Wikipedia:Requests for checkuser

From Wikipedia, the free encyclopedia
(Redirected from Wikipedia:RFCU)
Jump to: navigation, search

Checkuser is the process of checking information about two or more users (including named users and IPs). Special users are able to check if two or more accounts have been used from the same computer. These users also see User agents. This can help them decide if two accounts are related in the way described above. It is also possible to see if a user is editing from an open proxy.

On this page, users can request some users or IPs to be checked. Good reasons should be given for why a checkuser is needed; you should provide links which show the questionable edits, etc. Questions should usually be created so that they can be answered by yes or no. Responses will be short in order to comply with Wikipedia privacy policy. Sensitive information (like the IP addresses used by an account) are usually not reported. The results are not always clear, and a decision should not be made only on the basis of checkuser results.

Use of the tool[change source]

This tool is to be used to fight vandalism, to check for sockpuppet abuse, and to limit disruption of the project. It must be used only to prevent damage to the project.

The tool should not be used for political control; to apply pressure on editors; or as a threat against another editor in a content dispute. There must be a valid reason to check a user. Note that alternative accounts are not forbidden, so long as they are not used in violation of the policies (for example, to vote more than once or to make it look like more people support an idea). Checkusers will refuse a request, if the reason for checking is not good enough to warrant the use of the tool.

Please see the CheckUser policy for all the rules related to CheckUser.

User with Checkuser access[change source]

The technical list can be found at Special:ListUsers/checkuser.


Archives[change source]

Current requests[change source]

Please add requests to the top of the list.


Archives
2007
2008
2009
2010
2011-2013
2014
2015
2016
2017

Aminnie and Jaleh B and Parissa Official and ip 109.8.146.123[change source]

Referencing the Sockpuppet investigation started and in progress at the English Wikipedia, I checked user records and found Aminnie and the other accounts reported as being socks at EN, as well as the connected IP (which has been editing the Parisa Music Mixify and DJ Mixify articles here, sometimes alternately with Aminnie. I call duck on this lot. Quack :) DaneGeld (talk) 15:41, 14 November 2017 (UTC)

Note- has this been looked at yet please? I'm away at the moment in The Netherlands, so I'm not keeping up; the absence of notes leads me to believe it's been missed or still in progress. Any clues please? Thank you. DaneGeld (talk) 23:46, 18 November 2017 (UTC)
As has been mentioned to you before, you won't always get a comment back on RFCU cases. Secondly, just because they are socks elsewhere doesn't mean they fall afoul of socking here. Two of those accounts have yet to edit here. And editing as an account and an IP is not against the rules. -DJSasso (talk) 16:16, 20 November 2017 (UTC)

‎JBJGyZ and Gyurik Zita[change source]

Looks like block evasion here; new account ‎JBJGyZ has been making almost identical bad edits (to the same article) as blocked vandalism-only account Gyurik Zita. J991 12:02, 2 November 2017 (UTC)

Difficult to check as CU info is not held for long periods of time. This one could be proved by the duck test--Peterdownunder (talk) 12:11, 2 November 2017 (UTC)

Oct252017Lulz and Oct252017three[change source]

Both editing making the exact same threat on United Kingdom and United States, for which I'm requesting revdel. Both edits reverted and 4im issued as they're obvious socks of a couple Djsasso picked up on 23rd October, notes are at WP:AN. DaneGeld (talk) 21:19, 25 October 2017 (UTC)

Note: I indeffed both as vandalism-only accounts. --Auntof6 (talk) 21:34, 25 October 2017 (UTC)

Duck. Please add these to the same sockfarm as this and the others mentioned at WP:AN. Thanks DaneGeld (talk) 21:47, 3 November 2017 (UTC)

 Done--Peterdownunder (talk) 22:39, 3 November 2017 (UTC)

Randybeans918, Popcorn918 and Alex.ayer321[change source]

All edits this person made are at the article The Holocaust. Popcorn918 self-confessed in this edit that "he's here as Randybeans918". Obvious duck, also both users end with the same number "918". theinstantmatrix (talk) 19:30, 19 October 2017 (UTC)

Also may want to check out user Alex.ayer321; this account is suspiciously created after getting indefinitely blocked as Popcorn918 and came back to the article to make vandalizing edits. theinstantmatrix (talk) 19:36, 19 October 2017 (UTC)

Popcorn918 is currently blocked as a vandalism only account. --Eurodyne (talk) 19:33, 19 October 2017 (UTC)
 Done. -DJSasso (talk) 11:20, 20 October 2017 (UTC)

Metromemed and TheMetroGanger[change source]

First edits from both accounts were to Columbine High School massacre, all vandalism, some of it very unpleasant (example). Metromemed is described on its userpage as a "joke acc0(u)nt". Very ducky. DaneGeld (talk) 20:15, 17 October 2017 (UTC)

 Done Blocked as socks.--Peterdownunder (talk) 20:28, 17 October 2017 (UTC)

YahooBing and It's all yours[change source]

Following earlier deletion and multiple warnings leading to a level 4 on User_talk:YahooBing, one such warning for creating Vandalism-only account, User:It's all yours turns up and recreates the exact same article. This is an obvious duck, especially with the edits on Category:Playground equipment with both removing Playground from the category, and PlyrStar93 putting it back. Have tagged It's all yours as a suspected sock. DaneGeld (talk) 20:14, 15 October 2017 (UTC)

While not a checkuser, both accounts are globally locked, and 1 has a local block already in place. I went on and blocked the other so the auto-blocks can help mitigate future attempts. -- Enfcer (talk) 20:22, 15 October 2017 (UTC)
Same user agent, but different IPs, which geolocate to the same city. Possible, but unlikely. Anyway: no sock farm from either of these user's Ips. --Eptalon (talk) 20:35, 15 October 2017 (UTC)
You should be aware that according to PlyrStar93, both of these users are part of an extended SPI case on en, and there is a confirmed sockmaster of Hoggardhigh, whose account is already locked on 5 other wikis. DaneGeld (talk) 20:47, 15 October 2017 (UTC)
Both are blocked, and they are the only user for the respective IPs they use. So we are all done here,IMO. --Eptalon (talk) 21:01, 15 October 2017 (UTC)

What's up now & Bad Bad Leroy Brown[change source]

Both of these users have been blocked as VOA - unblock requests have been filed, and all those unblock requests have been lines from popular songs, The Saga Begins (Weird Al Yankovic), Basket Case (Green Day) and Ring of Fire (Johnny Cash). Smells kind of odd that both users are posting unblock requests just as lines from songs and I suspect they're both the same user. DaneGeld (talk) 21:27, 9 October 2017 (UTC)

Likely, but they are blocked at this point anyway so no action to be taken. -DJSasso (talk) 11:03, 10 October 2017 (UTC)

WikiVandal and SLBHwildcat5[change source]

WikiVandal has removed user warnings from their talk page, in a similar manner as SLBHwildcat5 and also Single4Life, part of the BazBomber sockfarm. All of their contributions are vandalism, I have been through them all and am now in the process of tidying them and reverting them. DaneGeld (talk) 19:19, 24 September 2017 (UTC)

Note to CU, both of these users are currently subject to indefinite blocks. DaneGeld (talk) 21:13, 24 September 2017 (UTC)
Confirmed.--Peterdownunder (talk) 21:14, 24 September 2017 (UTC)

Fikadu K. Angasu and Oriental Theological College[change source]

User:Fikadu K. Angasu was using their userpage as a G11 advert for the Oriental Theological College. I tagged this for QD and the user removed my QD tags, claiming they'd reworded the page so that it wasn't an advert. I warned them for removing QD tags on their userpage. Now, the Oriental Theological College has (mysteriously or not) arrived on the scene, and preceded to remove my G11 warning notice from Fikadu K. Angasu's talk page. My suspicion is that Fikadu K. Angasu is misusing another account with the intention of avoiding scrutiny and warnings. DaneGeld (talk) 09:19, 21 September 2017 (UTC)

I've blocked both users since it's an obvious case so there is no checkuser need. Only (talk) 10:18, 21 September 2017 (UTC)
 Done Confirmed as the same. -DJSasso (talk) 10:55, 21 September 2017 (UTC)

Single4Life and SLBHwildcat5[change source]

Single4Life's very first edit to the site was to create the RFCU for Eurodyne and Auntof6, 2 edits later to comment on the very thread SLBHwildcat5 had been blocked because of. Add to that the edit summaries which matched those of SLBHwildcat5 "removing vandalism" from their talk page. I believe that Single4Life is a sock of SLBHwildcat5 committing block evasion. DaneGeld (talk) 08:41, 20 September 2017 (UTC)

Note: One of these users is currently indeffed. The other is under a 31-hour block. --Auntof6 (talk) 08:47, 20 September 2017 (UTC)
Thanks, Auntof6, I had noticed but I thought it best to flag here. It looks ducky to me. DaneGeld (talk) 08:49, 20 September 2017 (UTC)
Thanks, Danegeld. My note was more for the checkuser person who handles this. --Auntof6 (talk) 08:56, 20 September 2017 (UTC)
Both use the same IP Address, and the user agent matches; so likely one is the sock of the other. Note however, that the IP may be dynamically allocated, so blocking the ip indefinitely is probably not an option.--Eptalon (talk) 09:06, 20 September 2017 (UTC)
You can't block IPs indefinitely anyways. The max is a year. -DJSasso (talk) 11:39, 20 September 2017 (UTC)
@Eptalon: Is it likely enough to indef the other account? --Auntof6 (talk) 17:14, 20 September 2017 (UTC)
As I said: same user agent, same ip address. Suppose you live in the same family, and have a router that does network address translation: then all the users in your family will get the same ip address. Now if you and another person in your family use the same browser, we also have the situation outlined. Note that there is a whole Sock farm behind "SLBHwildcat5"; Single4Life is just another account in that farm. --Eptalon (talk) 17:24, 20 September 2017 (UTC)
Thanks. I have indeffed the other account. --Auntof6 (talk) 17:35, 20 September 2017 (UTC)

Eurodyne and Auntof6[change source]

I read on the Administrators' Noticeboard that Eurodyne and Auntof6 are suspected socks. As far as I know, they have not been checked. Many users of the list of socks submitted by SLBHwildcat5 were blocked by one of these two admins. I suspect that they have been creating vandal accounts and blocking them in order to make themselves look better. Thanks, Single4Life (talk) 03:18, 20 September 2017 (UTC)Single4Life

Both are respected users, and administrators; looking at the times they edit, they are unlikely to be socks of one another. The bulk of AuntOf6's edits happen from 1h-4h (I assume GMT/UTC); Eurodyne has most edits during the afternoon/evening. (also GMT/UTC). I am not aware of the misbehaviour of either, so unless there's more convincing evidence; I guess this would be fishing. --Eptalon (talk) 07:49, 20 September 2017 (UTC)

Jeevitha Magandaran[change source]

Both edited on List of national fruits, changing the entry for Malaysia to "Durian", IP claims to be the "Deputy Prime Minister of Malaysia", although this may not necessarily be true. I can't prove it one way or another, but believed that 60.54.68.129 and Jeevitha Magandaran may be one and the same person. DaneGeld (talk) 16:50, 10 September 2017 (UTC)

I don't think this is an issue that needs a checkuser. Should the behaviour of either become problematic, the user in question can be blocked. And no, I am not going to argue if red or green is your favorite color... --Eptalon (talk) 11:08, 18 September 2017 (UTC)

This is the future[change source]

This is the future got blocked for vandalism and has since used these IPs above to continue the vandalism spree, Can a rangeblock or something be applied as this user isn't going to give up without a fight, judging by the IPs it seems to be from a specific device so rangeblocking shouldn't really affect anyone ?, Thanks, –Davey2010Talk 23:51, 8 September 2017 (UTC)

Partially struck as it could well be any device however as the front part is the same it must be either a specific device or just that particular area ?, Anyway thanks, –Davey2010Talk 00:07, 9 September 2017 (UTC)

Jsjjdjdjjfdhsdhdhdchchd[change source]

These users have pretty similar usernames, consisting of random letters, or repeating letters. Their edits are all vandalism, with the exception of the redlinked user, adding the same I am gay and i am jealous about lesbians because they are very sexy than me. to the pages they edit. Both userpages have the same content. Pretty obvious. Zhangj1079 (T|C) 21:54, 6 September 2017 (UTC)

 Done Blocked. Failed the "duck" test (as well as a CU).--Peterdownunder (talk) 21:59, 6 September 2017 (UTC)
Thank you! Zhangj1079 (T|C) 22:00, 6 September 2017 (UTC)

Multiple IP addresses[change source]

Additional: 107.77.204.228 (talkchanges <deleted>logsblock userblock logcheckuser)

These IP addresses have multiple similarities between their edits - first, they're all vandalism; secondly, all the edit summaries have the same format, which consists of a section header followed by 4 tildes, as if they're trying to sign the edit summary; third, and most important of these, is that they're ALL adding the exact same edit (concerning lots of legal things, including the death of someone called Seth Rich) to every article they edit. I've personally reverted changes by two of these IPs, 63.139.112.253 and 50.77.104.17, featuring this vandalism (both those are blocked now, I believe), but also the other IPs featured with the same repeating edits on Mike Enzi. It's worth noting these IPs have only started editing since August 5th or there about. DaneGeld (talk) 20:43, 22 August 2017 (UTC)

This is a known long term vandal who abuses both here and the English Wikipedia. As such, I can implement some range blocks that mirror ones already implemented on the English Wikipedia.
Note, though, this is not a checkuser issue. First of all, the fact that these are the same user is quite obvious so there doesn't need to be any additional technical evidence to link these accounts together. Second of all, because these are IPs and not named accounts, there's nothing really that a checkuser can do that a regular admin can't. Only (talk) 20:13, 23 August 2017 (UTC)
I've misunderstood the details at the top of the page then, because it says that it can be used for "named users and IPs", so that is what I did. Does it mean that I have to have a named user to attach the IP addresses to? DaneGeld (talk) 20:16, 23 August 2017 (UTC)
Basically yeah, if you are trying to say an IP is the same as a named user. That being said, in those cases a CU won't confirm if they are the same user or not because we can't publicly match an IP to a user. -DJSasso (talk) 14:52, 7 September 2017 (UTC)

CraptasticSams[change source]

Pretty obvious similarlity in usernames, and both accounts are indefinitely blocked as being vandalism only accounts. In addition, both accounts vandalized the user page of User:There'sNoTime and then reverted the user who reverted the vandalism. These edits have now been removed via RevisionDeletion, but they are still evident in the public page history. To me, this is pretty obvious, and therefore I think a CheckUser-imposed block on IP(s)/IP ranges might be warranted, at least temporarily. Catalan (talk) 00:36, 26 June 2017 (UTC)

Both are blocked, blocking an IP range is probably no use, unless more vandalism is detectzed. --Eptalon (talk) 20:23, 9 July 2017 (UTC)

Lenin.exe[change source]

Both appear to be vandalism only accounts created shortly between each other and share overlapping interests in editing the same articles/same vandalism. See 1, 2, etc...garden variety duck sock. Chrissymad (talk) 13:00, 20 June 2017 (UTC)

 Done Certainly failed the duck test, and I did find another one too. However they are sourced from a large education network, and therefore without blocking a large range further vandalism could be expected on topics related to Marx, Lenin and Communism. --Peterdownunder (talk) 23:32, 9 July 2017 (UTC)

ABS-CBN Out[change source]

These three accounts have appeared in the last 2 days and have the same edit patterns. They're tagging English Wikipedia administrators as blocked sockpuppets here (see the deleted history of User:NeilN, User:JamesBWatson, and User:DMacks. They're putting block notices on each other's pages ([1][2] and the deleted history of User:ABS-CBN Out). ABS-CBN Out ([3]) and PCMPAKurat ([4]) have also both taken the user talk page header of JamesBWatson and put it on their talk pages.

Definitely seems like there's a connection to this English sockpuppet case: https://en.wikipedia.org/wiki/Wikipedia:Sockpuppet_investigations/Christian2941/Archive, especially considering JamesBWatson blocked the sockmaster back in 2011. Only (talk) 11:37, 14 April 2017 (UTC)

All users listed as blocked, so I am not sure whether a checkuser is necessary.--Peterdownunder (talk) 21:47, 11 May 2017 (UTC)