Commons:Requests for checkuser

From Wikimedia Commons, the free media repository
Jump to navigation Jump to search

Shortcuts: COM:CHECK • COM:RFCU • COM:SOCK

This is the place to request investigations of abuse of multiple accounts or of other circumstances that require use of checkuser privileges.

Requesting a check

These indicators are used by CheckUsers to allow easier at-a-glance reading of their notes, actions and comments.
Request completed
Artículo bueno.svg Confirmed Symbol confirmed.svg Technically indistinguishable
Likely Symbol version generic.svg Possilikely
Symbol possible vote.svg Possible Symbol unlikely.svg Unlikely
Symbol unsupport vote.svg Inconclusive Symbol unrelated.svg Unrelated
Symbol no support vote.svg No action Time2wait.svg Stale
Request declined
Declined Checkuser is not for fishing
Checkuser is not magic pixie dust. 8ball The CheckUser Magic 8-Ball says
Cyberduck icon.png It looks like a duck to me Checkuser is not a crystal ball.
Information
Additional information needed Deferred to
 Doing…
Pictogram voting info.svg Info

Please do not ask us to run checks without good reason; be aware of the following before requesting a check:

  1. Checkuser is a last resort for difficult cases; pursue other options first, such as posting on the administrator's noticeboard.
  2. Running a check will only be done to combat disruption on Commons, or as required to assist checkuser investigations on other Wikimedia wikis.
    • Valid reasons for running a check include, for example: vandalism where a block of the underlying IP or IP range is needed and suspected block evasion, vote-stacking, or other disruption where technical evidence would prevent or reduce further disruption.
  3. Evidence is required. When you request a check, you must include a rationale that demonstrates (e.g., by including diffs) what the disruption to the project is, and why you believe the accounts are related.
    • Requests to run a check without evidence or with ambiguous reasoning will result in delays or the request not being investigated.
  4. The privacy policy does not allow us to make a check that has the effect of revealing IP addresses.
  5. Requests to run a check on yourself will be declined.

Outcome

Responses will be brief in order to comply with Wikimedia privacy policy. Due to technical limitations, results are not always clear. Closed requests are archived after seven days.

Privacy concerns

If you feel that a checkuser request has led to a violation of the Wikimedia Foundation privacy policy regarding yourself, please refer the case to the Ombuds commission.

If this page is displaying outdated contents even after you refresh the page in your browser, please purge this page's cache.

To request a check:

Cases are created on subpages of Commons:Requests for checkuser/Case.

Creating a request
  • Insert the name of the suspected sockpuppeteer (the main account or puppetmaster, not the sockpuppet!) in the box below, leaving out the "User:" prefix. Do not remove the text in the box, add to the end only.
  • Please explain/justify the request by saying what it is you suspect and why it is important that the check be carried out. Indicate the usernames you suspect, using {{checkuser}}. Please do not use this template in the section header, as that makes it difficult to read the account names. Include the diffs or links required to support the request and reason for it.
  • There are people to assist you and help with maintenance of the page. Just ask for help on the admin noticeboard if you really are stuck, or take your best shot and note that you weren't completely sure of what to say.
  • If a case subpage already exists, edit the existing page instead, either adding to the currently open section (if the case is not yet archived) or adding a new section to the top using {{subst:Commons:Requests for checkuser/Inputbox/Sample}} (if the case has been archived). When editing an existing case, be sure to list/transclude the subpage here.
Example
If you want to request a checkuser on User:John Doe, enter the text Commons:Requests for checkuser/Case/John Doe then click "Request a checkuser". You will be taken to a page where you can fill out the request. Please make your request there brief and concise.


Then transclude your subpage on the top of the list at Commons:Requests for checkuser and remove {{Checkuser requests to be listed}} from the top of the case subpage.

Checkuser requests to be listed‎ (empty)
nothing found

Requests[edit]

Gialaireview[edit]

Status: Artículo bueno.svg resolved • view • edit • history • watch
Filed: 02:50, 2 June 2023 (UTC)

Suspected related users[edit]

Rationale, discussion and results[edit]

Reason: Each of the accounts appears to have uploaded the exact same image at File:Đập Tân Sơn Chư Păh.jpg for use in w:vi:Gia Lai, despite that image being fairly low quality and not something easy-to-find on the internet. The photo was deleted as a copyright violation earlier this month, and subsequently re-uploaded by the sock. I find it quite odd that two independent people would upload the exact same image to Commons if they were acting independently, and multiple accounts are not permitted to be used to evade scrutiny when it comes to copyright violations. — Red-tailed hawk (nest) 02:50, 2 June 2023 (UTC)Reply[reply]

Likely Krd 15:05, 2 June 2023 (UTC)Reply[reply]
Thank you. I will be indeffing them as such. — Red-tailed hawk (nest) 22:15, 2 June 2023 (UTC)Reply[reply]

Large scale spam[edit]

Status: Symbol unrelated.svg open • view • edit • history • watch
Filed: 19:42, 1 June 2023 (UTC)

Suspected related users[edit]

Second batch
Third batch
Fourth batch

Rationale, discussion and results[edit]

Reason: Not sure what the main account is here, but these users are clearly socks and/or spambots, see their MO and their deleted contribs (there are no diffs anymore). They're spamming pdf ads on a massive scale and their quacking is truly deafening. There are more of this kind of accounts, if you don't find them before I do I will report them here later. Thank you. Wutsje 19:42, 1 June 2023 (UTC)Reply[reply]

Also under discussion at COM:AN/B#huge amount of sockpuppetry. I strongly suspect that the main account is Soroka223 (talk • contribs • Luxo's • SUL • deleted contribs • logs • block user • block log ). They made a couple of test uploads with the same edit summary before the sock army showed up. I've added a fourth batch of socks which got caught by Special:AbuseFilter/281 without their uploads getting through. Omphalographer (talk) 05:55, 2 June 2023 (UTC)Reply[reply]
I have checked a few random samples, and it appears this will end Symbol unsupport vote.svg Inconclusive/Cyberduck icon.png It looks like a duck to me. Krd 12:30, 2 June 2023 (UTC)Reply[reply]

B18IDH[edit]

Status: Artículo bueno.svg resolved • view • edit • history • watch
Filed: 00:15, 1 June 2023 (UTC)

Suspected related users[edit]

Rationale, discussion and results[edit]

Reason: B18IDH, the subject of Commons:Administrators' noticeboard/Blocks and protections#B18IDH (2), appears to be caught by a hard block (or perhaps autoblock or even a soft block). See the user_blocked field of Special:AbuseLog/9802454, the lack of block log entry, and mw:Extension:AbuseFilter/Rules format#Built-in variables's noting that user_blocked is "true for edits from blocked IP addresses, even if the editor is a registered user who is not blocked". They also appear to have been socking. I am requesting CheckUser to hopefully see whether they are the block target (and should be blocked accordingly), if they are not the block target (and should probably be either given IPBE or blocked for their non-socking issues), and if other accounts, including B18IDHK2, that pop up in the course of the check. —‍Mdaniels5757 (talk • contribs) 00:15, 1 June 2023 (UTC)Reply[reply]

Jordanene7[edit]

Status: Artículo bueno.svg resolved • view • edit • history • watch
Filed: 19:24, 31 May 2023 (UTC)

Suspected related users[edit]

Rationale, discussion and results[edit]

Reason: Reuploading File:NewCBSEVENINGNEWS1.png, which was uploaded by a sock of this user. I know everything in Category:Sockpuppets of Jordanene7 is likely stale, but there may be something in any notes Elcobbola may keep, checkuserwiki, or the checkuser logs. In any event, it seems like checks on this user tend to find multiple other accounts, so a check without any leftover data could be warranted as well. Best, —‍Mdaniels5757 (talk • contribs) 19:24, 31 May 2023 (UTC)Reply[reply]


Giorgio Pallavicini[edit]

Status: Artículo bueno.svg resolved • view • edit • history • watch
Filed: 21:27, 30 May 2023 (UTC)

Suspected related users[edit]

Rationale, discussion and results[edit]

Reason: On March 5, the main account was blocked for 1 year for overwriting artworks despite mutliple warnings. On May 26, another account overwrites an artwork with an AI-"enhanced" version like the uploads of the main account. According to a sysop and checkuser on itwiki, it might be Giorgio Pallavicini, a check is needed. Thibaut (talk) 21:27, 30 May 2023 (UTC)Reply[reply]

I'd call this Likely. --Krd 06:09, 31 May 2023 (UTC)Reply[reply]

Castro Pretorio[edit]

Status: Artículo bueno.svg resolved • view • edit • history • watch
Filed: 11:13, 29 May 2023 (UTC)

Reason: same behavior as Livioandronico2013, but now the EXIF are masked. He replaces old images with his own on Wikipedia articles without looking for consent. NOTE: RCU on it.wiki confirmed that Wikiriello and Wikiettino are Castro Pretorio's socks. --Ruthven (msg) 11:13, 29 May 2023 (UTC)Reply[reply]

  • Declined - Please review COM:RFCU, including "Evidence is required. When you request a check, you must include a rationale that demonstrates (e.g., by including diffs) what the disruption to the project is, and why you believe the accounts are related." (emphasis in original) It is not the duty of CUs to build cases for you. If the assertion is "same behavior", the expectation is diffs for both accounts demonstrating the similarly. Эlcobbola talk 14:09, 2 June 2023 (UTC)Reply[reply]
    Ridiculous! This is an LTA case. He comes back every few months and makes exactly the same stink, every time. He never changes his modus operandi. He sticks around abusing residential proxies in the interim times and fucks with every Wikipedia project you can think of. This should be an open-and-shut case every time, yet this guy manages to place a huge administrative burden on the whack-a-mole game. What the hell. Elizium23 (talk) 17:35, 2 June 2023 (UTC)Reply[reply]
    Ridiculous is not reading instructions, and unhelpful comments like these--you too could not be bothered to offer evidence. If it's an obvious case, no CU is needed ({{Duck}} is a "request declined" indicator.) Эlcobbola talk 18:08, 2 June 2023 (UTC)Reply[reply]


Stbkdjpwhu[edit]

Status: Artículo bueno.svg resolved • view • edit • history • watch
Filed: 23:12, 28 May 2023 (UTC)

Suspected related users[edit]

Rationale, discussion and results[edit]

Reason: two accounts got created in near time, two(and separate) very similar uploads. ----modern_primat ඞඞඞ TALK 23:12, 28 May 2023 (UTC)Reply[reply]

Stb's copyvio/advertise file: File:Kurulus osman english subtitles.png
Zih's copyvio/advertise file: File:Alparslan english subtitles.png ----modern_primat ඞඞඞ TALK 23:15, 28 May 2023 (UTC)Reply[reply]
Declined per "Checkuser is a last resort for difficult cases". --Krd 14:20, 29 May 2023 (UTC)Reply[reply]
✓ Done Blocked Zihsoujpnc as obvious sock. Yann (talk) 16:16, 29 May 2023 (UTC)Reply[reply]

Alright1223[edit]

Status: Artículo bueno.svg resolved • view • edit • history • watch
Filed: 21:20, 28 May 2023 (UTC)

Suspected related users[edit]

Rationale, discussion and results[edit]

Reason: Similar uploads (File:The Riya Sharma.jpg, File:The RiyaSharma.jpg) that seemingly violate copyright (I'm not an admin so I can't see the deleted uploads, but I suspect it is the same image). The images were then put on enwiki, and I had originally considered opening a SPI there, but it seems like the problem originates on Commons. LilianaUwU (talk / contribs) 21:20, 28 May 2023 (UTC)Reply[reply]

Declined per "Checkuser is a last resort for difficult cases". --Krd 14:18, 29 May 2023 (UTC)Reply[reply]
Blocked master 1 week and sock indef. —‍Mdaniels5757 (talk • contribs) 15:48, 29 May 2023 (UTC)Reply[reply]

Taki2006[edit]

Status: Artículo bueno.svg resolved • view • edit • history • watch
Filed: 19:30, 26 May 2023 (UTC)

Suspected related users[edit]

Rationale, discussion and results[edit]

ZakariaDjaafar has same actions [1] on Algeria flags files (and north africa former dynasties) than users @ZakariaDjaafar, Takiva, ⵜⴰⴽⵉ, Nedrko, and ⵎⴰⵙⵏⵙⴰ: , users who are pupetsocks of the Takiva. --Poudou99 (talk) 19:30, 26 May 2023 (UTC)Reply[reply]

Symbol unsupport vote.svg Inconclusive / Symbol possible vote.svg Possible --Krd 14:16, 29 May 2023 (UTC)Reply[reply]

Hfive5sgd2 May 25[edit]

Status: Artículo bueno.svg resolved • view • edit • history • watch
Filed: 13:24, 25 May 2023 (UTC)

Suspected related users[edit]

Rationale, discussion and results[edit]

I already blocked them, but please check for sleepers. Also could you please block the range(s), as this is beginning to be tedious. Thanks, Yann (talk) 13:24, 25 May 2023 (UTC)Reply[reply]

  • Cyberduck icon.png It looks like a duck to me - We are not unaware of range blocks. When four different CUs have looked into this case over two months, you may and should assume possible range blocks have already been made (they have). As indicated below, there is a large number of ranges. We cannot make /34, /32 -wide blocks on dozens of ranges without unacceptable collateral damage--simply RBI. Checkuser is not magic pixie dust. There is also no real purpose in checking for sleepers, as spambots are not the same as "real human" LTAs. The latter create pools of sleepers to draw from when one account is blocked, so finding sleepers prevents future disruption. The former, however, this case, create single-use accounts that upload one or several images and then are abandoned never to be used again. (I don't see that any account has an activity window longer than several minutes--if I've missed one, please provide it) Accordingly, finding these accounts does nothing to prevent future disruption, which is a prerequisite for a check. Эlcobbola talk 13:47, 25 May 2023 (UTC)Reply[reply]
  • Even short term range would be useful. Don't spambots create more than one account at the time? How blocking sleepers before they are used are not preventing future disruption? I don't get that. Yann (talk) 13:53, 25 May 2023 (UTC)Reply[reply]
Let's take the first five accounts from your request as examples:
Xoilactvio
  • 10:50, 25 May 2023 - created
  • 10:51, 25 May 2023 - copyvio 1
  • 10:52, 25 May 2023 - copyvio 2
Tk88aicasino
  • 06:34, 25 May 2023 - created
  • 06:35, 25 May 2023 - copyvio (only 1)
Bongdalusp
  • 08:03, 24 May 2023 - created
  • 08:05, 24 May 2023 - copyvio (only 1)
Sm66nhaca
  • 05:41, 24 May 2023 - created
  • 05:42, 24 May 2023 - copyvio (only 1)
Tk88cz
  • 09:05, 23 May 2023 - created
  • 09:06, 23 May 2023 - copyvio (only 1)
1) They are not created in batches ("Don't spambots create more than one account at the time?") and 2) As I said, these are spambots that are created, immediately upload, then are never used again. With the way rounding works, we would have to to find them the exact minute of their creation to prevent disruption--i.e., they cannot realistically be blocked before use ("How blocking sleepers before they are used are not preventing future disruption"). Эlcobbola talk 14:44, 25 May 2023 (UTC)Reply[reply]


A3cb1[edit]

Status: Artículo bueno.svg resolved • view • edit • history • watch
Filed: 11:35, 16 May 2023 (UTC)

Suspected related users[edit]

Rationale, discussion and results[edit]

Ulcarco77 is a new user requesting undeletion of files uploaded by Lûgnûg, another sock of A3cb1. This is the usual partern for A3cb1's socks: uploading a few files, and then request undeletion of A3cb1's socks files. Yann (talk) 11:35, 16 May 2023 (UTC)Reply[reply]

Artículo bueno.svg Confirmed, as well as Custainor99 (talk • contribs • Luxo's • SUL • deleted contribs • logs • block user • block log ) and Lødrionatta (talk • contribs • Luxo's • SUL • deleted contribs • logs • block user • block log ). --Krd 03:58, 18 May 2023 (UTC)Reply[reply]
Please check Janiken98, idem as Ulcarco77. Yann (talk) 16:43, 22 May 2023 (UTC)Reply[reply]
Janiken98 is Artículo bueno.svg Confirmed. Эlcobbola talk 16:56, 22 May 2023 (UTC)Reply[reply]
Added one more suspected sock and reopened. Ankry (talk) 15:58, 25 May 2023 (UTC)Reply[reply]
I've added Marck Giannini as well. An IP is inserting all his uploaded pictures on it.wiki on A3cb1's topic articles. Thanks --Ruthven (msg) 07:20, 26 May 2023 (UTC)Reply[reply]
@Elcobbola and Krd: Could you check Stvg20 and Marck Giannini, as mentioned above? Thanks, Yann (talk) 08:09, 28 May 2023 (UTC)Reply[reply]
Artículo bueno.svg Confirmed Stvg20, Symbol unsupport vote.svg Inconclusive Marck Giannini --Krd 14:13, 29 May 2023 (UTC)Reply[reply]



Stephane szyller[edit]

Status: Artículo bueno.svg resolved • view • edit • history • watch
Filed: 15:51, 14 May 2023 (UTC)

Suspected related users[edit]

Rationale, discussion and results[edit]

Reason: Create the same DR with almost identical (invalid) reason at File:Michale Boganim from "Tel Aviv Beirut" at Red Carpet of the Tokyo International Film Festival 2022 (52461587778).jpg. A1Cafel (talk) 15:51, 14 May 2023 (UTC)Reply[reply]

✓ Done Nasser berzane blocked for meatpuppetry. Yann (talk) 16:18, 29 May 2023 (UTC)Reply[reply]

PlanespotterA320[edit]

Status: Symbol unrelated.svg open • view • edit • history • watch
Filed: 22:53, 1 June 2023 (UTC)

Suspected related users[edit]

Rationale, discussion and results[edit]

This editor is nominating Russian images under the same rationale used by PlanespotterA320. --RAN (talk) 01:41, 9 April 2023 (UTC)Reply[reply]

I'm sorry, this single sentence with no links to evidence is all that's supposed to prove the accusation that this long-term user in good standing on the Russian Wikipedia is related to a globally banned cross-wiki disrupter? 𝟙𝟤𝟯𝟺𝐪𝑤𝒆𝓇𝟷𝟮𝟥𝟜𝓺𝔴𝕖𝖗𝟰 (𝗍𝗮𝘭𝙠) 23:09, 1 June 2023 (UTC)Reply[reply]
It's been a bit of a while since this was filed, Richard Arthur Norton (1958- ). I fixed the formatting today so that it would appear at COM:SOCK for checkusers to take a look. Do you have anything more specific than the above? 1234qwer1234qwer4 brings up a good point. — Red-tailed hawk (nest) 03:33, 2 June 2023 (UTC)Reply[reply]
  • Nothing new to add, other than the same MO as PlanespotterA320 and the same rationale, and that PlanespotterA320 was using multiple accounts. --RAN (talk) 03:54, 2 June 2023 (UTC)Reply[reply]
  • Declined - Please review COM:RFCU, including "Evidence is required. When you request a check, you must include a rationale that demonstrates (e.g., by including diffs) what the disruption to the project is, and why you believe the accounts are related." (emphasis in original) It is not the duty of CUs to build cases for you. If the assertion is "same rationale", the expectation is diffs for both accounts demonstrating the similarly--and, given that the suspected account is eight-years-old and active, in good standing, and has tens of thousands of edits to a sister project the master effectively never touched, the evidence should be especially compelling. Эlcobbola talk 14:07, 2 June 2023 (UTC)Reply[reply]
For older requests, please see Commons:Requests for checkuser/Archives
Retrieved from "https://commons.wikimedia.org/w/index.php?title=Commons:Requests_for_checkuser&oldid=769876438"