Wikipedia:Requests for checkuser

From Wikipedia, the free encyclopedia
(Redirected from Wikipedia:RFCU)
Jump to: navigation, search

Checkuser is the process of checking information about two or more users (including named users and IPs). Special users are able to check if two or more accounts have been used from the same computer. These users also see User agents. This can help them decide if two accounts are related in the way described above. It is also possible to see if a user is editing from an open proxy.

On this page, users can request some users or IPs to be checked. Good reasons should be given for why a checkuser is needed; you should provide links which show the questionable edits, etc. Questions should usually be created so that they can be answered by yes or no. Responses will be short in order to comply with Wikipedia privacy policy. Sensitive information (like the IP addresses used by an account) are usually not reported. The results are not always clear, and a decision should not be made only on the basis of checkuser results.

Use of the tool[change source]

This tool is to be used to fight vandalism, to check for sockpuppet abuse, and to limit disruption of the project. It must be used only to prevent damage to the project.

The tool should not be used for political control; to apply pressure on editors; or as a threat against another editor in a content dispute. There must be a valid reason to check a user. Note that alternative accounts are not forbidden, so long as they are not used in violation of the policies (for example, to vote more than once or to make it look like more people support an idea). Checkusers will refuse a request, if the reason for checking is not good enough to warrant the use of the tool.

Please see the CheckUser policy for all the rules related to CheckUser.

User with Checkuser access[change source]

The technical list can be found at Special:ListUsers/checkuser.

Archives[change source]

Current requests[change source]

Please add requests to the top of the list.


Single4Life and SLBHwildcat5[change source]

Single4Life's very first edit to the site was to create the RFCU for Eurodyne and Auntof6, 2 edits later to comment on the very thread SLBHwildcat5 had been blocked because of. Add to that the edit summaries which matched those of SLBHwildcat5 "removing vandalism" from their talk page. I believe that Single4Life is a sock of SLBHwildcat5 committing block evasion. DaneGeld (talk) 08:41, 20 September 2017 (UTC)

Note: One of these users is currently indeffed. The other is under a 31-hour block. --Auntof6 (talk) 08:47, 20 September 2017 (UTC)
Thanks, Auntof6, I had noticed but I thought it best to flag here. It looks ducky to me. DaneGeld (talk) 08:49, 20 September 2017 (UTC)
Thanks, Danegeld. My note was more for the checkuser person who handles this. --Auntof6 (talk) 08:56, 20 September 2017 (UTC)
Both use the same IP Address, and the user agent matches; so likely one is the sock of the other. Note however, that the IP may be dynamically allocated, so blocking the ip indefinitely is probably not an option.--Eptalon (talk) 09:06, 20 September 2017 (UTC)
You can't block IPs indefinitely anyways. The max is a year. -DJSasso (talk) 11:39, 20 September 2017 (UTC)
@Eptalon: Is it likely enough to indef the other account? --Auntof6 (talk) 17:14, 20 September 2017 (UTC)
As I said: same user agent, same ip address. Suppose you live in the same family, and have a router that does network address translation: then all the users in your family will get the same ip address. Now if you and another person in your family use the same browser, we also have the situation outlined. Note that there is a whole Sock farm behind "SLBHwildcat5"; Single4Life is just another account in that farm. --Eptalon (talk) 17:24, 20 September 2017 (UTC)
Thanks. I have indeffed the other account. --Auntof6 (talk) 17:35, 20 September 2017 (UTC)

Eurodyne and Auntof6[change source]

I read on the Administrators' Noticeboard that Eurodyne and Auntof6 are suspected socks. As far as I know, they have not been checked. Many users of the list of socks submitted by SLBHwildcat5 were blocked by one of these two admins. I suspect that they have been creating vandal accounts and blocking them in order to make themselves look better. Thanks, Single4Life (talk) 03:18, 20 September 2017 (UTC)Single4Life

Both are respected users, and administrators; looking at the times they edit, they are unlikely to be socks of one another. The bulk of AuntOf6's edits happen from 1h-4h (I assume GMT/UTC); Eurodyne has most edits during the afternoon/evening. (also GMT/UTC). I am not aware of the misbehaviour of either, so unless there's more convincing evidence; I guess this would be fishing. --Eptalon (talk) 07:49, 20 September 2017 (UTC)

Jeevitha Magandaran[change source]

Both edited on List of national fruits, changing the entry for Malaysia to "Durian", IP claims to be the "Deputy Prime Minister of Malaysia", although this may not necessarily be true. I can't prove it one way or another, but believed that and Jeevitha Magandaran may be one and the same person. DaneGeld (talk) 16:50, 10 September 2017 (UTC)

I don't think this is an issue that needs a checkuser. Should the behaviour of either become problematic, the user in question can be blocked. And no, I am not going to argue if red or green is your favorite color... --Eptalon (talk) 11:08, 18 September 2017 (UTC)

This is the future[change source]

This is the future got blocked for vandalism and has since used these IPs above to continue the vandalism spree, Can a rangeblock or something be applied as this user isn't going to give up without a fight, judging by the IPs it seems to be from a specific device so rangeblocking shouldn't really affect anyone ?, Thanks, –Davey2010Talk 23:51, 8 September 2017 (UTC)

Partially struck as it could well be any device however as the front part is the same it must be either a specific device or just that particular area ?, Anyway thanks, –Davey2010Talk 00:07, 9 September 2017 (UTC)

Jsjjdjdjjfdhsdhdhdchchd[change source]

These users have pretty similar usernames, consisting of random letters, or repeating letters. Their edits are all vandalism, with the exception of the redlinked user, adding the same I am gay and i am jealous about lesbians because they are very sexy than me. to the pages they edit. Both userpages have the same content. Pretty obvious. Zhangj1079 (T|C) 21:54, 6 September 2017 (UTC)

 Done Blocked. Failed the "duck" test (as well as a CU).--Peterdownunder (talk) 21:59, 6 September 2017 (UTC)
Thank you! Zhangj1079 (T|C) 22:00, 6 September 2017 (UTC)

Multiple IP addresses[change source]

Additional: (talkchanges <deleted>logsblock userblock logcheckuser)

These IP addresses have multiple similarities between their edits - first, they're all vandalism; secondly, all the edit summaries have the same format, which consists of a section header followed by 4 tildes, as if they're trying to sign the edit summary; third, and most important of these, is that they're ALL adding the exact same edit (concerning lots of legal things, including the death of someone called Seth Rich) to every article they edit. I've personally reverted changes by two of these IPs, and, featuring this vandalism (both those are blocked now, I believe), but also the other IPs featured with the same repeating edits on Mike Enzi. It's worth noting these IPs have only started editing since August 5th or there about. DaneGeld (talk) 20:43, 22 August 2017 (UTC)

This is a known long term vandal who abuses both here and the English Wikipedia. As such, I can implement some range blocks that mirror ones already implemented on the English Wikipedia.
Note, though, this is not a checkuser issue. First of all, the fact that these are the same user is quite obvious so there doesn't need to be any additional technical evidence to link these accounts together. Second of all, because these are IPs and not named accounts, there's nothing really that a checkuser can do that a regular admin can't. Only (talk) 20:13, 23 August 2017 (UTC)
I've misunderstood the details at the top of the page then, because it says that it can be used for "named users and IPs", so that is what I did. Does it mean that I have to have a named user to attach the IP addresses to? DaneGeld (talk) 20:16, 23 August 2017 (UTC)
Basically yeah, if you are trying to say an IP is the same as a named user. That being said, in those cases a CU won't confirm if they are the same user or not because we can't publicly match an IP to a user. -DJSasso (talk) 14:52, 7 September 2017 (UTC)

CraptasticSams[change source]

Pretty obvious similarlity in usernames, and both accounts are indefinitely blocked as being vandalism only accounts. In addition, both accounts vandalized the user page of User:There'sNoTime and then reverted the user who reverted the vandalism. These edits have now been removed via RevisionDeletion, but they are still evident in the public page history. To me, this is pretty obvious, and therefore I think a CheckUser-imposed block on IP(s)/IP ranges might be warranted, at least temporarily. Catalan (talk) 00:36, 26 June 2017 (UTC)

Both are blocked, blocking an IP range is probably no use, unless more vandalism is detectzed. --Eptalon (talk) 20:23, 9 July 2017 (UTC)

Lenin.exe[change source]

Both appear to be vandalism only accounts created shortly between each other and share overlapping interests in editing the same articles/same vandalism. See 1, 2, variety duck sock. Chrissymad (talk) 13:00, 20 June 2017 (UTC)

 Done Certainly failed the duck test, and I did find another one too. However they are sourced from a large education network, and therefore without blocking a large range further vandalism could be expected on topics related to Marx, Lenin and Communism. --Peterdownunder (talk) 23:32, 9 July 2017 (UTC)

ABS-CBN Out[change source]

These three accounts have appeared in the last 2 days and have the same edit patterns. They're tagging English Wikipedia administrators as blocked sockpuppets here (see the deleted history of User:NeilN, User:JamesBWatson, and User:DMacks. They're putting block notices on each other's pages ([1][2] and the deleted history of User:ABS-CBN Out). ABS-CBN Out ([3]) and PCMPAKurat ([4]) have also both taken the user talk page header of JamesBWatson and put it on their talk pages.

Definitely seems like there's a connection to this English sockpuppet case:, especially considering JamesBWatson blocked the sockmaster back in 2011. Only (talk) 11:37, 14 April 2017 (UTC)

All users listed as blocked, so I am not sure whether a checkuser is necessary.--Peterdownunder (talk) 21:47, 11 May 2017 (UTC)