In case the result is positive, do you suggest to bulk delete all uploads, or is there anybody who will review files that look like pd-old and need double check?--Krd 07:13, 7 April 2018 (UTC)
Judging by the historical value that many of these images have, the uploads do deserve an individual review, and there were also a few that seemed OK from the beginning, and some of the descriptions have been improved in the meantime. But I don't feel like I'm able to perform this. Many of these files could at least be transfered to de.wp, since they were published more than 100 years ago. Also, some of the original books or newspapers have had digital copies published under free licenses by libraries or archives. E.g. a scan of "Hans Rott: Kunst und Künstler am Baden-Durlacher Hof bis zur Gründung Karlsruhes (1917)" can be found at HEIDI published under CC BY-SA 3.0 DE. Still, there would be some work left to select correct licenses, check sources etc. It's a pity that the uploader didn't do this correctly in the first place. --Sitacuisses (talk) 13:13, 8 April 2018 (UTC)
I understand, and I do not disagree. But, if we consider as fact that the images need review but there is nobody available who will review them, what is the remaining intention of this CU request, what do you suggest if found positive? --Krd 07:47, 10 April 2018 (UTC)
I'm neither familiar with the details of the Global Ban Policy nor with any method of moving files to de.wp. I don't know either if there still is a group of Messina's supporters at de.wp who are ready and able to fix the files. The main intention of this request is to stop the account hopping and send a message to Messina that he's not getting through with this sloppy and deceptive work. In case the files get deleted, maybe a list of the file names and sources could be useful (e.g. pasted to de:Diskussion:Pforzheim), so anybody would be able to re-upload those files that can be found under an adequate license. --Sitacuisses (talk) 13:26, 11 April 2018 (UTC)
Sounds reasonable. Please give me some time to make some preparations. --Krd 05:56, 13 April 2018 (UTC)
I added a second group of suspected accounts, these have Hebrew names in common. Evidence that points to Messina: Account hopping, poor grasp of the rules of categorization, occupation with archive material and Israel. Many of the categories added by these accounts to Photographs by Willem van de Poll are by far too general or refer to non-essential traits of the images. Just a random example: he added Categories Rivers, Painting and Ships. --Sitacuisses (talk) 13:59, 11 April 2018 (UTC)
I didn't check every single account, but samples chosen at random turn out to be between Likely and Artículo bueno.svg Confirmed. I leave this request open for a while for additional comments what measures shall be taken.--Krd 10:43, 23 April 2018 (UTC)

MRYSOCKER2017[edit]

Suspected related users[edit]

Added March 18–19 following another bunch of attacks:

Discovered and blocked April 2 by Jdx:

Less certain—tentative identification relies on this edit:

A remote guess—from this query and File:DWCL-new-logo-1.png (histlogsabuse log):

Rationale, discussion and results[edit]

Reason: The vandal was able to register an acc at 11:40 (UTC) when all three known IP ranges were already blocked. It indicates that s/he is operating some IPs yet unknown to the community. Incnis Mrsi (talk) 14:14, 16 March 2018 (UTC)
P.S. The problem is older than I supposed initially. Special:Contribs/110.54.128.0/17 was used since this edit and up to February 15. Incnis Mrsi (talk) 16:35, 16 March 2018 (UTC)
The vandal also certainly has some connection to Obra19 (talk · contribs) due to Revision of File:BANGUI_WINDMILL,ILOCOS_NORTE_2.jpg and https://commons.wikimedia.org/w/index.php?title=Special%3ALog&type=newusers&user=Obra19 and also because Obra19 is likely based in the same country, Philippines. Of course, some connection does not mean “is necessarily the same person” – a productive user would very unlikely turn to a pure vandal. As a guess, “Jojodeladia” may be a nick of the vandal in question who was Obra19’s close friend in 2013. Incnis Mrsi (talk) 17:46, 16 March 2018 (UTC)

Internet search reveals “Jojo deladia” as the same person as Obra19, a photographer. Incnis Mrsi (talk) 19:47, 16 March 2018 (UTC)

Note that Moonrivers (talkcontribsblock logfilter log) has an extensive history of blocks in November–December 2017. Incnis Mrsi (talk) 19:47, 16 March 2018 (UTC)

The first six are likely related. The latter four are possible, but I can't say likely. I don't have time to follow up further. .     Jim . . . (Jameslwoodward) (talk to me) 13:20, 17 March 2018 (UTC)

What about the eleventh item? Six plus four give ten, not eleven. Incnis Mrsi (talk) 06:10, 18 March 2018 (UTC)

Please, check 7 new vandal accs added today. Incnis Mrsi (talk) 06:10, 18 March 2018 (UTC)

Check-users, please, take care about IP ranges used by registered socks observed on April 2. Incnis Mrsi (talk) 06:29, 2 April 2018 (UTC)

Please, check for sleeper accounts using updated list of IP ranges. Incnis Mrsi (talk) 09:23, 17 April 2018 (UTC)

Notes on 203.87.128.0/17[edit]

On querying en.Wikipedians a fine structure of the range was revealed. All edits except from two narrow ranges—Special:Contribs/203.87.156.116/30 and Special:Contribs/203.87.171.160/28—are not from MRY. Incnis Mrsi (talk) 12:46, 19 March 2018 (UTC)

21-04-2018[edit]

This LTA managed to get 3 autoconfirmed accounts. Please find the sleepers. Thanks, Yann (talk) 05:33, 21 April 2018 (UTC)


For older requests, please see Commons:Requests for checkuser/Archives