Commons:Requests for checkuser

From Wikimedia Commons, the free media repository
Jump to: navigation, search


Does your request belong here?
This is the place to request sockpuppet checks or other investigations requiring CheckUser privileges. Checkuser is a last resort for difficult cases. Use other methods first. You can try posting on the administrator's noticeboard for example.
Please do not ask us to run checks without good reason:
These indicators are used by CheckUsers to allow easier at-a-glance reading of their notes, actions and comments.
Request completed
Artículo bueno.svg Confirmed Likely
Symbol possible vote.svg Possible Symbol unlikely.svg Unlikely
Symbol unsupport vote.svg Inconclusive Symbol unrelated.svg Unrelated
Symbol redirect vote.svg Completed Time2wait.svg Stale
Request declined
Declined Checkuser is not for fishing.
Checkuser is not magic pixie dust. 8ball The CheckUser Magic 8-Ball says
Cyberduck icon.png It looks like a duck to me Checkuser is not a crystal ball.
Additional information needed Deferred to
 Doing… Pictogram voting info.svg Info
  1. Running a check will only be done to combat disruption on Commons, or as required to assist CheckUser investigations on other Wikimedia wikis.
    • Valid reasons for running a check include vandalism where a block of the underlying IP or IP range is needed, disruptive sockpuppetry, vote-stacking, and similar disruption where the technical evidence from running a check would prevent or reduce further disruption to Wikimedia projects.
  2. Requests to run a check with ambiguous reasoning will result in delays - please provide a rationale at the time you make the request
    • Show what the disruption to the project is, and why you believe the accounts are related.
  3. Requests to run a check on yourself will be declined
  4. The privacy policy does not allow us to make a check that has the effect of revealing IP addresses.
Responses will be brief in order to comply with Wikimedia privacy policy. Due to technical limitations, results are not always clear. Check back regularly to see the outcome of your request. Closed requests are archived after seven days.
Privacy violation?
If you feel that a checkuser has led to a violation of the Wikimedia Foundation privacy policy regarding yourself, please refer the case to the Ombudsman commission.

If this page is displaying outdated contents even after you refresh the page in your browser, please purge this page's cache.

To request a check:

Cases are created on subpages of Commons:Requests for checkuser/Case.

Creating a request
  • Insert the name of the suspected sockpuppeteer (the main account or puppetmaster, not the sockpuppet!) in the box below, leaving out the "User:" prefix. Do not remove the text in the box, add to the end only.
  • Please explain/justify the request by saying what it is you suspect and why it is important that the check be carried out. Indicate the usernames you suspect, using {{checkuser}}. Please do not use this template in the section header, as that makes it difficult to read the account names. Include the diffs or links required to support the request and reason for it.
  • There are people to assist you and help with maintenance of the page. Just ask for help on the admin noticeboard if you really are stuck, or take your best shot and note that you weren't completely sure of what to say.
  • If a case subpage already exists, edit the existing page instead, either adding to the currently open section (if the case is not yet archived) or adding a new section to the top (if the case has been archived). When editing an existing case, be sure to list/transclude the subpage here.
If you want to request a checkuser on User:John Doe, enter the text Commons:Requests for checkuser/Case/John Doe then click "Request a checkuser." You will be taken to a page where you can fill out the request. Please make your request there brief and concise.

Then transclude your subpage on the top of the list at Commons:Requests for checkuser and remove {{Checkuser requests to be listed}} from the top of the case subpage.


Shiwam Kumar Sriwastaw[edit]

Suspected related users[edit]

Rationale, discussion and results[edit]

Reason: Area 1108 is confirmed by enwiki checkuser as a sock of Shiwam Kumar Sriwastaw. Area 1108 and Millionairs's edit similarly at commons and both repeatedly upload files with copyright issues (like the non-trivial logos). The accounts also leave messages to each other: 1, 2 with the same style of English writing.

The logo of Colors TV was repeatedly uploaded to Commons by previous socks, and based on simplewiki page COLORS TV history, the file has been repeatedly inserted by the socks:

Adding new report for existing case, hopefully doing the formats right. -★- PlyrStar93. Message me. 23:15, 18 March 2018 (UTC)


Suspected related users[edit]

Rationale, discussion and results[edit]

Reason: This edit.   — Jeff G. ツ please ping or talk to me 17:54, 17 March 2018 (UTC)

I have reverted the edit. Please elaborate what is the reason for checkuser in this case. --Krd 18:41, 18 March 2018 (UTC)


Suspected related users[edit]

Added March 18 following another attack:

Less certain—tentative identification relies on this edit:

A remote guess—from this query and File:DWCL-new-logo-1.png (histlogsabuse log):

Rationale, discussion and results[edit]

Reason: The vandal was able to register an acc at 11:40 (UTC) when all three known IP ranges were already blocked. It indicates that s/he is operating some IPs yet unknown to the community. Incnis Mrsi (talk) 14:14, 16 March 2018 (UTC)
P.S. The problem is older than I supposed initially. Special:Contribs/ was used since this edit and up to February 15. Incnis Mrsi (talk) 16:35, 16 March 2018 (UTC)
The vandal also certainly has some connection to Obra19 (talk · contribs) due to Revision of File:BANGUI_WINDMILL,ILOCOS_NORTE_2.jpg and and also because Obra19 is likely based in the same country, Philippines. Of course, some connection does not mean “is necessarily the same person” – a productive user would very unlikely turn to a pure vandal. As a guess, “Jojodeladia” may be a nick of the vandal in question who was Obra19’s close friend in 2013. Incnis Mrsi (talk) 17:46, 16 March 2018 (UTC)

Internet search reveals “Jojo deladia” as the same person as Obra19, a photographer. Incnis Mrsi (talk) 19:47, 16 March 2018 (UTC)

Note that Moonrivers (talkcontribsblock logfilter log) has an extensive history of blocks in November–December 2017. Incnis Mrsi (talk) 19:47, 16 March 2018 (UTC)

The first six are likely related. The latter four are possible, but I can't say likely. I don't have time to follow up further. .     Jim . . . (Jameslwoodward) (talk to me) 13:20, 17 March 2018 (UTC)

What about the eleventh item? Six plus four give ten, not eleven. Incnis Mrsi (talk) 06:10, 18 March 2018 (UTC)

Please, check 7 new vandal accs added today. Incnis Mrsi (talk) 06:10, 18 March 2018 (UTC)


Suspected related users[edit]

Accounts without actions:

Rationale, discussion and results[edit]

Reason: ar.Wikipedia blocked the titular user as a puppeteer for one month. I wouldn’t care much unless found our infamous license forger Mou3awiya_Rafi3i/Mouauia_rafii among alleged puppets. Do suspicions of ar.Wikipedians warrant, at very least, a comparison between Saideljamali and Mou3awiya_Rafi3i? Incnis Mrsi (talk) 10:22, 11 March 2018 (UTC)

  •  Doing… Magog the Ogre (talk) (contribs) 19:44, 11 March 2018 (UTC)
  • These IP ranges have a lot of shared activity. So it's hard to tease out who is who.

All these are on the same IP range but differ in other respects. From a technical standpoint, the link is Symbol possible vote.svg Possible only. I have not seen enough evidence to justify blocking Saideljamali; arwp CU may have seen more evidence than I, however. Magog the Ogre (talk) (contribs) 20:06, 11 March 2018 (UTC)

external image

سعيد الجمالي
Are these three guys the same person?
Thanks, I hope that Saideljamali will excuse us for this inquiry. @Magog the Ogre: may I tell the Arabs that their perception of Mou3awiya/Mouauia, Fouad_---azan, and Anasos as namely Saideljamali’s socks is unfounded? Incnis Mrsi (talk) 20:13, 11 March 2018 (UTC)
@Incnis Mrsi: certainly you may tell them. I would phrase it a bit more ambiguously, since they may have seen behavioral or technical evidence that I have not. Magog the Ogre (talk) (contribs) 20:37, 11 March 2018 (UTC)
Hello all, @Magog the Ogre: please take a look at this Special:PermaLink/26062 on CU wiki --Alaa :)..! 05:57, 12 March 2018 (UTC)
Hello @Incnis Mrsi: I read your comment under Saideljamali CU request on arwiki. Initially, please don't remove any CU changes on arwiki like here (I think that @Magog the Ogre: know that this action is unacceptable), secondly we've a lot of evidences against Saideljamali not only the CU report, and there's a private arwiki issues about linking between Saideljamali account with old vandal account (Chronic socks on arwiki- @Magog the Ogre: you can take a look ar Special:PermaLink/25730 on CU wiki). Finally, please remember checkuser is not perfect and can be evaded without too much difficulty and is not a crystal ball --Alaa :)..! 06:13, 12 March 2018 (UTC)
I don’t care whether is Fouadadan = Saideljamali because the former is not a Commons problem currently. @علاء: could you express please your opinion, is Saideljamali the same person as Mouauia_rafii? This last person is a sort of problem here. Incnis Mrsi (talk) 06:30, 12 March 2018 (UTC)
My opinion: they are not. Mouauia is interested in slaughterhouses (French: abattoirs), historical United States political families (including Kennedy family) and “michael jackson”[sic]. Special:ListFiles/Saideljamali does not show anything alike; BTW, Commons sysops can compare these pics against deleted Fouadadan’s stuff. Incnis Mrsi (talk) 06:59, 12 March 2018 (UTC)
P.S. Fouadadan is a prolific puppeteer and operated a large ring of socks here; see also to learn how can present-days Fouad look like. Is his style similar to either Mouauia or Said? Note that Mouauia is known to en.Wikipedies as a separate person. No, we should not lump the three Moroccan guys together and I’m unsure why Alaa stuck to a misleading theory. Incnis Mrsi (talk) 07:23, 12 March 2018 (UTC)


Suspected related users[edit]

Added on March 14[edit]

Rationale, discussion and results[edit]

Reason: An intermittent editor of es.Wikipedia with characteristic and easily recognizable editing style. Namely, his/her interest is almost entirely confined to celebrities of modern popular culture. These persons include:

Observed Wikipedia edits never add substantial information, but only insert copyvio pictures uploaded to Commons or transfer some things from Wikidata. On Commons the sock ring is known for uploading copyvio and, since mid-2017, for forging license records; hence, most socks are already blocked on Commons. The master doesn’t use each account for a long time. In Spanish Wikipedia also was briefly used, but no respective IP edits were found on Commons. Incnis Mrsi (talk) 10:59, 7 March 2018 (UTC)
After more scrupulous analysis I’d separate accounts active in January 2017—namely, Purpledragon and Sol-lol—from all the socks registered since May 2017. I now deem Deerty2222 the first certain account from the ring which operates currently. Incnis Mrsi (talk) 13:14, 7 March 2018 (UTC)

On yet another thought, I mined a very strong evidence that Sol-lol and Deerty2222 are the same person – feel free to request it off-wiki. Whereas strong evidence linking Sol-lol with Purpledragon exists as well. Also, Sol-lol is 4 days older than Purpledragon – under whose name will we categorize socks? Incnis Mrsi (talk) 14:24, 7 March 2018 (UTC)
Decided myself due to already existing Commons:Requests_for_checkuser/Case/Sol-lol. Incnis Mrsi (talk) 14:31, 7 March 2018 (UTC)
@Magog the Ogre: please, check IPs and an acc listed today (the first IP was already reported by ~riley). I have evidence that these Central European IPs are currently used: see es:Special:Contribs/, es:Special:Contribs/, es:Special:Contribs/Wusq. Likely each IP is a kind of proxy. Incnis Mrsi (talk) 11:02, 14 March 2018 (UTC)
I believe Magog did not comment with respect to the IPs because for privacy reasons, checkusers will not connect IP addresses to accounts. In addition, neither IP has edited on Commons. I have additionally blocked Frutillito125 and had blocked in a global range block. has been blocked for 1 year as an open proxy locally in the event the user attempts to use it here. ~riley (talk) 02:48, 15 March 2018 (UTC)
Frutillito125 then lead me to Frutillitos125 and FrankBips. ~riley (talk) 03:04, 15 March 2018 (UTC)
They are likely identical to each other, but not to Sol-lol. FrankBips speaks English and edits en.Wikipedia. Incnis Mrsi (talk) 11:20, 15 March 2018 (UTC)
Moreover, here we see changes of multiple fields with each one edit and edit warring without any edits summary. Where are Sol-lol’s characteristic “Puse imagen al articulo” and “Puse una foto a la plantilla”? And here we see some copyright discourse – did anybody see Sol-lol discussing digital rights? @~riley: please, fix the nonsense in user: pages of these accs and diminish your confirmation bias for next hunts. Incnis Mrsi (talk) 15:51, 15 March 2018 (UTC)
These are not based on my own speculation but rather steward findings. Please assume good faith rather than label actions as confirmation bias. I merely tagged, it is clear now that these findings are technically indistinguishable in nature and not connected to each other but rather using the same open proxies. I will adjust the user pages accordingly when I have a chance to do so, or you can do so yourself if the “nonesense” is so unbearable. ~riley (talk) 16:28, 15 March 2018 (UTC)

One more: Etid22 (talk contribs Luxo's SUL deleted contribs logs block user block log checkuser) is uploading images of Christian Nodal and Christian Martinoli, adding them to articles on Spanish Wikipedia using the Ukrainian IP (talk contribs WHOIS RBL tools luxo's crossblock block user block log checkuser) and forging license reviews in the name of Explicit. LX (talk, contribs) 21:19, 16 March 2018 (UTC)

Etid22 Cyberduck icon.png It looks like a duck to me – compare to Edit4411 (talk · contribs). Incnis Mrsi (talk) 06:57, 17 March 2018 (UTC)

For older requests, please see Commons:Requests for checkuser/Archives