Steward requests/Checkuser/2015-01

It is a difficult case - there are a lot of IP ranges and user agents involved. However, there are some matches. Alexandros 63850 has an obvious sock - Papadopouloi. Timmy terner is also Likely Likely to belong to Alexandros 63850. George23820 is a Possible Possible sock of Alexandros 63850. GiannhsSamartzis is Stale. The results for Akistv are Inconclusive Inconclusive. Ruslik (talk) 16:47, 31 December 2014 (UTC)

Thank you, I was hoping for more conclusive results. --C messier (talk) 17:02, 31 December 2014 (UTC)

Ruslik are you sure that Akistv isn't associated with 87.202.92.166? Both have contributed to the same articles (Zoom TV was a copy of AB Channel) and both have uploaded copyrighted material as own work (in greek wikipedia and Commons). Thank you in advance. --C messier (talk) 17:14, 31 December 2014 (UTC)

We do not associate accounts with IP addresses. Ruslik (talk) 20:35, 2 January 2015 (UTC)

 Confirmed Checking the accounts resulted in obvious findings: Two IPs and their user agents are identically used. One of them was very likely used to change accounts within a day holding a very similar user agent, the other overlapping IP was used even more dramatically: When MacRusgail was not able to stop NahidSultan from correctly tagging pages for deletion in his capacity of cross-wiki maintanence work, the user switched his non-admin account MacRusgail to the admin account Creachadair, keeping IP address and user agent, in order to block the account, and changed it back afterwards, still keeping IP address and user agent. This happened within ten minutes and strongly suggests the same person behind both accounts. I couldn't find further socks and just a couple of exposed IP address which accidentically created or edited article which were edited by MacRusgail (sometimes evven shortly) afterwards, that also applies to the latter of both IPs mentioned above. I'm leaving the decision how to react on this result to the gdwiki community. Cheers, —DerHexer (Talk) 13:12, 4 January 2015 (UTC)

The main reason is the following - the last two users are blocked in Armenian Wikipedia for vandalism, for blanking pages and non-constructive edits. The pages that they were editing are the same as 1221nor user edits or creates. The latter has also suspicious activity in hy.wikipedia. So we need to know whether these persons are the same or not. Thanks and Happy New Year. --Lilitik22 (talk) 16:09, 3 January 2015 (UTC)

The following accounts are  Confirmed:

Lakiditto098

1221nor

Lilit1345

Karenpetrosyan

Norayr2001

Norayr b-yan

Norayrbaghdasaryan

Ruslik (talk) 18:14, 8 January 2015 (UTC)

Closed  Closed per faWP admin request  — billinghurst sDrewth 11:32, 10 January 2015 (UTC)

Fishing CheckUser is not for fishing Please reach a consensus of the community prior to putting an uncertain request to stewards.  — billinghurst sDrewth 11:34, 10 January 2015 (UTC)

The full list of  Confirmed socketpuppets of Shuvo Hulk: A Mujibur rahman, Dr.Abdullah Al Noman, Noman02, আফসানা মিমি.

Ruslik (talk) 20:17, 20 January 2015 (UTC)

With reference to previous investigation Dr. Syed Shahzad Ali Najmi/Archive can the following two can be identified as the Sockpuppet.

Reason: Keeps on adding and supporting about Shahzad Ali Najmi and his book, used for commercial advertising.

• Najmi Healing Energy - Discussion Page

• Syed Shahzad Ali Najmi - Discussion page

As the previous Sockpuppets which were Blocked in English Wikipedia and later on Urdu Wikipedia, these two users are acting as the same.

Please confirm if the are Sockpuppets. --Tahir mq (talk) 14:00, 20 January 2015 (UTC)

If the users are problematic in their editing and not responding to direction, then just utilise your tools to manage them. There is no evident advantage getting a checkuser for these users.  — billinghurst sDrewth 06:49, 24 January 2015 (UTC)

We have been busy with this vandal over the past months. Now we would like to check one's IP addresses to see if there's a way to block one more efficiently. If range block would do, then it would appreciated if you could help us with fetching a reasonable range as we have little experience with range blocks on Estonian Wikipedia.

Also there's Sals104, Sals101, Sals100 and 78.84.146.54 with similar vandalizing pattern.

@Pikne: I have placed two IP range soft-blocks as there would be the chance of collateral damage for real users if I did hard blocks. If there are further problems then please do come back and ask for more assistance.  — billinghurst sDrewth 11:42, 25 January 2015 (UTC)

Thanks in advance. Pikne 14:12, 24 January 2015 (UTC)

The user also vandalized on the Finnish Wikipedia. The latest is guc. I'm pretty sure it's the same user. --Stryn (talk) 12:40, 25 January 2015 (UTC)

Sals116 just continued with his rampage in Estonian Wikipedia.

We have reason to believe that he is Latvian. Might it be possible to contact some local internet service providers about this vandal? Kruusamägi (talk) 12:07, 26 January 2015 (UTC)

Sure @Kruusamägi: if an admin would please contact stewards(_AT_)wikimedia.org and we can provide some data for you. I would suggest that the community edits w:et:Mediawiki:Titleblacklist and add something like .*Sals1\d{2}.* <newaccountonly>. If the community wishes for multiple range blocks and is prepared for the consequences then we can do that. If you are going to do that it may mean that you need to direct users to your admin pages at somewhere like meta so they can contact to get local IP block exemptions.  — billinghurst sDrewth 12:42, 26 January 2015 (UTC)

Added the regex suggested by @Billinghurst: to w:et:Mediawiki:Titleblacklist. Cumbril (talk) 17:00, 26 January 2015 (UTC)

Possible Possible though with the time separation it is difficult to be too definitive.  — billinghurst sDrewth 12:00, 25 January 2015 (UTC)

 pending close of admin decision process I do not believe that this should be undertaken at this time, if required they can be taken when the vote is to be closed and is a demonstrated need. There is a history of alternate accounts.  — billinghurst sDrewth 06:36, 24 January 2015 (UTC)

The very reason this is requested, now, is because there may be possible subversion of the admin request process, using sock accounts, by a user confirmed to maintain a 200 plus sockfarm and has abused sock accounts before. -- Cirt (talk) 06:40, 24 January 2015 (UTC)

As mentioned, I know the history well. When it is closed we can do the checks, prior to a decision. There is no advantage and no demonstrated urgency for doing checks now, and it could be seen to pervert the discussion if they are not socks. Whilst suspicions can be checked, we still need to assume good faith.  — billinghurst sDrewth 06:45, 24 January 2015 (UTC)

It will potentially pervert the discussion to allow possible socks to comment in the discussion while it is ongoing, creating potential for follow-on-voting based upon possible socking, during the voting period itself. -- Cirt (talk) 06:48, 24 January 2015 (UTC)

Then please gain a consensus of your community to have these checks undertaken prior to the close.  — billinghurst sDrewth 06:51, 24 January 2015 (UTC)

Thank you for this recommendation, requested, at [5]. -- Cirt (talk) 07:09, 24 January 2015 (UTC)

We never require a consensus of the community for conducting a check; can you point me to a policy that says this? We should only be checking to see whether the request follows the CU policy and the privacy policy. What is even more disturbing is that this sets the precedent that community consensus can direct that a check is run, thus violating someone's privacy. --Rs chen 7754 17:02, 24 January 2015 (UTC)

Thank you for your helpful comment, Rschen7754, most appreciated. -- Cirt (talk) 22:59, 24 January 2015 (UTC)

• As one of the few bureaucrats on Wikiquote, I support running a Checkuser investigation on the two editors identified above, although for slightly different reasons than Cirt proposes. Wikiquote has lately been deluged by a vandal (or team of vandals) using multiple accounts to disrupt the operations of the cite generally, and engaging in a pattern of behavior wherein an account will make a few legitimate edits before launching into disruptive attacks (of which Kalki has been a frequent target). In this light, I agree that it is suspicious for the two identified low-volume editors to have appeared in an adminship discussion as they have - even if this is totally unrelated to any past actions by Kalki. This is particularly the case for User:Gene96, who has edited nowhere else in any Wikimedia project. I also believe that it would be a mistake to require a community consensus on the point, if there is any possibility that such consensus could be tainted by sockupuppetry occurring in that discussion. BD2412 T 22:35, 24 January 2015 (UTC)
  • Agree here with BD2412. -- Cirt (talk) 22:59, 24 January 2015 (UTC)
    • I also note that Kalki has stated in the Wikiquote discussion initiated by Cirt that he has no objection to having his status checked. Cheers! BD2412 T 01:09, 25 January 2015 (UTC)

Done, not socks of Kalki. They are socks and of another person who has voted. I have struck the votes.  — billinghurst sDrewth 12:10, 25 January 2015 (UTC)

Which other person who has voted are they socks of, Billinghurst? -- Cirt (talk) 17:04, 25 January 2015 (UTC)

Cirt blocked both accounts as socks, but of whom? I'm concerned. Someone in that RfA attempted to disrupt or warp it. I think Wikiquote needs to know. Thanks. --Abd (talk) 21:03, 25 January 2015 (UTC)

Agreed. -- Cirt (talk) 21:12, 25 January 2015 (UTC)

I also agree. If there is another editor of whom these are sockpuppets, we should know who that is, as they are engaging in prohibited conduct. BD2412 T 21:59, 25 January 2015 (UTC)

Thank you, BD2412, then it seems we in the en.wikiquote local community are unanimous in requesting more information about who else is connected to these sockpuppets as the sockmaster and other socks. -- Cirt (talk) 03:00, 26 January 2015 (UTC)

When multiple accounts are in breach of community policy, it is usually the protocol to link to that policy though I went and found that policy on this occasion. It is my opinion that getting the person to self-disclose may be more valuable for a resolution and an explanation, and ask that you try that on this occasion. If the person chooses to not to disclose then I am comfortable releasing that information.  — billinghurst sDrewth 05:51, 26 January 2015 (UTC)

Billinghurst, this is quite curious, and not how it's normally done at Wikiquote or Wikipedia, to my experience. We are unanimous in asking you, in a request from our local Wikiquote community, to reveal the connected sock accounts. You said the data is unequivocal. We're not asking for IP addresses. Merely to identify all the confirmed socks together. Please. Thank you, -- Cirt (talk) 06:26, 26 January 2015 (UTC)

I've now made the request for whoever is behind those accounts to self-disclose in a comment at q:Wikiquote:Requests for adminship/Kalki (4th request). I must say this is quite odd, and against the unanimous consensus of our local Wikiquote community. Again: We the local Wikiquote community please ask Billinghurst to identify all accounts  Confirmed as tied to sock accounts Gene96 (talk · contribs) and Jimmy11234 (talk · contribs). -- Cirt (talk) 06:35, 26 January 2015 (UTC)

Cirt, I have not refused to provide the detail and I clearly state that above. I have suggested that for a community in dispute that you try self-disclosure. There is no vandalism, there is no urgency, so please try a diplomatic approach to a resolution, rather than your current approach of looking to smash heads. (Please don't overstate your case, three people does not equal unanimity.) I ask you to employ some circumspection, reflect on why your community has got itself into this situation, and look to an outcome that is beneficial to the community.  — billinghurst sDrewth 06:49, 26 January 2015 (UTC)

Billinghurst, each of your statements are more confusing! What do you mean by "community in dispute"? What do you mean by "why your community has got itself into this situation"? Either some third party at the ongoing Request for Adminship is part of the socking, or not, right? You already stated that was the case. Now, I've followed your advice, and posted to the RFA page with a formal request for that third-party to self-disclose. But I just for the life of me can't understand your behavior here. Please, enlighten me, why is this particular case so unique? -- Cirt (talk) 07:05, 26 January 2015 (UTC)

Do you really think that this is the place for such a discussion? I don't. Take some time to reflect, read between the lines.  — billinghurst sDrewth 07:31, 26 January 2015 (UTC)

Billinghurst, I'm sorry, I'm trying to understand, but I really don't know what you mean. I don't even know what you're implying. I don't even know why you don't think this is the place for a discussion about Checkuser results. Can you please explain it to me? Please? Please, Billinghurst, I'm trying to understand here. I've notified most of the users that voted before your action at the Request for Adminship. I've posted a notice at the Request for Adminship, asking users to please self-disclose if they are related to the other two  Confirmed sock accounts. I just don't understand what you're hinting at here, and why this isn't the place? -- Cirt (talk) 07:34, 26 January 2015 (UTC)

Perhaps others that commented above including Rschen7754, BD2412, or Abd are as confused as me as to why other sock account(s) at the Request for Adminship haven't been disclosed, and/or what else may be going on here. I guess I'm not clued into "read between the lines" as Billinghurst put it. Perhaps others have more clue than I, so maybe they'll comment with some insight. -- Cirt (talk) 07:49, 26 January 2015 (UTC)

I can see the value in maybe waiting 24-48 hours or so, but after that, the community deserves to know I think. --Rs chen 7754 14:37, 26 January 2015 (UTC)

Cirt was reasonably correct about "unanimity" in that there is no opposition. However, Billinghurst's restraint is also reasonable. I recommend that Cirt stop arguing here. Making the request was enough. Rschen7754, thanks. --Abd (talk) 15:17, 26 January 2015 (UTC)

Okay, I agree here with the idea by Rschen7754, above. Thank you, -- Cirt (talk) 15:41, 26 January 2015 (UTC)

There has been no self-disclosure, which means that CU disclosure is all that remains. The third and original username/account holder for this checkuser request is Miszatomic.  — billinghurst sDrewth 21:55, 27 January 2015 (UTC)

I've notified Miszatomic of this request. Tiptoety ^talk 22:42, 27 January 2015 (UTC)

Is this the same puppeteer as the several accounts named (only a fraction of those involved in a massive campaign of disruption) at WQ:AN#Twerp troll-vandal earlier this month with related content and locus of the activity. Is this also related to this case from last month with similar threatening behavior? At issue is whether we are dealing with a persistent long-term (very long-term) campaign of vandalism and harassment, or just a recent copycat. ~ Ningauble (talk) 17:00, 28 January 2015 (UTC)

• I logged into the accounts when one of the vandals first said that his account password was Zarbon I logged into other vandals to check if they were vandals and used this information and took action to block other accounts immediately .
  • Miszatomic (Talk) 7:00, 28 January 2015 (UTC)

This is not about this case, Miszatomic is talking about other accounts, not the two identified socks here. He has already acknowledged being the two identified socks. --Abd (talk) 19:20, 28 January 2015 (UTC)

Note: This one can be closed, thank you. -- Cirt (talk) 22:13, 30 January 2015 (UTC)

Unrelated Unrelated. AFAICS, it would appear that each account has its own, distinct access point to Internet. There are some overlaps that suggest that there are indeed two different people [6] [7]. Elfix 19:36, 27 January 2015 (UTC)

Note: This one can be closed, thank you. -- Cirt (talk) 22:14, 30 January 2015 (UTC)

This has been addressed by other means.  — billinghurst sDrewth 14:21, 31 January 2015 (UTC)

Thanks. BD2412 T 14:51, 31 January 2015 (UTC)

• Talk archives
• Steward requests archive/Checkuser

• Noindexed pages