Meta:Requests for CheckUser information/Archives/2007-01

yiddish wikipedia checkuser

Additional check by votes page if not sockpuppet.[1]. A new user נחום ראזענבערג wants to be sysop while involved in edit wars. I have opposed his promotion on common sense grounds, all supported with clear links why we should not trust this user to grant him sysop rights. But this user [2] silently votes for him and ignoring all reasoning. Can we be sure they are not the same guy?--יודל 21:38, 11 January 2007 (UTC)

Done Both users seem to have dynamic IPs, and they do not even share an ISP, from what I can tell. So, I highly doubt they are the same person.--Shanel 21:59, 11 January 2007 (UTC)

Thanks--71.247.142.188 21:04, 15 January 2007 (UTC)

English-language wikiversity

There's an ongoing (quite hot) discussion about rounded corners at the English-language Wikiversity and a new user has registered today and his 2 edits have been made on this talk page. Maybe it's a coincidence, but I find it strange that this "new" user finds this talk page immediately after registering and agrees word for word with another user. Could you please confirm that they are 2 different people? I don't want to do it since I've taken part in this discussion. guillom 09:37, 12 January 2007 (UTC)

The users do not share IP's. Effeietsanders 09:45, 12 January 2007 (UTC)

Thanks. guillom 09:48, 12 January 2007 (UTC)

Finnish wikiquote

There's persistent vandal using multiple accounts in finnish Wikiquote. Here are some of his accounts/contributions: [3], [4], [5], [6], [7], [8], [9]. Could you check if they are using same IP or IP range. --Harriv 09:48, 16 January 2007 (UTC)

None of them have the same IP nor range. Some are open proxies and some are from Finland. guillom 10:02, 16 January 2007 (UTC)

Thanks. --Harriv 10:15, 16 January 2007 (UTC)

CU request for WN fr

Last time, fr:user:Korki has decided to proceed to modifications which have started a kind of edition war with myself. As a sysop on the project, and considering his (?) behaviour (no discussion, insults in history), I have decided to block him for 7 days. But, I wonder if this count can be a sockpuppet for other users. I would like a CU to be proceed, and compare for (at least) the followings count on WN fr : fr:user:Faager, n:fr:user:Brilbot. Thank you very much. Grimlock 20:32, 7 January 2007 (UTC)

Done fr:user:Faager is almost certainly not a sockpuppet. fr:user:Korki and n:fr:user:Brilbot have the same ISP, but have static IPs on different ranges.--Shanel 20:43, 7 January 2007 (UTC)

ru-sib.wikipedia

Can someone please do a checkuser on the last 4 vandals I blocked on that wiki to see if there's some range to block? --.anaconda 09:52, 2 January 2007 (UTC)

The users Зайогук, ГогаСуперЗорд e ЗелёныйОпасныйДракончег share the same IP address

The user ОАллахБыПобралЭтогоЗукагоя edited from 2 IPs that do not belong to the same subnet of the previous three.

Hope this helps. Ciao. --Paginazero - Ø 10:50, 2 January 2007 (UTC)

Can you check those IPs against users on ru:? MaxSem 10:51, 2 January 2007 (UTC)

Конечно. The IP shared by the first three users has been used also by ru:User:Атакующая Подводная Лодка on Dec. 30th.

One of the IPs of ru-sib:User:ОАллахБыПобралЭтогоЗукагоя is shared with ru:User:Фтопку!, which edited today from it. Пока. --Paginazero - Ø 11:01, 2 January 2007 (UTC)

Hm, Атакующая_Подводная_Лодка... Very strange... Could you please check whether these IPs were open proxies or not? Edward Chernenko 13:14, 2 January 2007 (UTC)

That is not something you should check with CheckUser. You might want to ask someone like User:Tawker or User:RonaldB that kind of stuff, they do it more often and have programs for that. Effeietsanders 13:48, 2 January 2007 (UTC)

I know what's CheckUser, don't worry :-). I don't know IPs to check so I ask checkuser to get this IPs and test them using something like this tool. Edward Chernenko 13:58, 2 January 2007 (UTC)

The IP from which Атакующая Подводная Лодка edited is not an open proxy, for what I can understand.

One of the IPs from which ОАллахБыПобралЭтогоЗукагоя might be, although the online test gave no answer. If another steward, more keen on this sort of investigation, would like to help, I'd appreciate it. --Paginazero - Ø 15:49, 2 January 2007 (UTC)

There are very high odds that the ips used by ОАллахБыПобралЭтогоЗукагоя are open proxies --Cspurrier 16:04, 6 January 2007 (UTC)

checkuser for yi.wikipedia.org

the yiddish wikipedia, a user wants to lock this page [10], therefore he makes an edit war, so to be sure this is not the case please check this [11] 70.107.142.70. thanks--יודל 01:35, 10 January 2007 (UTC)

Done. נחום ראזענבערג does not edit from 70.107.142.70, and his IP address is stable within a range. —{admin} Pathoschild 01:47, 10 January 2007 (UTC)

check user request for yiddish wikipedidia

about 3rr rule suspicion that the same user is reverting with other names more then 3 times certen article [12]. Please check 3 user names if they aren't the same IP address [13] [14] [15]--יודל 22:11, 18 January 2007 (UTC)

Done Confirmed that yi:User:געוינער, yi:User:יידל, and yi:User:אבי ריינער are in fact the same IP address. Bastique 00:03, 19 January 2007 (UTC)

Also with the same IP:

• yi:User:אַברהם ריינער
• yi:User:יִודל
• yi:User:אבִישי
• yi:User:Hotwier Bastique 00:07, 19 January 2007 (UTC)

Chinese Wikipedia

I request to check these vand users in Chinese Wikipedia.

• zh:User:維哥()
• zh:User:OHOHOHOO
• zh:User:正義
• zh:User:投訴
• zh:User:John088

I think these users are sock puppet by zh:User:民國九十五年,because 民國九十五年 has used the same method to discredit other sysop.--Alex S.H. Lin 19:12, 24 January 2007 (UTC)

These users are all using different IPs. They are almost certainly not the same user. Either that or the IPs are open proxies. Bastique 19:28, 24 January 2007 (UTC)

checkuser for yi.wikipedia.org

There are 2 sysups, the same users with different user names. Pleas check it out. יודל and Amsgila123. thank you!--אלזוז 21:13, 23 January 2007 (UTC)

Can someone do it please?--אלזוז 22:43, 23 January 2007 (UTC)

The two users do not share any IP address, none of their addresses belong to the same domain. Hope this helps. --Paginazero - Ø 08:03, 24 January 2007 (UTC)

Ripuarian Wikipedia

There are users on ksh and meta that have been alleged to be sockpuppets that influence discussions and votes. Please check if some of them they are mutually identical:

• ksh:User:Purodha

All IP's in the same range, and not shared with another user. Other users were using the same range though, but that might have been an coincidense. Effeietsanders 12:18, 28 January 2007 (UTC)

• ksh:User:Sabine

I dont see a reason why Sabine should be cu'd? Effeietsanders 11:48, 28 January 2007 (UTC)

• ksh:User:De Klütteboor

Too long ago since last edit. Impossible to CU. Effeietsanders 11:49, 28 January 2007 (UTC)

• ksh:User:Satansbraten

Two IP's, not shared with any other user. Unlikely that he and Purodha were operating from the same computer. However he shares the IP with one other user, but that might have been an coincidense. Effeietsanders 12:18, 28 January 2007 (UTC)

• m:User:Peterretep (alleged to be identical with either Satansbraten or Purodha in ksh)

Jhs (local meta CU, checked this one for me, and his IP equals with Satansbraten on ksh:. Effeietsanders 12:18, 28 January 2007 (UTC)

We have no admin with CheckUser rights. Is it possible for you to check them? Thank you Dbach 17:22, 27 January 2007 (UTC) NB: is there any way for an experienced computer specialist to create sockpuppets and get around IP checks? Dbach 17:25, 27 January 2007 (UTC)

I will look into this. Effeietsanders 11:32, 28 January 2007 (UTC)

Done Effeietsanders 12:34, 28 January 2007 (UTC)

Thank you! Dbach 18:01, 29 January 2007 (UTC)

Yiddish wikipedia votes check-user

We have 3 people voting to block anything with sex related issues from the news section on the front page. [16] Now this smacks of religious censorship, and i would like to request a checkuser to see if they are not the same IP address, since this raises allot of suspicion, vote being done by one brand new user with knowledge of the procedure. can i t be done to be sure this is not a sockpuppetry scenario?

• [17] געוואלד
• [18] רוני
• [19] and the brand new name nulad

Thanks.--יודל 04:18, 29 January 2007 (UTC)

Done. These users do not share IPs or ISPs, although Nullad and געוואלד appear to be in the same state at least.--Shanel 04:40, 29 January 2007 (UTC)

OK Thank You I guess they will have their way to censor the project. Thank you very much.--יודל 04:42, 29 January 2007 (UTC)

no.wikipedia

no.wikipedia (users <admins, bots, bureaucrats, checkusers, oversight>, edits, log)

Please check the following two accounts on no.wikipedia: [20], [21]. The second is thought to be a sockpuppet of the first, and both have been harassing several users with quite coarse language. --Silje 21:40, 25 February 2007 (UTC)

Done and confirmed those users are the same, along with this user. If this continues after this point, let us know and we'll perform an IP block. Bastique 21:56, 25 February 2007 (UTC)

• Jon Harald Søby@nowiki, to check nazi vandals (which turned out to be the same as this guy, and about 10 other accounts). Jon Harald Søby 19:51, 6 March 2007 (UTC)

pl.wikinews, pl.wiktionary & pl.wikibooks

pl.wikinews (users <admins, bots, bureaucrats, checkusers, oversight>, edits, log)

pl.wiktionary (users <admins, bots, bureaucrats, checkusers, oversight>, edits, log)

pl.wikibooks (users <admins, bots, bureaucrats, checkusers, oversight>, edits, log)

Please check the following vandals on pl.wikinews: [22], [23], [24], [25], [26]. I would be thankful if you notify me if the IP's appear on block log or are anonymous proxies. --Derbeth 17:43, 17 February 2007 (UTC)

Please also compare with vandals [27], [28], [29], [30], [31], [32] and block log on Polish Wiktionary. --Derbeth 17:52, 17 February 2007 (UTC)

Plus [33] on pl.wikibooks. BTW, I am sysop on all these three projects. --Derbeth 18:34, 17 February 2007 (UTC)

Is there any specific reason why you want these users to be checked? As you might know, we can not "just do some checkusers", we have a policy to comply with. Effeietsanders 22:54, 18 February 2007 (UTC)

Is fighting vandalism a sufficient reason? As you may check, all users given above have been blocked. There are clues that at least part of these accounts were created by the same person. For example, a vandalism on one project was made just after blocking similar vandal a minute before on an other project. I would not say that all of these accounts belong to one vandal, but I assume that you can find two or three different reappearing vandals between them. --Derbeth 19:53, 19 February 2007 (UTC)

Sounds like it would be. The checkuser policy says:

On Wikimedia projects, privacy policy considerations are of tremendous importance. Unless someone is definitely violating policy with their actions (e.g. massive bot vandalism or spam), revealing their IP, whereabouts or other information sufficient to identify them is likely a violation.

I think vandalism counts as a policy violation. —The preceding unsigned comment was added by 71.217.206.24 (talk • contribs) .

Done All of the users (plus some more users) checked on all three projects used the IP 85.14.73.190. Jon Harald Søby 19:58, 23 February 2007 (UTC)

ca.wikipedia

ca.wikipedia (users <admins, bots, bureaucrats, checkusers, oversight>, edits, log)

Could you please check if ca:Usuari:Dyvid6, with this contributions is the same as the user who made this vandalic contributions just 2 minutes after he made his last contribution with his account? His mistakes with ortography and his curriculum in es.wikipeda makes us really think he is. Thank you!--Xtv 19:06, 26 February 2007 (UTC)

After being blocked, it seems he presumably changed the ip and continued making contributions with the user account. So, it should be looked his ip before making the new contributions, for example in this one. Thank you.--Xtv 19:51, 26 February 2007 (UTC)

Done It was Dyvid6 who made those edits. He has also shared an IP with Taichi6. Jon Harald Søby 19:11, 27 February 2007 (UTC)

ar.wikipedia

Hi, I would like to have checkuser on ar:User:نهرو and ar:User:القرش الأسود and ar:User:ود ادم. Almost all their contributions were votes on ar.wikipedia Articles for deletion.--Marquez 00:03, 6 March 2007 (UTC)

القرش الأسو and نهرو come from IPs used by ود ادم drini ^[es:] _[commons:] 00:21, 6 March 2007 (UTC)

Thanks, can you also tell me if those users ar:User:الحويطي and ar:User:هانئ الشنقيطي, uses the same IP that ar:User:نهرو and ar:User:القرش الأسود and ar:User:ود ادم use. By the way, if those users uses the same IP then they are sockpuppets. I don't know what the policy is but shouldn't you provide ar.wikipedia with all users who uses this ip since it is a sockpuppet? --Marquez 01:35, 6 March 2007 (UTC)

why those? Why not on your original request? I won't provide the IPs however. policy is m:Privacy policy. If you see sockpuppet behaviour, block as that, no need to checkuser. See es.wikiquote exmaple below. drini ^[es:] _[commons:] 02:34, 6 March 2007 (UTC)

OK. I'm the user ar:User:Marquez in Arabic wikipedia and I am an admin in Arabic wikisource. A user created an article in Arabic wikipedia about a religious sect that exist in Egypt. It seems that he made this thing up. Since it is original research (the sources were "I made an interview with members of this sect"), it must be deleted (speedy deletion). However, the community preferred to put the article in ar:ويكيبيديا:تصويت للحذف or Articles for deletion. After that, users like ar:User:نهرو, ar:User:القرش الأسود, ar:User:ود ادم, ar:User:الحويطي, ar:User:مستخدم:الخليفة الأخضر and ar:User:هانئ الشنقيطي registered and started to vote in Wikipedia:articles for Deletion. Most of their contributions were voting. That's why we would like to know whether they are the same user or not. I did not add all these usernames in my original request simply because I didn't know about them until other wikipedian told me about them. I did not ask for the IP of those users. I just thought that because they were sockpuppets, ar.wikipedia admins need to know other users who uses the same IP.--Marquez 05:51, 6 March 2007 (UTC)

I second the request, we need info on 8 accounts, 3 of them is already proved to be from same IP above (ar:User:نهرو, ar:User:القرش الأسود & ar:User:ود ادم) , the others are ar:User:الحويطي, ar:User:هانئ الشنقيطي, ar:User:مستخدم:الخليفة الأخضر, ar:user:هنري الثامن, ar:user:أحمد الحسنية. Thanks in advance. --Mido 17:37, 6 March 2007 (UTC)

Hello,

هانئ الشنقيطي and :ود ادم share one common IP. Yann 17:56, 6 March 2007 (UTC)

All 5 last accounts have different IPs, although in the same range. Yann 18:19, 6 March 2007 (UTC)

Done Well أحمد الحسنية هانئ الشنقيطي الحويطي ود ادم القرش الأسو and نهرو all are from the same group of ips, while مستخدم:الخليفة الأخ and هنري الثامن come from the of ip range as those above. drini ^[es:] _[commons:] 18:04, 6 March 2007 (UTC)

Thank you guys for your help, appreciated :) --Mido 18:31, 6 March 2007 (UTC)

simple.wikipedia

simple.wikipedia (users <admins, bots, bureaucrats, checkusers, oversight>, edits, log)

Hello there. I would like to have checkuser information on simple:User:Kimberly Ashton and simple:User:Kimbleeashton, to confirm the "whereabouts" of this troll. Thank you.-- Tdxiang 09:32, 28 February 2007 (UTC)

Done. The Kimberly Ashton account is too old to retrieve information about. The Kimbleeashton account shares an IP address with the blocked user Mr. typo correcter, a self-admitted sockpuppet. Information online suggests that this is a secure web proxy, so it is not reliable for pinpointing the user's Internet service provider or rough location. They have not re-used that IP address range. —{admin} Pathoschild 23:03:28, 02 March 2007 (UTC)

es.wikiquote

es.wikiquote (users <admins, bots, bureaucrats, checkusers, oversight>, edits, log)

Good day, I'm q:es:User:Javierme in Spanish Wikiquote and Wikimedia Commons, and I'm currently the only active administrator. I've had an encounter user (User:Citadme) who's been causing disruption for a couple of months. The problem is that, me being the only sysop I feel uneasy being judge and party so I've delayed taking actions as long as I've been able.

I requested steward Drini (since he speaks Spanish so he can read the details and the comments) to have a look and deal with the user but he refused in a post to the "Cafe" (the equivalent of Village Pump in Spanish speaking projects) on feb 18 stating that it wouldn't be correct for him as a steward to deal with a local affair and he asked the community to get involved and form consensus over what to do.

He also asked the other administrator (who was active 3 months ago) to get involved and look into the issue, but Unnio didn't return neither respond.

The few regular users commented and agreed at the Cafe that Citadme was being disruptive

• Yorusti
• Macalla
• Fernando Suarez

While another expert user (Anna) had tried to reason with him and make him follow Wikimedia policies at Citadme's discussion page and another regular user (Alhen) confirmed my view and expressed his support towards my actions in mine)

Citadme disagreed and made comments that only experts (like him) should edit some entries

• [34]

So with the community support I went and blocked him for 24 hours, without preventing his IP from editing or creating new user accounts.

• [35]

Since then, several new accounts showed up created the previous and the following days started reverting to the same texts to citadme:

• q:es:User:Pediaknowledge

18:49 15 feb 2007 Pediaknowledge (Discusión | contribuciones) Nuevo usuario

Using the same phrases "you won't silence god!" as citadme. Compare edit summaries [36] atheism won't win! with citadme's comments about people can't silence god: [37], [38]

• q:es:User:Neutralityon

# 10:24 19 feb 2007 Neutralityon (Discusión | contribuciones) Nuevo usuario

whose only contribution has been a revert to citadme: http://es.wikiquote.org/wiki/Especial:Contributions/Neutralityon

• q:es:User:Psychologyn

# 10:29 19 feb 2007 Neutralityon (Discusión | contribuciones) se creó la cuenta para Usuario:Psychologyn (Discusión | contribuciones | bloquear)

Who, claiming to be a psychologist, started a psychological intervention of the wiki. User creation log shows it was created by neutralityon himself

• q:es:User:Ajusticiandoaberzales (whose name translates as Executing-Basque-Nationalists)

09:27 21 feb 2007 Ajusticiandoaberzales (Discusión | contribuciones) Nuevo usuario

Who "silenced Javierme in the name of god": [39]

• q:es:User:Psiquiatraonline'

09:29 21 feb 2007 Ajusticiandoaberzales (Discusión | contribuciones) se creó la cuenta para Usuario:Psiquiatraonline (Discusión | contribuciones | bloquear)

who, claiming to be a psychiatrist, continued the "psychiatric valoration of current administration", user creation log shows it's the same as Ajusticiandoaberzales

Citadme had asked the previous days I should leave to other projects closer to the interests shown by the photographs at my Commons page and that these should be analysed by Wikimedia psychologists and psychiatrists ([40][41], [42] ). Later from both Psiquiatraonline and Psychologyn [43] accounts, these photographs were described as proves of me suffering several mental disorders.

Some other usernames are a little bit worrying:

• q:es:User:Fullofinsight, q:es:user:Elvengadordelasangre (the-blood-avenger), q:es:ElGranajusticiador (the-great-executioner)

There have been also some IPs involved in the disruption:

• q:es:User:201.246.67.51 (blanking a page on buddha)
• q:es:User:80.35.110.110 (again blanking buddha page and calling a regular user a "diabolic witch" for editing the page of a fake god)

So, given that the user has been disrupting Wikiquote for a while, users have expressed on Cafe (Village Pump) that they agree on the blocks, the creation of disruptive socks I think it's warranted now to request a checkuser on those usernames so the sockpuppets can be stopped, and I also request further comments from the stewards. --q:es:User:Javierme --Javierm 00:20, 2 March 2007 (UTC)

You want comments? Independently of the checkuser you requested, the evidence you've gathered is enough to warrant citadme a block, for the attacks (calling witches and other things some users), refusal to work the wiki way (he reverting and impeding "non experts" from working on pages he has owned) and for the use of disruptive sockpuppets (it's clear to me they're sockpuppets, other than blocking the IP, there's not much to prove with checkuser). So, in my view, go ahead and block. drini ^[es:] _[commons:] 01:03, 2 March 2007 (UTC)

OK, I can block his accounts next time they're used for a new attack, but, what if he waits until getting promoted to sysop through sockpuppet votes? Pediaknowledge's only contribution this month has been to express his interest in becoming a sysop [44], at the same list Citadme had joined two minutes before [45]. I'd prefer to have some technical prove rather than only the coincidences in point of view, idiolect, modus operandi and time of logging. --Javierm 23:46, 2 March 2007 (UTC)

Done. These accounts were used from a very large Internet service provider, which makes correlation more difficult. It is extremely likely that Neutralityon, Psychologyn, Ajusticiandoaberzales, and Psiquiatraonline are the same person, and that Fullofinsight and Elvengadordelasangre are the same. Whether these two groups, Citadme, and 80.35.110.110 are the same is uncertain; but, based on your evidence above, I think it is likely. 201.246.67.51 is based on a different continent and is probably a different person.

It is likely that many or most editors on the wiki operate from these ranges, so I cannot provide any other user names they may be using. My advice, unofficially, would be to encourage some trusted editors to request administrator access to help you deal with this user, and to deny recognition by remaining civil and impersonal. —{admin} Pathoschild 01:03:14, 03 March 2007 (UTC)

Anything on Pediaknowledge and this Citadme-Pediaknowledge edition in a 2 minutes span ([46])? --Javierm 08:32, 3 March 2007 (UTC)

Nope, but see drini's comment above. —{admin} Pathoschild 01:03:35, 06 March 2007 (UTC)

<personal attack removed by Pathoschild.>

Very much persons wants his expulsion, syncerely.

Friendly.--Citadmedefense 00:41, 6 March 2007 (UTC)

Hello Citadmedefence. This page is strictly for requesting CheckUser information; if you believe a user should lose their administrator access, please reach a consensus on the local wiki first, then bring it up on Requests for permission. Thanks. —{admin} Pathoschild 01:03:51, 06 March 2007 (UTC)

• Jon Harald Søby@enwiki, on request of Bastique; none of the ordinary checkusers were available. Jon Harald Søby 21:17, 13 March 2007 (UTC)

• Jon Harald Søby@iswiki, on IRC request to check three users for sockpuppetry. (Suspicion was confirmed.) Jon Harald Søby 21:52, 11 April 2007 (UTC)

Sesotho wiki vandals

Please check this vandal user, this vandal user, this imposter user, this imposter user, this vandal user, st:User:Nembel and this imposter user. I think its proxy users, and if so, block the proxies (as long with every "öppen proxy" here). If possible, check is someone at the Swedish Wikipedia used the same IP as the vandals. Thanks./Mannen av börd 16:55, 24 March 2007 (UTC)

Compromised host in another country. MaxSem 17:33, 24 March 2007 (UTC)

No matches with anyone on svwiki, sorry. MaxSem 17:41, 24 March 2007 (UTC)

User:Kimberly, PulltoOpen, Anita is back! and User:71.231.130.56 and User:Kimbleeashton on the Simple English Wikipedia

PLease check these two users to confirm if this "dangerous" troll is back. Thank you.-- Tdxiang 09:44, 22 March 2007 (UTC)

None of those users come from that IP, but first username is from indef blokced user. Second username is unrelated.drini ^[es:] _[commons:] 15:29, 24 March 2007 (UTC)

User:Xani, User:Zin, User:Dila on the Kurdish Wikipedia

Please check them. User Xani has voted with Zin and Dila for his adminship (this is my opinion). --Bangin 11:39, 18 March 2007 (UTC)

Do you have any reasons to believe so? MaxSem 13:10, 18 March 2007 (UTC)

A lot, but is it ok to tell them here? You can trust me, there I'm a bureaucrat. Can I write then the reasons in german? --Bangin 13:31, 18 March 2007 (UTC)

If you want, you could come to #wikimedia-stewards on irc.freenode.org (you can connect through http://chat.wikizine.org if you have no irc client) to clarify your suspicions. Effeietsanders 13:42, 18 March 2007 (UTC)

• Processing Effeietsanders 14:57, 18 March 2007 (UTC)

He admitted it himself. MaxSem 15:37, 18 March 2007 (UTC)

User:Codice1000, User:Mausolo on Meta

As a recent checkuser request on the Italian Wikipedia showed that these accounts have been abusively used to gain consensus, I'm asking for a check also here on Meta as both participated to the discussion for the creation of the Insubric Wikipedia. I already requested this to M/, here's his reply. Thanks. --.anaconda 01:09, 13 March 2007 (UTC)

Same ISP, but no IP matches --Cspurrier 01:27, 13 March 2007 (UTC)

AFAIK it's a very big ISP. Can you please compare the IPs used on Meta with the one used on it.wiki, as suggested by M/? check if they used one these IPs on it.wiki? --.anaconda 01:30, 13 March 2007 (UTC)

IPs match between it.wiki Codice1000 and meta Codice1000 and it.wiki Mausolo --Cspurrier 02:11, 13 March 2007 (UTC)

"Fucking bastard"s on the English Wikiquote

• 00:00, 25 March 2007 InvisibleSun is a fucking bastard (Talk | contribs | block) New user
• 23:58, 24 March 2007 Cbrown1023 is a fucking bastard (Talk | contribs | block) New user
• 23:58, 24 March 2007 UDScott is a fucking bastard (Talk | contribs | block) New user
• 23:54, 24 March 2007 Kalki is a fucking bastard (Talk | contribs | block) New user

Vandalism-only accounts (with bad usernames) created on the English Wikiquote. We are looking to see if they were created by the same IP address, and if so, please block that IP with account creation disabled. Cbrown1023 talk 17:54, 25 March 2007 (UTC)

Done, results reported on IRC. MaxSem 18:22, 25 March 2007 (UTC)

Persian Wikipedia (fa)

I'm an admin on persian wikipedia. Recently two users strongly supports each others for POV pushing on religous articles and even articles about living persons. They vote in the same way on AfDs and appear on every discussion page that one of them is involved. User accounts are created in 1 day and they have been blocked several times for incivil actions. Some users complained about this matter on persian wikipedia's ANB. User accounts are: fa:User:Navid.k and fa:User:Taeedxy. For checking If I'm an admin there or not you can see my previous Requests for CheckUser information and Requests for permission. You can mail me via meta email address. Thank you in advance. Hessam 14:27, 4 April 2007 (UTC)

on it Effeietsanders 19:31, 4 April 2007 (UTC)

The users share the same ranges. However, they are not the only users using these ranges. At least one more contributor with quite an amount of edits is active under these ranges. Further several users with a relatively small number of edits. It can not be stated definitively that these two users are sockpuppets, as they might be coincidentally on the same IP ranges (i.e. same provider or so). It can not be excluded either. There is a possibility they are sockpuppets. Effeietsanders 19:35, 4 April 2007 (UTC)

als.wikipedia

als.wikipedia (users <admins, bots, bureaucrats, checkusers, oversight>, edits, log)

Hi, I am administrator in the alemannic Wikipedia (als:User:Umschattiger). I request Check user information. Reason: als:User:Kennsch? is suspected to post fake content (e.g. als:Husa, which should be a disease I can't verify. During the discussion (als:Diskussion:Husa) he suddenly got support from als:User:00x0ex01. Later, this second user turned his opinion to the complete opposite (with no reason). I have to assume that both users are identical and the person behind the nicknames intends to spoof me (and other admins). Before blocking these "two" users, I request checkuser to proof my suspicion. It would be nice a steward would tell me, if the two mentioned users have used the same IP (which IP's have been used, would be useful, but not necessary). Thank you in advance. --Umschattiger 21:28, 30 March 2007 (UTC)

Comment: Strong oppose to CU in this case. It's simply a random nonense article (deletion and/or blocking of these users was suggested, see also [47]). I can't see any facts that meat the CU and privacy policies criteria (also explained this to Umschattiger already in German). --:Bdk: (CU on de.wikipedia) 21:38, 30 March 2007 (UTC)

May be a border case. But I have two possibilites: I can block the suspected users without checkuser information only because of my suspicion. Or I'll block/will not block the users after Check user gave the result, that IPs are identical/are not identical. More is not necessary. Which way I have to choose is your decision. IMHO a confirmed suspect is better, but I'm not familiar with the details of your policy --Umschattiger 21:44, 30 March 2007 (UTC)

See CheckUser policy and Privacy policy. Well, it would always be easier if you know everybody's IPs, but this is not a reason to check every account that edits in an unwanted way (here: to create one single fake article). Please think about the effects a check would have on further requests for all such "low-level" cases. This would be precedent-setting for als.wikipedia. Please, just delete this **** article, and - if regarded as needed - block these users. As already said, it should be pretty easy to find out if this article really is a fake or not – just ask for the medical term for that "illness". (No offence meant against Umschattiger, btw.) --:Bdk: 21:53, 30 March 2007 (UTC)

PS: If you're personally involved, it's always best to ask another admin to block users or to delete pages :-) --:Bdk: 21:56, 30 March 2007 (UTC)

First, I'm not offended (why should I?). And second, I'm in contact with admin als:User:Chlämens in this case. But thanks for your help --Umschattiger 22:02, 30 March 2007 (UTC)

Not done per the above discussion. —{admin} Pathoschild 17:04:58, 01 April 2007 (UTC)

cross wiki spam

There is a very likley en:Joe job going on in the blacklist. Before I list names from a bunch of wikis that are likely to be related, let me give some background. Jonathen Barber was an obsessedwithwrestling.com column writer. He went and promoted his column using over 100 sockpuppets on english wikipedia. This resulted in the site obsessedwithwrestling gettig placed on the meta blacklist. A few concerned editors contacted obsessedwithwrestling.com and told them about the spam that Barber was doing. This resulted in Barber's columns getting deleted. (see discussion here). Following that incident he then starts to spam using proxies to hold copies of his now deleted columns. (see here). I have blocked approximately 3-4 proxies over this on the meta blacklist. In addition to spamming proxies he also used web.archive/obsessedwithwrestling to get around my original proxy blockings. This resulted in my blocking of web.archive.*obsessedwithwrestling (basically allow web.archive if obsessedwithwrestling does not follow it). After having done this, he now seems to have turned to trying to get other wrestling sites blacklisted. One such example is gerweck.net, the reporting account actually reported a few accounts that did not spam, which is really odd and raised concerns. (see here) Following this we now had a spate of crosswiki spam adding in tnawrestling.com using multiple accounts on multiple wikis. (see here). A listing of possible users and diffs are as follows:

• The over 100 sockpuppets of JB196, all of which spammed this guys columns into wikipedia. (primarally english wiki at this point)

following the socks, after the blacklisting of the site, the following accounts add links to alternative ways to bypass the blacklist

• en wikipedia Jackevens101 adds links to web.archive.org/web/20051118043205/http://www.obsessedwithwrestling.com
• en wikipedia FipphenrocksDawsons adds links to same site as above.
• en wikipedia GReeNmOuntainKeurig adds links to same site as above.
• en wikipedia HappyG00Lucky adds links to same site as above.
• en wikipedia Im_Afraid_of_the_Dark adds links to same site as above
  • • note on the above users, at some point they stopped attempting to add the web.archive link, because at that point I had removed the ability to do so.
• en wikipedia [48] adds links to proxy sites. (notice the edit summary).
• en wikipedia Staeraftphee, more spam notice the following edit summary. [49]

gerweck.net spammers (see spam blacklist talk page for all the details). These all happen after I had blocked the proxies and bypasses around the blacklist above (and or around the same time)

• http://en.wikipedia.org/wiki/Special:Contributions/GerweckWins
• http://en.wikipedia.org/wiki/Special:Contributions/Gerweck2
• http://it.wikipedia.org/wiki/Speciale:Contributi/GerweckGilbert
• http://es.wikipedia.org/wiki/Especial:Contributions/GerweckOwns
• http://es.wikipedia.org/wiki/Especial:Contributions/LightGerweck
• http://it.wikipedia.org/wiki/Speciale:Contributi/Quotethedrama
• http://co.wikipedia.org/wiki/Special:Contributions/FruitLoopsRule
• http://cs.wikipedia.org/wiki/Speci%C3%A1ln%C3%AD:Contributions/ErasterStaed (note this account has no edits, but was created around this time, and even was reported as a spammer)
• http://cs.wikipedia.org/wiki/Speci%C3%A1ln%C3%AD:Contributions/Pencilart
• http://en.wikipedia.org/wiki/Special:Contributions/Frenchdipper
• http://sl.wikipedia.org/wiki/Posebno:Contributions/Brushwithdeath
• http://cs.wikipedia.org/wiki/Speci%C3%A1ln%C3%AD:Contributions/Circlejerk
• http://es.wikipedia.org/wiki/Especial:Contributions/Gerweckpop
• http://en.wikipedia.org/wiki/Special:Contributions/Astedscroll
• http://es.wikipedia.org/wiki/Especial:Contributions/GerweckOwnss
• http://fr.wikipedia.org/wiki/Special:Contributions/Bedtimestory
• http://en.wikipedia.org/wiki/Special:Contributions/Fckship
• http://it.wikipedia.org/wiki/Speciale:Contributi/HiroshimaGerweck
• http://it.wikipedia.org/wiki/Speciale:Contributi/WikGerweck
• http://it.wikipedia.org/wiki/Speciale:Contributi/Gerweckrules
• http://sl.wikipedia.org/wiki/Posebno:Contributions/Supercrazy
• http://fr.wikipedia.org/wiki/Special:Contributions/Jkwltape
• http://cs.wikipedia.org/wiki/Speci%C3%A1ln%C3%AD:Contributions/GerweckinglyHatian
• http://sl.wikipedia.org/wiki/Posebno:Contributions/Enteringandbreaking
• http://fr.wikipedia.org/wiki/Special:Contributions/HatianButtBuddy
• http://de.wikipedia.org/wiki/Spezial:Beitr%C3%A4ge/HatianButtBuddy
• http://de.wikipedia.org/wiki/Spezial:Beitr%C3%A4ge/HatiantoNoend
• http://es.wikipedia.org/wiki/Especial:Contributions/Hatonthebackofyourbutt
• http://es.wikipedia.org/wiki/Especial:Contributions/FrenchKissingFrench
• http://it.wikipedia.org/wiki/Speciale:Contributi/GilbertoGerweck
• http://cs.wikipedia.org/wiki/Speci%C3%A1ln%C3%AD:Contributions/Gonetowindup

Reported by (still related to above):

• http://meta.wikimedia.org/wiki/Special:contributions/Gloryhighbone

tna request: (details here)*http://en.wikipedia.org/wiki/Special:Contributions/TNARasslin

• http://it.wikipedia.org/wiki/Speciale:Contributi/TNAWrestling
• http://it.wikipedia.org/wiki/Speciale:Contributi/Tnarules
• http://it.wikipedia.org/wiki/Speciale:Contributi/GsquaredArabian
• http://it.wikipedia.org/wiki/Speciale:Contributi/GoFlowFrickFrack
• http://fr.wikipedia.org/wiki/Special:Contributions/TNARasslin
• http://it.wikipedia.org/wiki/Speciale:Contributi/TNAWrestlingRules
• http://hu.wikipedia.org/wiki/Speci%C3%A1lis:Contributions/TNABabay
• http://hu.wikipedia.org/wiki/Speci%C3%A1lis:Contributions/LimitofTNASgREATNESS
• http://tr.wikipedia.org/wiki/%C3%96zel:Contributions/Crymeariver
• http://cs.wikipedia.org/wiki/Speci%C3%A1ln%C3%AD:Contributions/HeavyandAble
• http://sr.wikipedia.org/wiki/%D0%9F%D0%BE%D1%81%D0%B5%D0%B1%D0%BD%D0%BE:Contributions/Alertforyoutome
• http://cs.wikipedia.org/wiki/Speci%C3%A1ln%C3%AD:Contributions/TNAWrestling
• http://ja.wikipedia.org/wiki/%E7%89%B9%E5%88%A5:Contributions/TNAlovesHead
• http://vi.wikipedia.org/wiki/%C4%90%E1%BA%B7c_bi%E1%BB%87t:Contributions/TNARules
• http://mg.wikipedia.org/wiki/Special:Contributions/Myaccount
• http://zh-classical.wikipedia.org/wiki/Special:Contributions/Fiftynine
• http://nn.wikipedia.org/wiki/Spesial:Contributions/TNATNATNA
• http://az.wikipedia.org/wiki/X%C3%BCsusi:Contributions/Finkkkkkkkkk
• http://uz.wikipedia.org/wiki/Special:Contributions/TNAForyou
• http://et.wikipedia.org/wiki/Eri:Contributions/TNAWrestling
• http://en.wikipedia.org/wiki/Special:Contributions/FortuneCookieTNA
• http://mk.wikipedia.org/wiki/%D0%A1%D0%BF%D0%B5%D1%86%D0%B8%D1%98%D0%B0%D0%BB%D0%BD%D0%B8:Contributions/TNALovestoFight
• http://fiu-vro.wikipedia.org/wiki/Special:Contributions/TNAForever
• http://uz.wikipedia.org/wiki/Special:Contributions/TNAWrestling
• http://lmo.wikipedia.org/wiki/Special:Contributions/WhattodoinadaywithoutTNA
• http://eo.wikipedia.org/wiki/Speciala:Contributions/TNAWrestling
• http://sv.wikipedia.org/wiki/Special:Contributions/TNAWrestling
• http://ksh.wikipedia.org/wiki/Spezial:Beitr%C3%A4ge/TNAWrestling
• http://ru.wikipedia.org/wiki/%D0%A1%D0%BB%D1%83%D0%B6%D0%B5%D0%B1%D0%BD%D0%B0%D1%8F:Contributions/TNAForever
• http://gv.wikipedia.org/wiki/Special:Contributions/TNAWrestling

reporter was

• http://meta.wikimedia.org/wiki/Special:Contributions/Squared_Trinomial

Note After I whitelisted the tna link on the english wiki, we are now getting spam from

• http://en.wikipedia.org/wiki/Special:Contributions/HeroofWilmington to non wrestling sites even

This is highly likely to be a en:Joe job by one user. —— Eagle101 ^{Need help?} 05:01, 6 April 2007 (UTC)

I confirm that the following accounts almost certainly belong to the same user: itwiki{GerweckGilbert, Gerweckrules, GilbertoGerweck, GoFlowFrickFrack, GsquaredArabian, HiroshimaGerweck, Quotethedrama, Tnarules, TNAWrestling, TNAWrestlingRules}, along with itwiki{JeffKiiing, Gerweckkkkgo, GsquaredArabian, HatianButtBuddy, Kaosasbad, WikGerweck} and probably itwiki{PWInsider2}. I also confirm that the following accounts almost certainly belong to the same user: eswiki{FrenchKissingFrench, GerweckOwns, Gerweckpop, Hatonthebackofyourbutt, LightGerweck}, along with eswiki{GerweckOwnss, Gerwekkkkkk, Gerwekkkkkk2, LightGerweck}.

The user edited with their IP address, probably by accident. This IP address is the only one used in all the cases I listed above. Since I am active on Meta, I cannot verify the reporting users per the Steward policies. —{admin} Pathoschild 06:04:24, 06 April 2007 (UTC)

Since there are no regular checkusers on Meta, I performed the check myself. All sockpuppets are blocked, the IP is blocked for a year. MaxSem 18:42, 7 April 2007 (UTC)

More spam from using accelerator3359 as the wrestling site.

• hu:User:ForYoutoDo
• et:User:Staedtler76
• es:User:FortuneCookieBoy
• eo:User:Freedomthrew
• lb:User:Teedybopper
• oc:User:Trooperstar
• id:User:Intosafety
• nn:User:FreightTrain
• cy:User:Teamplayer101
• hsb:User:Treatinglikeaman

Please look into this, thank you —— Eagle101 ^{Need help?} 02:22, 8 April 2007 (UTC)

I confirm that the following users operate from the same IP address as above and no other (users not listed above italicised): huwiki{ForYoutoDo, LimitofTNASgREATNESS, TNABabay}, etwiki{Staedtler76, TNAWrestling}, eswiki{FortuneCookieBoy, TNAWrestlingExtreme, FrenchKissingFrench}, eowiki{Freedomthrew, TNAWrestling}, lbwiki{Teedybopper}, ocwiki{Trooperstar}, idwiki{Intosafety}, nnwiki{FreightTrain, TNATNATNA}, cywiki{Teamplayer101}, and hsbwiki{Treatinglikeaman}. —{admin} Pathoschild 03:04:01, 08 April 2007 (UTC)

Meta

I noticed that a "mumfum" vandal was blocked here earlier (User:Beansoup). At a fairly similar time I blocked a similar vandal on Wikibooks. On there the IP revealed by Checkuser was one that has now had three such vandal accounts on (the IP will be seen in the log with my entry on). Is it worth checking the user here to see if the IP is the same - thanks --Herby ^{talk thyme} 14:19, 10 April 2007 (UTC)

Confirmed. Don't know if it was a single-shot attack, though. Will investigate more thoroughly it a bit later and block if appropriate. MaxSem 06:49, 11 April 2007 (UTC)

Thanks - saw it in the log. Yesterday's was the third definite one (mumfum vandal) on that IP address on Wikibooks. Let me know if you need more info - regards --Herby ^{talk thyme} 07:08, 11 April 2007 (UTC)

As a further point the same user on Books was blocked on Species at about the same time [50] - I'm guessing the IP will have been the same there too --Herby ^{talk thyme} 12:34, 12 April 2007 (UTC)

Arabic Wikipedia

Hi, it's Azdiyy from Arabic wiki (see the source of my page there for confirmation). I kindly ask you to do a checkuser and/or review the checkuser log and, if my doubts are true, to warn Arabic wikipedia admins.

The main sockpuppet master is an Arabic admin who has an account with the same name here called Aram33. He was banned for breaking the 3RR on the eve of 9 Feb 07 in edit wars with me. The following morning sockpuppet ar:user:الكرداوي registered and engaged in arguments with the same user Aram33 was engaged with (i.e. me). Aram33, unknowingly it seems, carried on editing after the ban until his ip (81.246.209.77) got blocked, and made then a plea to the admin who blocked him using the same ip. Shortly after the ban expired, the sockpuppet stopped. It can be seen from his contributions that this sockpuppet only made edits on two days (Feb 10 & 18).

The previous sockpuppet's name is in Arabic letters. Its latin version, ar:user:al-kirdawy, registered on Feb 12 and posted a comment on Aram33 talk asking him to leave and warning him that a checkuser will be carried on. The stupid comment was deleted by Aram33 after 91 mins (link).

On 22 Feb Aram33 again broke the 3RR and again protected the page calling my edits vandalism. Admin user:Meno25 unprotected the page and warned Aram33. Shortly afterwords, ar:user:Quiet country who is suspected of being a shared sockpuppet (owned mainly it seems by disgruntled and disqualified admin ar:user:Classic 971) attacked Meno25. Sockpuppet Al-kirdawy put a naked image on my userpage and suggested an article made by a user who rebuked Aram33 for deletion. Admin user:MKay banned Al-kirdawy for vandalism and deleted the image as per my request. Again this sockpuppet made contributions on two days only (Feb 12 & 22).

Such incidents cannot pass on unnoticed in a small community such as the Arabic wiki. User:Tarawneh made a comment on Feb 11 that seems to give the impression that a checkuser has been done.

on Feb 17 I posted a comment linking the two accounts and requesting checkuser. The response from other admins was unencouraging that I withdrew my request and apologised. Interestingly, then admin user:Chaos, who was a checkuser, replied saying that Aram33 and the first sockpuppet used the same ip. He added that the sockpuppet is the admin's roommate according to Aram33!

Here I like to ask you to read the Arabic section. It seems to me that all these sockpuppets are related to the same admin - they have been banned but he's still at large. Admin user:Mido banned me for that claim; he still refuses to answer my questions.

For many reasons I suspect many other accounts to have been created by the same person. After much pressure, checkuser on Aram33 and other accounts was agreed to be carried out on 3 April. You should be able to check the log? What suprises me is that no action has been taken since and many questions and emails I ask are left unanswered. I made a comment here hoping the concerned admins will take note and clean their acts to no avail. I am sorry to ask you to go through this. And I know many of them have much to say against me. I also think they will not be able to answer my questions directly. See the comment here made by one of the two checkuser admins to know the type of persons I have to reason with.

The checkuser requested was for:

1. ar:user:Aram33
2. ar:user:Asabbagh
3. ar:user:Asbsamsf
4. ar:user:علي راضي طيب

The checkuser reason should be as follows. Sysop ar:user:Aram33 who is suspected of creating sockpuppets al-kirdawy and its Arabic match (he claimed ar:user:al-kirdawy is his roommate after matching checkuser) seems now to prepare more accounts to be replacements to his main account with view to be admins as more doubts are raised in the community about his involvement. Both ar:user:Asabagh and ar:user:Asbsamsf are heavily involved in admin tasks. Aram33, Asabagh, and Asbsamsf have participated in admin voting recently example. Ar:user:علي راضي الطيب has carried on personal attacks on Aram33 as to make him look good and persons involved against Aram33.

I also suspect the following accounts, though not much yet have they done:

1. ar:user:النمر الاحمر
2. ar:user:النمر الأبيض
3. ar:user:الدب القطبي
4. ar:user:احمد بشارة
5. ar:user:Ahmad510
6. ar:user:Mahaodeh

Aram33 uses in my opinion ips mainly in Belgium (Skynet dynamic DSL). He has also used open proxies.

Aram33 is not the main issue here, it is this self-governed above-law gang, or just a group of friends. To many users and admins things are not clear, but persons currently with both checkuser and admin rights cannot be that ignorant - are they? I blame two specific persons in particular as they refused to answer my questions (the only two admins to have checkuser on ar wi). I suspect more cover-ups will be done if you ask certain admins. As the only known admin on both ar and en wiki I kindly ask you to ask user:Meno25 if you need any translation or confirmation. User:MKay and user:Tarawneh I think will also be two trustworthy persons to ask. The admins directly involved in my opinion are: user:Mido, user:Alnokta, and user:Chaos who resigned recently.

If my claims regarding the sockpuppets are largely true, please block the masterpuppet and its accounts yourselves as the Arabic admins involved seems to me to be complacent, or send a note to Bureaucrats ar:user:Oxydo and user:MKay.

One last point, the only way I think they may reply to my claims is by listing my previous mistakes and bans. Though I don't always agree with the way the dealt with me, I think it's unrelated to the already-complicated issue above. Thanks--Azdiyy 09:23, 11 April 2007 (UTC)

I can confirm that the check was performed. As of all the other - allegations of total cabalism aren't adding credibility to your other claims. MaxSem 15:23, 11 April 2007 (UTC)

Thanks for your help. I've no checkuser like you, just relying on patterns. I have good evidence to suggest the use of open or commercial ip-hiding software by the said admin (e.g. ar:user:202.175.95.171 [51]). I've also given many names which I think some of them at least should be in the same range. Shouldn't the message left by ar:user:Al-kirdawy on ar:user:Aram33 page be enough to desysop him by other admins? I know couples can email each other but two roommates using wiki talkpages to communicate is a bit funny? Would you please google some ips for proxy listing?
Below is the important bit of ar:user:Al-kirdawy's message on ar:user:Aram33 talk translated:
PS. They will check the ip to make sure that the writer of these words [i.e. Al-Kirdawy] is not Aram.
Many thanks--Azdiyy 16:41, 11 April 2007 (UTC)

That admin Aram33 has created sockpuppets cannot be denied. As for user:Mido, I owe him an apology as it seems to me now that he's still unaware of these delicate issues. I also think that user:Chaos has acted in good faith. This RFCU can be archived as communication is back between concerned parties – lack of which fuelled my suspicions. Many thanks. --Azdiyy 11:35, 16 April 2007 (UTC)

Catalan Wikipedia

Please check if the catalan wikipedist ca:User:Uriol is the same than the IP 88.6.192.134, which reverted most of the unlicended templates I put on the images loaded by Uriol. Thanks!--Iradigalesc 21:17, 14 April 2007 (UTC)

Not done, obvious cases should be treated as such. We generally don't disclose user's IPs. MaxSem 05:31, 15 April 2007 (UTC)

Norwegian Wikibooks

Please check how the users b:no:Bruker:FUCKER, b:no:Bruker:God Moffe, b:no:Bruker:Hitlerjugend, b:no:Bruker:Jonah Hexx, b:no:Bruker:El Papagayo and b:no:Bruker:Angus Young are operating. They are responsible for a series of very similar vandalism and defamation raids, every time being blocked and deleted/reverted and then returning a while later with a new user name and the same tactics. I would also be interested to know if the IPs are known open proxies or TOR nodes. -- SLB (no) 07:57, 16 April 2007 (UTC)

Done, no affirmative results. Jon Harald Søby 19:23, 17 April 2007 (UTC)

Ko Wiktionary

• Please check the following users wikt:ko:User:LERK, wikt:ko:User:Kahusi wikt:ko:User:Mithridates, wikt:ko:User:ToePeu, wikt:ko:User:Klutzy, wikt:ko:User:PuzzletChung, wikt:ko:User:Theoteryi, in relation to the ko Wikipedia and the ko Wikibooks.
• Which username has the following ID number:
  • #127 #146 #147 #148 #149 #150 #151 #153 #155 #167 #176 #179 #182 #189 #191, which have double accounts on the ko Wiktionary. --아흔(A-heun) 16:15, 19 April 2007 (UTC)

Please explain what exactly you'd like to know, and why it's important enough to warrant a check? MaxSem 16:19, 19 April 2007 (UTC)

I ask myself why some users create double accounts without contributing. The ID numbers above are quite recently created day after day. What I want to know is if the users above act in another username. --아흔(A-heun) 16:26, 19 April 2007 (UTC)

I think it should be confirmed if this request is based on community consensus. --Aphaia 16:52, 19 April 2007 (UTC)

Not done several of those names are stablished users across different wikis (Mithridadtes comes to my mind, he's a eswiki stablished user).

1. You've been blocking people without reason just to hunt sockpuppets, in the process you blocked good faith users. That's a no no. If a sockpuppet starts disrupting, then you block it (and autoblock will do the rest).
2. In order to request Checkuser, there MUST be a valid reason to do so, "hunting sockpuppets" for the sake of it it's not a valid reason. Why are you so concerned about it? drini ^[es:] _[commons:] 17:04, 19 April 2007 (UTC)
3. I ask myself why some users create double accounts without contributing. Satisfying your curiosity is not a reason enough to block or CU.

Further clarification. What I told you on kowikt, is that if you need to stop sockpuppets you may come here and ask for help. However, checking users for the sake of it is not a valid reason, either to perform sockpuppet, or to perform test blocks. So we're asking you to provide valid reasons on why those users should be checked drini ^[es:] _[commons:] 17:10, 19 April 2007 (UTC)

I'd like to mention the following:

1. There is no community consensus on the ko Wiktionary because there are no sufficent active users.
2. I don't know any "good faith users" on the ko Wiktionary, because there are no sufficent writing users.
3. I don't want to "satisfy my curiosity", but I want to know why users create several accounts lately without contributing.

• Please take a look at here, you might approve my points above, though that misery is a bit shameful for the ko folks. Anyway, I accept your decision. --아흔(A-heun) 19:20, 19 April 2007 (UTC)

Recent series of fake accounts, I think I understand your concerns and it makes a some point (cf Vandalism reports#KAGE) to some extent. For the third part however, you can just ask some of them on kowiki VP if they created those accounts. Much easier, you may ask CU for the obvious vandal account/IP address. As well some other WP, a page for accumlating vandal data may be helpful for further inquiries. --Aphaia 01:50, 20 April 2007 (UTC)

How about this: Bold means > 250 edits:

• Mithridates: en:User:Mithridates, es:User:Mithridates furthermore, he's a sysop on Ido wikipedia: io:User:Mithridates so, good user.

  ToePeu: ko:User:ToePeu, en:User:ToePeu, eo:User:ToePeu, good user.

  Klutzy: ko:User:Klutzy, en:User:Klutzy, once more, good user.

  PuzzletChung: sysop of korean wikipedia: ko:User:PuzzletChung, de:User:PuzzletChung, en:User:PuzzletChung, ja:User:PuzzletChung, ru:User:PuzzletChung, zh:User:PuzzletChung, also he's done good edits on korean wiktionary, not an idle account, and bureaucrat of korean wikiquote, so very good user.

  LERK: en:User:LERK, fr:User:LERK, ja:User:LERK, ko:User:LERK, en:wikt:User:LERK, ja:wikt:User:LERK, and a sysop on Commons: Commons:User:LERK, so another good user.

(and I'm not doing the others since I got tired)

Funny, that information was NOT found using checkuser or blocks, often, those are linked on the userpages either at kowikt or kowiki

My advice is to lower the nervousness levels, people like to get accounts and dont' use them for many reasons. One I can think of right now, is to prevent vandals usurping the names of stablished users, for instance I registered User:Drini in several wikis, so other people can't get the name, even if I don't use it. You may always ASK those guys if you have doubts. Talking is often the best way.

Bottom line: don't get worked up about unused accounts drini ^[es:] _[commons:] 02:28, 20 April 2007 (UTC)

I thought my request has been rejected! Wenn I have requested checkuser, I have had my reasons, and I've got what I wished.

I must say, all Wikprojects depend essentially upon contributing of writing users: Without writing user no Wikiproject! Unfortunately the ko folks often forget this golden principle. At all events, thanks for your efforts. --아흔(A-heun) 13:41, 20 April 2007 (UTC)

The checkuser reuest got denied. All that information was gathered WITHOUT checkuser. It's an example of how can you investigate in the future without checkuser or blocks. drini ^[es:] _[commons:] 14:27, 20 April 2007 (UTC)

I said, I've got what I wished, but not the infos above. --아흔(A-heun) 15:05, 20 April 2007 (UTC)

really funny! :( when admin blocks a user, then used ip is blocked automatically. and A-heun concluded the user was sockpuppet. wikt:ko:User:ToePeu have claimed that's wrong, but A-heun accused he has no contribution of wikt (wikt:ko:사용자토론:퇴프), which is out of point. anyway, I am not a sock puppet of wikt or wb. --Klutzy 02:33, 20 April 2007 (UTC)

User:Kjoonlee

Hi, I'm User:Kjoonlee at en.wp, ko.wp and ko.wikt. Please check ko:wikt:User:Kjoonlee with checkuser, against the user with ID #191. --Kjoonlee 20:17, 21 April 2007 (UTC)

Relevant links:

• :ko:wikt:Wiktionary:List of vandal IPs#Sock Puppets
• :ko:wikt:Wiktionary:Village pump#Questions from Kjoonlee

I am listed on a list of vandals as a sock puppet. I don't know who my sock puppet is, but I'm not him ;), and I have no idea what he did. Please prove my innocence. --Kjoonlee 20:24, 21 April 2007 (UTC)

Done I performed the Checkuser. The IPs of user ko:wikt:User:Kjoonlee does not match with any other user. --Dbl2010 21:25, 21 April 2007 (UTC)

Thank you. :) --Kjoonlee 21:38, 21 April 2007 (UTC)

Everything go well now. thank you all. --ToePeu 18:51, 23 April 2007 (UTC)

Meta

If it happened on Wikibooks I would CU the spate of "M7" accounts (three today) and take an "interest" in the underlying IP? --Herby ^{talk thyme} 14:11, 8 May 2007 (UTC)

Would anybody do that for me, also? Repeating against the IP that I blocked on simple.wiki might be of interest. --M/ 14:16, 8 May 2007 (UTC)

Done, found and permablocked two abusive addresses. MaxSem 14:39, 8 May 2007 (UTC)

Thanks, appreciated --Herby ^{talk thyme} 14:44, 8 May 2007 (UTC)

Cornish Wiktionary

On the Cornish Wiktionary we've been attacked by vandals and spambots recently. Can you check to see if the vandals listed at kw:wikt:Wiktionary:Vandalism in progress are all the same user?? If it is, I can block the relevant IP ranges to stop this vandalism. --WiganRunnerEu 22:25, 23 April 2007 (UTC)

I can confirm that the users are the same, and operated from the same IP address. However, they appear to operate from an Internet service provider that assigns dynamic IP addresses, so you would probably need to block the entire range. If the vandal persists, please report the new names here so I can confirm.

For archival purposes, the users in question are:

• WoW
• TheM62Manchester on wheels again!
• Thomasthetankengineisheretofreakuout
• DKEBNIS
• Namecomis
• Haley Brown is not hot!!

—{admin} Pathoschild 03:34:24, 25 April 2007 (UTC)

Simple English Wikipedia

I suspect that User:Depository is a sockpuppet of the well-known George Reeves Person. The grammatical tendencies are the same, the editor shows the same interest as GRP (Rocky Marciano, etc.) and the hatred of those who have blocked him in the past. An IP address that belonged to him was warning me that "Mkil killed ton of info on normal enyclopedia, now here as well, all the info on marciano page, which is generally known to be true, especially with references provided, so be careful with this individual's reverts." [52] For some background, GRP's last sock on the English Wikipedia, User:BoxingWear, got into a conflict with MKil over something on the article, and was blocked later on for being a sock of GRP, established by checkuser (Wikipedia:Requests for checkuser/Case/George Reeves Person). I suspect that GRP has followed MKil to the Simple English Wikipedia to troll him, just as he had done in the past. Thank you. PTO 02:23, 25 April 2007 (UTC)

Not done. Checkuser information is only kept for approximately a month, so there's nothing to compare to unless you can find a more recent confirmed sock puppet. —{admin} Pathoschild 03:16:58, 25 April 2007 (UTC)

There's quite a long list of IP addresses over at the now-deleted Wikipedia:Long term abuse/George Reeves Person. Would that be helpful? PTO 03:20, 25 April 2007 (UTC)

Yes. The checkuser results confirm that Depository edited from the same Illinois (United States) network. They also edited from IPs in Massachusetts (United States) and Turkey, which suggests the use of open or anonymising proxies. —{admin} Pathoschild 03:45:11, 25 April 2007 (UTC)

Greek Wikipedia

There is suspicion that el:User:Adol (contributions) is a sockpuppet of el:User:Adolapts. Reason for this is: account creation and first contribution of el:user:Adol in a VFD for "keep" (same vote as Adolapts) 16 minutes after Adolapts posted comment [53]. Another vote for a "delete" (account's 4th contib) same as Adolapts's[54] and also has another "keep" vote where Adolapts also voted "keep"([55]), however later casted a "keep" vote where Adolapts has voted "delete" ([56]). Has out of the blue made edit identical with Adolapts (removal of the same exact sentence) in an article where Adolapts has had an edit war with another user (this identical to this). Has edits in articles that Adolapts has created and added links in other articles to Adolapt's articles (other contribs are 2 small articles and some int. links in others). Has denied being a sockpuppet when aked straightforward if the account is one. General interests seem the same (Medieval history/archaeology). This is a quite clumsy sockpuppet, so other puppets coming from the same IP or any alternate puppeteer besides Adolapts would be great information. Thanks - Badseed 12:11, 3 May 2007 (UTC)

Confirmed. No other socks. MaxSem 12:59, 3 May 2007 (UTC)

ru.wikipedia

Please, check our checkusers (ru:User:Drbug, ru:User:Wulfson, ru:User:Wind, ru:User:Dmitry Gerasimov, ru:User:DaeX, ru:User:CodeMonk) for cases of abusive use of checkuser tool. We think here (see, f.e., ru:Википедия:Заявки_на_арбитраж/Неправомерная_блокировка_Edward_Chernenko - in Russian) that our checkusers use checkuser tool for logging all IP's that users use to edit Wikipedia without requests and valid motives to do it. --Jaroslavleff 05:38, 14 May 2007 (UTC)

Not done. Please contact a member of the Ombudsman commission, which is tasked with investigating possible abuse of checkuser access. —{admin} Pathoschild 04:07:15, 15 May 2007 (UTC)

zh.Wikipedia

Accounts requested to check：zh:user:Mypet and zh:User:Kairei.

Reason：zh:user:Mypet involved in vandalism (whole page blanking) in article talk page zh:Talk:白目 from 26 April and received 3 times block due to this. It came to our attention that while zh:user:Mypet received his third block on today (12 May 2007, 08:01 UTC), 20 minutes later zh:User:Kairei blanked the same page just like what zh:user:Mypet did, and this user actually did not have any editing activities since 27 December 2006. So it is suspected zh:User:Kairei is the sockpuppet of zh:user:Mypet and we would like to comfirm it. Thank you for your kind assistance.--Charlotte1125 09:29, 12 May 2007 (UTC)

They share an IP address, along with several other users. --Cspurrier 18:46, 13 May 2007 (UTC)

Thank you.--Charlotte1125 06:26, 14 May 2007 (UTC)

Russian Wikipedia

I request my account in ru.wp (ru:User:Edward Chernenko) to be checked for possible usage of sockpuppets. Account confirmation is here. I suspect that local checkusers have published false information about me. Edward Chernenko 13:09, 11 May 2007 (UTC)

I confirm that the user Edward Chernenko was edited from a single IP in the last 60 days and that the IP did not edit under any other aliases. Cary Bass ^demandez 13:32, 11 May 2007 (UTC)

Thank you. Edward Chernenko 13:55, 11 May 2007 (UTC)

I would like to add however, as addressed by the Russian users that this IP 83.166.112.29 is not the one found by Checkuser but appears to be you as well. This IP is also the IP someone used to log into IRC on Friday to point this checkuser request out to the stewards shortly after you edited here. This IP does, in fact, resolve to two other usernames as indicated by the local checkusers. Cary Bass ^demandez 13:18, 14 May 2007 (UTC)

A check on СибирчегНоНеНарушитель gave the following results:

(IPs anonymized for privacy reasons.)

IP #1

• СибирчегНоНеНарушитель
• А!!! Ктулху Зохаваит Фсех!
• Клапауций
• Zeratul
• Don't Call Me a Fairy
• Ball Lightning O'Damnation
• Берлог

IP #2

• IP #2 (anon)
• СибирчегНоНеНарушитель

IP #3

• СибирчегНоНеНарушитель
• Alex The Great
• Медиа

IP #4

• Медиа
• IP #4 (anon)
• СибирчегНоНеНарушитель

And 14 additional IPs from which only СибирчегНоНеНарушитель had edited. Jon Harald Søby 13:33, 14 May 2007 (UTC)

Thank you, Cary, thank you Jon, for the in-depth analysis that proved our (ru-checkusers') good faith! Dr Bug (Vladimir V. Medeyko) 17:37, 14 May 2007 (UTC)

Cornish Wiktionary

There was a flood of vandalism this morning from the following users:

• kw:wikt:User:Shumpycock
• kw:wikt:User:Da pikey called shanel
• kw:wikt:User:Baldthryce
• kw:wikt:User:Klaffour033030
• kw:wikt:User:Marcus Sparaigen
• kw:wikt:User:Dringziggs (this user left an obscene message on my user talkpage there, where I'm kw:wikt:User:SunStar Net.

I would like to know if this can be stopped, as there has been a repeated pattern of vandalism repeatedly. Can you block the underlying IP over there as well for me?? --WiganRunnerEu1 11:08, 11 May 2007 (UTC)

Nuked a couple of IPs, and a dozen of sockpuppets accounts created on them (some of them were still dormant). drini ^[es:] _[commons:] 14:57, 11 May 2007 (UTC)

En Wikiquote part 2

note to checkusers: contact Pathoschild for archived data.

Willy on Wheels or its follower attacked ENWQ recently and we changed the move setting from [user] to [autoconfirmed]. It might be dormant accounts, so I request for checkuser to detect those possible vandal accounts. Would you please to perform CU on q:user:Auburn Pilot, q:user:Jesus the Tank Engine and q:User:Pene Naranjo, and let us know accounts created from the same IP addresses, if appropriate? (Hmmm, we need a local page for "long-term vandals"?) --Aphaia 17:02, 10 May 2007 (UTC)

The user operates from a pool of dynamic IP addresses assigned to Virgin Media, with each account on a different address. There is no way to block the user without the possibility of significant collateral damage, given the wide ranges involved. —{admin} Pathoschild 04:01:00, 11 May 2007 (UTC)

Thank you for your information. --Aphaia 06:42, 11 May 2007 (UTC)

En Wikiquote

note to checkusers: contact Pathoschild for archived data.

There has just been a recent vandal attack there (the user appears to be a punctuation mark [57]). Reading the Admin board there [58] it looks like this has happened before. I'd like to see CU run to see if there is any connection and (if appropriate) the IP blocked for a period. Thanks --Herby ^{talk thyme} 13:23, 10 May 2007 (UTC)

Thanks. From me too I request for checkuser on the requested account as well a series of Wazz accounts, q:User:SA1 to q:User:SA11, and q:User:Mrs. Herntaq. As for discussion, q:WQ:AN#Question Regarding Use of Wikiquote for School Projects might be more relevant for this vandal whom we called "Wazz". For your information, the account Vagish is confirmed by en:user:Vagish as his or her own, so it was just coincidence. --Aphaia 16:53, 10 May 2007 (UTC)

Vagish was not related, but the following users are: group A{%DB%9D (encoded), Gartermac, Mrs. Herntaq, SA1, SA2, SA3, SA4, SA5, WQAS1, WQAS2, WQAS3, WQAS4), group B{SA6, SA7, SA8, SA9, SA10, SA11, WQAA1, WQAA2). Versioning and whois indicates that the users most likely operated from a computer lab behind a dynamic proxy assigned to Carbon Lehigh Intermediate school Unit 21 (209.18.48.0/20). group A edited from various IP addresses assigned to the school, while group B seems to have used a web proxy installed on ptrhosting.com (72.232.50.146). Versioning indicates a probability that multiple persons were involved, probably students in a computer lab. —{admin} Pathoschild 03:39:27, 11 May 2007 (UTC)

Thank you for your information. --Aphaia 06:42, 11 May 2007 (UTC)

Wikispecies

There was a flood of vandalism on Wikispecies last days from following users:

1. Wikispecies:Special:Contributions/Jimbo_Prince_of_Wales {6 May 2007}
2. Wikispecies:Special:Contributions/J._Donal_Wales
3. Wikispecies:Special:Contributions/Jimmy_Donal_Wales
4. Wikispecies:Special:Contributions/Jimbo_Donal_The_Prince_of_Wales (11 May 2007)
5. Wikispecies:Special:Contributions/Open2universe_on_Wheels (13 May 2007}

Could you have a look into this please? Lycaon 07:15, 14 May 2007 (UTC)

Sure I'm on it. drini ^[es:] _[commons:] 17:37, 14 May 2007 (UTC)

Great!! Thanks. Lycaon 17:44, 14 May 2007 (UTC)

Simple English Wikipedia

There was a case of trolling. I would like to confirm that Rolis1, Naachess and Dandr53 are really sockpuppets. The one I'm doubtful of is Rolis1. Thanks.--Tdxiang 03:52, 15 May 2007 (UTC)

Done. There's no conclusive evidence. All three edited from the same public library, Naachess and Dandr53 from the same computer or two computers with identical software versions. —{admin} Pathoschild 04:00:21, 15 May 2007 (UTC)

Meta

note to checkusers: contact Pathoschild for archived data.

Can I request that the following accounts are checked User:Jimbo Donal Wales wearing briefs stinking of mud!, User:I want to rape anyone who uses Verizon!!, User:I want to rape Prince William!, User:Fair use should be allowed on Wikimedia! and User:Shanel Kalicharan*!. To me there looks to be a possible connection (& with user names on other wikis - I'd be curious enough to look in the log). If anyone does delve in I'd like User:Hatchcombe checked given their only edit was to vandalise my page & I seem to be attracting rather a lot of this recently! Cheers --Herby ^{talk thyme} 08:44, 15 May 2007 (UTC)

Why do you need a checkuser performed? These accounts are all blatantly in bad faith and can be blocked without further data. —{admin} Pathoschild 03:56:22, 18 May 2007 (UTC)

They are all blocked. My view on Wikibooks would be that I would be interested in the underlying IP address in both the context of Wikibooks and other wikis. If the IP carried a history, there or elsewhere then I would place a block on it. I see no reason to view the prevention of vandalism and vandal accounts differently here --Herby ^{talk thyme} 06:57, 18 May 2007 (UTC)

Done. I can confirm that they are probably related, but the selection is too narrow for any useful results. Group A{Jimbo Donal Wales wearing briefs stinking of mud!, Hatchcombe} uses an IP address assigned to Hurricane Electric, while group B{I want to rape anyone who uses Verizon!!, I want to rape Prince William!, Fair use should be allowed on Wikimedia!, Shanel Kalicharan*!} uses one assigned to Everyones Internet. Both are Internet service providers with large IP address pools; unless you can find other accounts over a longer period (at least several days or weeks), I can't confirm whether the IP addresses are stable or already reassigned to a new user. —{admin} Pathoschild 00:38:10, 19 May 2007 (UTC)

En Wikiquote

Another "on wheels" attack here (there has been a spate recently) "Contribution"! and I would ask that this user's IP is checked. Again it looks like it could be part of a pattern - thanks --Herby ^{talk thyme} 10:12, 15 May 2007 (UTC)

And maybe compare it to my log entry on Books from today (a French WoW!)? --Herby ^{talk thyme} 11:08, 15 May 2007 (UTC)

Please block the vandalizing IP, no need to state it here. Cbrown1023 talk 14:27, 15 May 2007 (UTC)

Errr - hate to ask but will anyone take a look at these two please --Herby ^{talk thyme} 15:55, 17 May 2007 (UTC)

My computer broke for a couple of days, I'll look into it now. drini ^[es:] _[commons:] 16:31, 17 May 2007 (UTC)

Done drini ^[es:] _[commons:] 16:35, 17 May 2007 (UTC)

Appreciated (& confirms with WB, thanks). Any chance on the one above too? Cheers --Herby ^{talk thyme} 16:55, 17 May 2007 (UTC)

meta has local chekusers, doesn't it? drini ^[es:] _[commons:] 14:27, 18 May 2007 (UTC)

Agreed but apparently not about for a couple of days --Herby ^{talk thyme} 14:53, 18 May 2007 (UTC)

Meta is somehow well watched. Should more of these come, they would be blocked really soon. So, there's no emergency (in my view) to hunt the ip drini ^[es:] _[commons:] 14:58, 18 May 2007 (UTC)

Fair comment Drini and I'll sit back - I just have rather a severe aversion to vandals & vandal accounts! Thanks for responding --Herby ^{talk thyme} 15:03, 18 May 2007 (UTC)

IIRC, meta has not local chekusers; stewards can be assumed to serve this function, though. And all meta users I expect hate redundant bureaucracy.--Aphaia 05:06, 19 May 2007 (UTC)

Fa Wikipedia

گردآفرید and کیخسرو

I am an administrator on Farsi Wikipedia. Recently, fa:User:گردآفرید was blocked because of serious violation of policies. Later on, another newly created account, fa:User:کیخسرو started its activities, and has recently contributed on a Request for CheckUser Permission page on our wiki. As using an account for bypassing a block is against Wikipedia policies, and regarding the similarity of the tone of speech of these two accounts and their areas of interest, I would like to request checking these two accounts against each other, and if feasible, againast other currently active accounts in our Wiki. Thanks in advance Huji 15:45, 18 May 2007 (UTC)

I can confirm that both users have identical user agent strings and have the same proxy server IP, as well as real IPs in the same range. There is also a third user, شیرین, who has the same user agent string, proxy server, and real IPs in the same range.

There are a few other users as as well who match this pattern, except they have different user agent strings: Lancer, Zignor, Anahid, Saeed-shokoohhe, and Karim111.

All the accounts mentioned above have real IPs in the same range, which trace to Florida, but the proxy server IP is in Iran. I do not have the technical knowledge to say for sure, but it seems like they are using an open proxy (or open proxies).

There were a few older accounts with no XFF header or user agent string information using this proxy server, so I cannot conclude anything about them.--Shanel 18:55, 18 May 2007 (UTC)

Thank you. I will ask Pathoschild for futhur help about the proxies. Huji 19:00, 18 May 2007 (UTC)

Scratched out the above; they're just the squid servers. :P. But I still think they are using an open proxy anyway.--Shanel 19:12, 18 May 2007 (UTC)

Fbyk

By Huji's request on IRC, I've checked a number of accounts for sock puppetry. I confirm that Fbyk, ‏ظهیری‎, and the bot Elessar are either either the same person, or editing from the same computer, or editing from an identical computer (for example, in a school). Senemmar edits from the same Internet service provider, but versioning shows different computers (so they're probably not the same). Behdood edits from a different Internet service provider in the same country, and a different computer (so they're probably not the same). Shiran's account is too old, and the data is no longer available.

Keep in mind that coincidences are possible, and that they might be different people. Checkuser should only be used with other evidence, such as similar behaviour or conflicts of interest. —{admin} Pathoschild 16:21:25, 27 May 2007 (UTC)

I fixed a typo in the above statemnt (Elessar's username was written as Ellesar). For future records, Elessar is known to be one of the active bots on FaWP, run by ظهیری for a long time. We don't have a record of it being used for sockpuppetry or similar uses. Although my basic judgement was that Fbyk is not a sockpuppet or meatpuppet as well, we are discussing this case on our Administrators Notice Board. My thanks goes to Pathoschild for his assistance in this case. Huji 17:56, 27 May 2007 (UTC)

For confirmation, I checked if it was true that Fbyk edited from a different city today - I can confirm this, hopefully closing the case. Datrio 11:46, 29 May 2007 (UTC)

Cross check Commons / sk:wiki / en:wiki

A check user information is needed on the user commons:User:Upravenec Koukal, in comparision with:

• sk:User:V. Z. (last edit: May 21st)
• en:User:Zacheus (last edit: May 21st)
• User:Zacheus - meta, one more, just now
• sk:User:Semenáč (last edit May 18th)

(both sk:User:V. Z. and en:User:Zacheus are accounts of <personal data removed> here on Meta and <personal data removed> (redirected there to cs:User:Z)]; the User:Semenáč could be somebody else).

• commons:User:Upravenec Koukal registered and uploaded on May 15th 2007 the image Image:Upravenec Koukal.jpg
• he published the image on his user page
• the name Koukal or Jan Koukal is the name of myself, I wanted to keep it secret on wikipedia
• <personal data removed> published my name publicly (here, on cs.wiki, internet), also he published the place where I live, he also claimed I was a collaborateur of the communsit secret police – he was arbitrated for this on cs.wikipedia <personal data removed>
• although he knew that it can even be dangerous to my family and is not true, he announced on sk.wikipedia here that he will publish my photo
• the cs:User:Semenáč or sk:User:Semenáč, merely blocked for trolling and making nacist propaganda, attacked several times the article sk:Anna Halmanová and cs:Anna Halman, see also en:Anna Halman; after I have reverted today a strongly vulgar edit (giving this victim the category prostitute), the en:User:Zacheus attacked me for this on my user page en:User talk:-jkb-

I will request for an arbitration against this user on en.wiki (he has been banned already on cs.wiki, blocked recently on sk.wiki with some new warnings, he has been warned on en.wiki etc.). I am not sure if it will be possible to compare the users as I requested above (he has some more dozens of sockpuppets on cs.wiki and probably some more IP’s), but a positive check wopuld help the arbitration. Thank you for your work. -jkb- 14:39, 21 May 2007 (UTC)

here is the end of my request, -jkb- 12:27, 25 May 2007 (UTC)

---

This is another case of -jkb-'s wikistalking. He knows very well that Semenáč and me are two different persons. I ask to ban him for his harassement. That's why I removed my personal data.

I agree to check me. I hope this will finally prevent him to both stalk & harass me. —Zacheus ^{Talk • Contributions • Edit counter} 06:58, 23 May 2007 (UTC)

• http://meta.wikimedia.org/wiki/Checkuser_policy#Use_of_the_tool :

It is allowed to check an editor's IPs upon his specific request, when this user wants to publicly prove his innocence. Note that the tool may provide some partial evidence for him, while it does not prove his innocence by itself.

just so people don't forget that CU is not a foolproof way of showing innocence drini ^[es:] _[commons:] 17:00, 24 May 2007 (UTC)

I fully understand this. But I hope that negative results persuade -jkb- about my innocence and that he finally stops harassing me when no sysop takes care about his harassment of me by blocking and banning him. —Zacheus ^{Talk • Contributions • Edit counter} 09:34, 25 May 2007 (UTC)

Zacheus and -jkb-: STOP TO HARASS EACH OTHER! Zachaeus is angry because he is ban at Czech Wikipedia (-jkb- was for his ban) and checkusers of Czech Wikipedia alos found some of his sockpuppets there. -jkb- harass Zacheus because Zacheus and other users find out that -jkb- vandalized article upravenec because he is by himself en:reconcilee. -jkb- also lies about article about Anna Halman, (see his fake edit summaries like that one: [59]) an he lies that he wants to keep it secret on wikipedia. (see [60], [61] where he wanted to protect photo of him at commons).

Ross Hedvicek, another Czech Wikipedian, presents this picture here: http://dvoranaslavy.blogspot.com/2007/04/upravenec-jan-koukal.html (nobody proves that it is really -jkb-), so tell me, why to check Zacheus?

Commons, sk.wiki, meta and cs.wiki are separate projects and all has own checkusers and check that accounts would be brech of privacy. --Greta Swart 11:10, 25 May 2007 (UTC)

Greta Swart seems to be one-purpose account. --Wikimol 12:49, 25 May 2007 (UTC)

Results

• Done Upravenec Koukal did not match either Zacheus or V. Z. both having fairly static ips (unchanged for long time), so I'm quite positive Upravenec is a diffent user. However Upravenec Koukal = Semenáč . Now kids, go back to the playground and be nice to each other. drini ^[es:] _[commons:] 14:28, 25 May 2007 (UTC)

á Drini, grácias por tú interessantes resultados... However, now I will have to see to get two different proceedings. I hope this page will not be deleted as I will need it in one case at least. Muchas grácias una más, -jkb- 14:39, 25 May 2007 (UTC)

Use this link if you need it, since this will be archived soon. drini ^[es:] _[commons:] 14:40, 25 May 2007 (UTC)

Follow-up

This kind of vandalism seems to fit the pattern of the "vandal with a grudge" who had been operating on English Wikipedia; I thought he stopped after I made a complaint to his Internet provider. (The IP ranges used by the vandal are listed in the linked page.) Can my suspicion be proven or disproven? - Mike Rosoft 21:17, 26 May 2007 (UTC)

itwiki

Tooby requested on IRC that I check if the account AWIE@itwiki had been highjacked, and if Ruanda@itwiki was involved. He pointed out that AWIE had suddenly 'gone crazy' on the Italian Wikipedia and Wikinews, had insulted Ruanda, and that both users had similar editing patterns and behaviour.

Both users operate from the same Internet service provider, "Fastweb" in Italy. (That ISP is blacklisted for spam, by the way.) Versioning shows AWIE has not changed the computer he edits from (unless he changed to an identical computer), and that Ruanda operates from two computers with different versions of Windows (which is probably a home computer and one at work or school). Aside from the ISP, there's no apparent relation between the two users; it's possible one highjacked the other, but there's no indication of this. —{admin} Pathoschild 20:22:56, 30 May 2007 (UTC)

Meta

Check on User:Kazoo the Wikimonster please - cross wiki vandal using bottle graphic. A similarly named user vandalised Wikiquote in the past 12 hours too --Herby ^{talk thyme} 07:30, 30 May 2007 (UTC)

Done Did not see you on IRC, so sent results of meta check run to you via email for further analysis. Please advise if there are more things to check for. ++Lar: t/c 00:01, 31 May 2007 (UTC)

Bahasa Melayu Wikipedia

We have a recurring bad name user on MS Wikipedia. Would appreciate if someone can id the IP for following user. Suspect it came from same IP.:-

• ms:Pengguna:Anwar cannot become our PM because he is a faggot
• ms:Selamat pagi, saya gay
• ms:Pengguna:Yosri benci Orang Yahudi!!!!
• ms:Pengguna:Yosri hates Jews!!!!
• ms:Pengguna:Tetek
• ms:Pengguna:The bitches (May be different user.) Yosri 07:32, 30 May 2007 (UTC)

Those users are actively sockpuppeting, block on sight. There are a 2 or 3 different ips being used. drini ^[es:] _[commons:] 14:15, 30 May 2007 (UTC)

Please block the underlying IP address if it is not from Malaysia. Yosri 01:25, 31 May 2007 (UTC)

Done-- by drini _[commons:] . Thanks. Yosri 09:45, 31 May 2007 (UTC)

Igbo Wikipedia

We have a recurring pagemove vandal on the Igbo Wikipedia. (See Angela's and my entries in the block log for all his socks.) He has moved ig:Imo State five times now. Please block the underlying IP address of ig:user:Niameychan/ ig:user:Ship's gone crazy, man. Picaroon (Talk) 21:43, 21 May 2007 (UTC)

Done--Shanel 22:25, 21 May 2007 (UTC)

Korean Wikipedia

There are suspicious accounts that is regarded as a blocked user's sock puppets in Korean Wikipedia. Please check the underlying IP addresses of them.

• ko:사용자:에멜무지로 (the blocked user)
  • ko:사용자:삶, ko:사용자:뷁 (the suspicious accounts)

--Yes0song 02:47, 28 May 2007 (UTC)

Done The suspicious accounts are from the same IP, whereas the blocked user was on the same IP a few days before. drini ^[es:] _[commons:] 07:38, 28 May 2007 (UTC)

Tom Thrampit on Meta

I'd like User:TomThrampit checked. Spammer creating bot style pages (UK based) which is not unusual in its way however there is an ip that has been trying to convince me to unblock them on other wikis who's repertoire includes spam bot pages (UK based) - as such I believe the check is relevant. Thanks --Herby ^{talk thyme} 17:30, 21 June 2007 (UTC)

Maybe compare with my log entry on Books, 12 pages there --Herby ^{talk thyme} 17:42, 21 June 2007 (UTC)

Done::I have checked (and mailed you my findings) on meta ++Lar: t/c 20:47, 21 June 2007 (UTC)

Chinese Wikipedia

69.241.165.106 on zh:wikipedia

I am being stalked across language projects, again, this time by this IP. This user's been harassing me through spamming my inbox to the extent that Raul654's request to block e-mails was enacted due to renewed support from myself and others being affected. I know that this is him because of the message headers I've received in harassing e-mails after he discovered my e-mail address, as well as through a checkuser.—Ryūlóng (竜龍) 05:10, 15 June 2007 (UTC)

To clarify, I want to be sure that he is not creating a new sockfarm on zh, as he has at en.—Ryūlóng (竜龍) 05:11, 15 June 2007 (UTC)

Done. No users are editing from this IP, and the only edit by the IP was to Ryulong's userpage.--Shanel 05:15, 15 June 2007 (UTC)

Nuee on zh:Wikipedia

Please help me to check zh:User:Koi, zh:User:Nuee, 210.200.105.217, 203.79.252.195, 203.79.252.193, to clarify the owner is zh:User:Nuee or not because they caused edit war at articles about Vietnam with sockpuppets of zh:User:影武者.

And also check owner of zh:User:Ruralkeeps, zh:User:GY King, zh:User:Benjamin Lin, zh:User:Samson Lin is zh:User:影武者 or not, because their editing habit is similar, thanks.

More information, please see zh:WP:VIP. BrockF5 16:06, 31 May 2007 (UTC)

Done. see zh:Wikipedia:互助客栈/方针#CheckUser--Shizhao 06:25, 6 June 2007 (UTC)

Karlapatriziaharman1001@meta

Looking at the delete/block log this type of bot activity continued after I'd gone off wiki. I see autoblocks kicked in so presumably they moved IP each time. Now I see spam as being evil & a form of vandalism so I guess I would like to see the IPs marked at least so if they try again the picture builds. If folks don't agree then so be it (one of those days!).

• Karlapatriziaharman1001 (talk • contribs • logs • block user • block log • checkuser)
• Todber guissanod (talk • contribs • logs • block user • block log • checkuser)
• Datriodarius (talk • contribs • logs • block user • block log • checkuser)
• Cornstone 3000 (talk • contribs • logs • block user • block log • checkuser)
• Finneytim (talk • contribs • logs • block user • block log • checkuser)

Seem to be the ones involved - cheers --Herby ^{talk thyme} 09:45, 22 June 2007 (UTC)

Nest of spambots but not all necessarily related, found another one too Bekram vikre (talk • contribs • logs • block user • block log • checkuser) which I also blocked. Sent results offline. More in a bit. ++Lar: t/c 17:53, 22 June 2007 (UTC)

Done All the users are blocked already. Near as I can tell it's with account creation prevented) for most or all of them... this should be sorted. The IPs themselves are not directly blocked that I could see... The log suggests to me that Pathoschild also looked into this but didn't perhaps have a chance to update results. ++Lar: t/c 18:21, 22 June 2007 (UTC)

I asked him to checkuser them. The results are on his talk page.--Shanel 18:34, 22 June 2007 (UTC)

you mean user_talk:Pathoschild ... Way to subvert process there! Asking him directly instead of filling out form 897uw-J in triplicate! :) As if. Well that would explain why he didn't update here, probably didn't spot it. As for his suggestion not to block the IPs, just the users as they pop up, on reflection I concur. Not sure I see the need for further checkusering, just block on sight. ++Lar: t/c 18:39, 22 June 2007 (UTC)

Started a discussion on the topic of IP blocks here --Herby ^{talk thyme} 19:19, 22 June 2007 (UTC)

Ichhabevielesocken@meta

• User:Ichhabevielesocken (talk • contribs • count • logs • page moves • block log • email)
• User:Ichhabevielesocken2 (talk • contribs • count • logs • page moves • block log • email)
• User:Ichhabevielesocken3 (talk • contribs • count • logs • page moves • block log • email)
• User:Ichhabevielesocken4 (talk • contribs • count • logs • page moves • block log • email)
• User:Ichhabevielesocken5 (talk • contribs • count • logs • page moves • block log • email)
• User:Ichhabevielesocken6 (talk • contribs • count • logs • page moves • block log • email)
• User:69.241.165.106 (talk • contribs • count • logs • page moves • block log • email)

This is the same user as listed below at #Chinese Wikipedia. I want to make sure that this is the IP he abused here at Meta as he did at w:zh and w:en.—Ryūlóng (竜龍) 06:25, 21 June 2007 (UTC)

DoneCheckuser is not for fishing. What specifically were you asking Ryulong? Whether this user and that IP go together? Please in future try to clearly ask a specific question. However my curiousity was piqued so... Ran some checks and it's all a bit twisted. Ichabevielesocken 1-6 are not directly related to 69.241.165.106. They all come from the same IP (which is different than 69.241...) and all are blocked and all appear to have no contribs remaining. However there is a connection to that IP in that two users KensingtonBlonde (talk • contribs • count • logs • page moves • block log • email) and KensingtonBlond (talk • contribs • count • logs • page moves • block log • email) are intertwined with that IP and the one for the "I have many german socks" IDs 1-6... note also [62] where blondE is complaining about checkuser policy and the blockage of 69.241... on en. Blond (no e) has no edits other than to establish user and talk pages. Something fishy is going on here... I'd block the 69.241... IP here as well (it is already, I beleive, blocked on wp:en), were I you. I have the results saved away so I can refer to them later or if other checkusers want to check my conclusions. ++Lar: t/c 21:14, 21 June 2007 (UTC)

note: see also Commons:Commons:Requests_for_checkuser/Case/Ichträgtkeineschuhe ++Lar: t/c 22:26, 21 June 2007 (UTC)

I think I know the proper IP this time. The other one is old, I think.—Ryūlóng (竜龍) 23:55, 21 June 2007 (UTC)

Yes, you do. ++Lar: t/c 00:58, 22 June 2007 (UTC)

The_Fourth_Horseman@meta

I'd appreciate it if someone would CU User:The Fourth Horseman. Given the contribution it would seem to be a cross wiki vandal with a known pattern. A check would help control attacks on this and other wikis. Thanks --Herby ^{talk thyme} 08:40, 6 June 2007 (UTC)

Done Likely that this user is related to the Kazoo series. Contact me directly if you need more details. ++Lar: t/c 10:58, 7 June 2007 (UTC)

Thanks, sorted and folk advised, quite a history there --Herby ^{talk thyme} 11:31, 7 June 2007 (UTC)

Cross-wiki (w:es & commons)

• es:Usuario:Tokoblue
• es:Usuario:Ultra JG
• commons:User:Jinta15
• commons:User:EMCi

In assisting with dealing with vandalism across projects, I noticed that EMCi had uploaded a fair use image (since deleted) that Tokoblue had populated at es.wikipedia. Similarly, Ultra JG (who has been causing issues with uploading images at en.wikipedia that I have dealt with) placed images uploaed by Jinta15 at the commons onto es.wikipedia pages. This violates policies at both the Commons and at the Spanish Wikipedia (derivative works), and this may require blocks on accounts across projects.—Ryūlóng (竜龍) 07:48, 16 June 2007 (UTC)

I can perform checks on Commons, (note that there is a process for requesting checks there (COM:RFCU)) and I will be happy to share the info I find with whoever is a CU on es. But it may be most effective to have a steward do this one. Not sure. I will carry out and save the checks on commons though, and es CUs can contact me. ++Lar: t/c 14:45, 16 June 2007 (UTC)

So, is any steward doing this crosswiki, or should I do it? drini ^[es:] _[commons:] 12:49, 20 June 2007 (UTC)

Drini, I think you should do es at least, unless you heard differently already. Contact me offline if you want my findings on commons instead of running them for yourself. ++Lar: t/c 20:48, 21 June 2007 (UTC)

Done:

User	ISP	Country (approximate)	Software profile
Tokoblue@eswiki	VTR Banda Ancha SA	Chile	Unique.
Ultra JG@eswiki	Terra Networks SA	Chile	Matches Jinta15.
Jinta15@commonswiki	Terra Networks SA	Chile	Matches Ultra JG.
EMCi@commonswiki	Indecopi	Peru	Unique.

The checkuser results are ambiguous. The similarities may be entirely circumstantial, or they may be good-faith users— perhaps friends who decided to contribute together, but were not aware of the fair use policies. I suggest assuming good faith and politely discussing the matter with the users, unless other evidence shows bad faith. —{admin} Pathoschild 00:41:08, 22 June 2007 (UTC)

Cross Wiki (Meta and yi)

There has been a vote on meta about yi sysopelection. I see the vote on Requests for permissions/Yiddish Wikipedia as not a vote, but at least it is a poll. People have heavy suspicions that there is sockpuppetry here. I support those feelings, based on my experience earlier in yiwiki (see [63], and hereby request a checkuser for the voters against, which are suspected to be sockpuppets (at least partially) from Yidel, user:יודל. I further request a full checkuser of all voters, as I have severe worries. Very likely more relevant information to identify sockpuppets can be obtained from the corresponding accounts (as far as existing) on yiwiki. Please see if better information can be found that way. Also note the votes on [64]. I would also want to request CU here for, for the votes after the header רוני פאר סיסאפ. This is with the same reasons as stated above. Please see whether people voted twice, which is considered illegal. Please block accounts that have voted twice on meta, as well (on meta), and copy a report if there is any on the voting page of the yiddish Wikipedia. Thanks a lot in advance. I realize that it must be a hell of a job. I will not perform the CU myself, as I consider myself too much involved. Effeietsanders 21:22, 13 June 2007 (UTC)

also i would like to check for open proxy's if involved thanks--יודל 13:09, 14 June 2007 (UTC)

I am requesting to be contacted by email or IRC before you make public the results --Jeo100 14:05, 14 June 2007 (UTC)

No. This isnt normal procedure if u voted twice u know already don't play games here.--יודל 21:15, 14 June 2007 (UTC)

I think we may not uphold that election. It was not advertised on yi, and several users who had never edited yi: voted. So it's not a "yiddish community" consensus. drini ^[es:] _[commons:] 21:16, 14 June 2007 (UTC)

Nod, I think all agree on that. I think this can only be seen as a straw poll. But none the less this would be abuse of sockpuppets if you "vote' twice. Hence my request. I realize I must sound a bit cryptic, but to me this is all partly just as confusing as for you guys. I have announced a new vote on yiwiki btw to make sure the community vote is clear, fair etc. Effeietsanders 21:39, 14 June 2007 (UTC)

I can perform that check here (but not on yi), but not at this very second, about to get on an airplane. If it still needs doing when I get a chance I will. Effeitesanders, please, mail me with more info if there is any info that should not be made public... thanks! ++Lar: t/c 23:23, 14 June 2007 (UTC)

There's no point on doing it now, isn't it? Let's wait for the real thing. drini ^[es:] _[commons:] 23:24, 14 June 2007 (UTC)

What do you mean "let's wait for the real thing"?? Thanks. Perhaps we should discuss further on the checkuser mailing list? ++Lar: t/c 03:52, 15 June 2007 (UTC)

I mean the new elections, done properly within yi:, with a clear set of rules. It's a bad precedent to allow people to come at meta, setup votes here, where people from other projects vote, where we have problems verifying accoutns belonging or duplicated from the local project, and after it, gain adminship here and get local sysophood, specially on wikis with a live community. drini ^[es:] _[commons:] 10:32, 18 June 2007 (UTC)

Cross-wiki (en and sk)

On en-wiki, user -jkb- has filed an arbitration request against en:User:Zacheus alleging, among other things, that on the Slovak wikipedia, this user, whose account there is sv:User:V. Z., threatened to expose his real life identity. I would like to confirm whether en user Zacheus is the same editor as sk user V. Z. There does not seem to be much dispute about this, but it is possible that someone else is trying to discredit V. Z. or attack jkb from a false flag. (This is the continuation of a long-running dispute involving other accusations of imposter accounts and so forth.) Thanks. Thatcher131 13:18, 13 June 2007 (UTC)

Confirmed, identical beyond all doubts. MaxSem 13:32, 13 June 2007 (UTC)

We had already checked those users in the past. drini ^[es:] _[commons:] 12:35, 14 June 2007 (UTC)

Flannigan_Hittagan @ enwikiquote

I'd appreciate it if someone would check this user. I've not seen this particular variation of vandalism before but it is reminiscent of some "Mumfum" vandalism that was on Wikibooks last year. Thanks --Herby ^{talk thyme} 07:11, 20 June 2007 (UTC)

Done. There are no other accounts registered from the IP address range they edited from. You have not provided enough information for any other type of check. —{admin} Pathoschild 00:36:24, 23 June 2007 (UTC)

Thanks, links with a previous one on Wikibooks from last year (Mumfum)and has some blacklist entries too - I'll advise the community --Herby ^{talk thyme} 07:06, 23 June 2007 (UTC)

Kazoo @ enwikiquote

Given the similarities to the user below on the Meta request can I ask for a check on this user on Wikiquote. This seems unlikely to be a coincidence - thanks --Herby ^{talk thyme} 09:54, 30 May 2007 (UTC)

Also please those: user 2 and user 3, if appropriate. Those user names follow a same convention. --Aphaia 14:46, 30 May 2007 (UTC)

• Still outstanding, thanks --Herby ^{talk thyme} 13:56, 31 May 2007 (UTC)

Done completely unrelated IPs, both open proxies, blocked. drini ^[es:] _[commons:] 22:20, 9 June 2007 (UTC)

Poetlister @ enwikiquote

Please run a check on admin Poetlister, per the recent Wikipedia developments. Cbrown1023 talk 23:51, 30 May 2007 (UTC)

Since there is no urgent need, I expect, so would you stewards please wait for us to build the consensus? The user in concern has a good history on that project, and it is not clear the consensus says this CU is necessary, as far as I understand. while I personally don't oppose to perform in certain circumstances. There are another opinion on the community, like waiting for the opposite side opinion. Thank you for your consideration, --Aphaia 00:15, 31 May 2007 (UTC)

Aphaia, hopefully, if it is the Poetlister we all know and love, it will smash the accusations I have set against her (and were on the other wikis). If not, then we can just block the socks. Cbrown1023 talk 00:20, 31 May 2007 (UTC)

Point taken, but technically there is no urgent need supposedly. Do you think however it is better to submit this request in more stable and communal basis just after one day? The data taken from check will be not so drastircally different, hopefully. --Aphaia 00:23, 31 May 2007 (UTC)

Points taken, but since when does a CU request require community consensus? Please get on IRC so I can discuss this with you in real-time (and many other things). Cbrown1023 talk 00:24, 31 May 2007 (UTC)

A steward has already confirmed the connection between the Wikiquote and Wikipedia identities, since it was used as even more corroborating evidence for the connection on Wikipedia. As the CheckUser looking at this on Wikipedia, I can talk to Wikiquote admins or any stewards doing further checks about the technical details, if desired. Of course, it is still up to the Wikiquote community to decide what to do with this information. Dmcdevit 00:30, 31 May 2007 (UTC)

Thanks for your offer, Dmcdevit, there are some concerns as long as I'm aware of: 1. If there is another account owned by Poetlister on English Wikiquote. 2. Since Cbrown1023 raised another issue the possible participation of Poetlister (enwq) to Wikimedia Review, this accusation without published proof is also in dispute (or seems so). I am not sure CU (who concerns our wikis and only) have this information, or do you have this kind of information too? 3. Who will hear that information offered from you: Although I put my trust on you, Dmsdevit, I'm hesitant to say for now "so please let me know". I have no good reason to ask you for information on the behalf of the community without consensus, I am only one of its 18 admins. As bureaucrat, I could boast to be trusted, but imo b'crats aren't voted for that purpose (as stewards aren't elected to rule the global arbcom). So still, I'd like you to wait for a while, and give us a time to deal it in order and on consensus. --Aphaia 00:49, 31 May 2007 (UTC)

I understand if Wikiquote has no Arbitration Committee or any other clear place for me to contact, but I'm always wary of discussing technical details of saying publicly how we decided that there was sockpuppetry, both because we don't want to help anyone else evade detection, and because we don't want to reveal personal information. If a CheckUser is run, though, the steward can find me on IRC since it was a complex check. In any case, the point about WR, an attack site that has been used for the purpose of outing the identities of individuals before, has never been in question on Wikipedia, and the user has confirmed it in their own words. For this reason it is not a good idea for her to have access to sensitive deleted revisions. Dmcdevit 01:08, 31 May 2007 (UTC)

(indent changed) Thank you for your understanding, I understand it inappropriate to publish all gathered information through CU, and how the CUs and steward can check the log, not from my own experience though. And I agree with you generally it is not a good idea to give a devoted WR editor to grant sysop right on our projects. Just for your relief, as far as I know English Wikiquote hasn't suffered to be posted sensitive information, so at least currently being it sysop is not so harmful as on major Wikipedias. As for WR, you said "the user has confirmed it in their own words", so it might be not a secret; could you please a link where we can see it ourselves? --Aphaia 01:17, 31 May 2007 (UTC)

The user is currently discussing it on the website [65]. I don't think Poetlister has made any secret of the fact. Dmcdevit 01:31, 31 May 2007 (UTC)

Wow! The invective from Wikipedia Review's "Poetlister" is sounds quite vicious and rather paranoid. I can see this is going to make it hard to support Poetlister even as an editor on WQ. Do we have evidence that this is the same person as our helpful Poetlister? Is it possible this is someone who merely registered as Poetlister, using the info readily available on her WP user page, to discredit her or opportunistically use her name to smear WP? (Sorry if I sound naive; it's just that this doesn't sound like our Poetlister.) ~ Jeff Q (talk) (also a WQ sysop) 02:18, 31 May 2007 (UTC)

Closing this as "time-out" - will archive it --Herby ^{talk thyme} 08:03, 28 June 2007 (UTC)

Sockpuppets @ simple English Wikipedia

• simple:User:Wiki-star
• simple:Wiki-star
• simple:Taracka
• simple:YogaKing37
• simple:Sweetness34 (El Sparky)
• simple:Andymack1986
• simple:Dodoria

These few users have been suspected of sockpuppetry on the Simple English Wikipedia. Please look into it. Thank you.--Tdxiang 02:13, 19 June 2007 (UTC)

For a little background on the reason for this request, see simple:Wikipedia:Requests for deletion#Dodoria, Zarbon and Frieza.--Werdan7 (t) 05:00, 19 June 2007 (UTC)

Your user links are wrong, and I cna't find "Sweetness34 (El Sparky)" user drini ^[es:] _[commons:] 12:39, 20 June 2007 (UTC)

Done Users Wiki-star, Andymack1986, Yogaking37, Dodoria, Sweetness34, Taracka, Zarbon, Recoome are all from a single ip, and all but the last 2 were used only during a single day on a narrow time window. Moreover, the IP is listed as a possible spam source at several online spamlists. drini ^[es:] _[commons:] 12:48, 20 June 2007 (UTC)

Vandals @ akwiki

Please check to see if these page-move vandals and a spambot have the same IP address.:

   * ak:b:User:Willy on wheels on wheels on wheels!!!
   * ak:b:User:Willy on wheels on wheels!!
   * ak:b:User:Kwava Kellisa

I have just blocked two pagemove vandals and a spambot - are they related and if so what IP rangeblock should I use?? --WiganRunnerEu 12:19, 15 June 2007 (UTC)

Done, I blocked two compromised IPs and a bunch of socks. MaxSem 18:27, 15 June 2007 (UTC)

Taeedxy @ fawiki

fa:User:Taeedxy was accused for having a sockpuppet account on persian wikipedia ANB. Even he had voted the same on some AfD with that suspicious account. For proving that he is innocence, Taeedxy asked me to request for his checkuser information here. Please check these two users on persian wikipedia. fa:User:Taeedxy and fa:User:Pls. Thanks in advance. Hessam 19:06, 30 May 2007 (UTC)

I'm fa:User:Rooh23 . I'm not an administrator . Above request is wrong beacaue:

1. Hessam said : fa:User:Taeedxy was accused for having a sockpuppet . It's not true . The case that Hessam named accused really is an example . In that edit fa:User:Hoseyn_1 asked a question from fa:User:Taeedxy : if you and fa:User:Navid.k and fa:User:Pls have edits from same computer , what is your explanation? . A simple question not accusation . In the case there are 2 users are under question with fa:User:Taeedxy . But fa:User:Taeedxy select fa:User:Pls and asked from Hessam for check user . Then what about fa:User:Navid.k ?
2. fa:User:Taeedxy allowed Hessam for check user but Hessam never asked from fa:User:Pls .

Excue me if my English is terrible :-)

Thanks . --Rooh23 05:18, 3 June 2007 (UTC)

The reason is this. Anyway I think checkuser information is not needed anymore :-) Hessam 19:46, 8 June 2007 (UTC)

Spring2000 @ fawiki

This account: fa:User:Spring2000 has been recently created and prominently used to attack other user of Farsi Wikipedia (fa:User:گردآفرید and fa:User:سندباد), and has been blocked for 24 hours due to misconduct and personal attacks. As the attacked accounts have been involved in edit wars perviously, specially with fa:User:Sepehrnoush, and regarding that the account user is very well oriented about wiki styles, this is possible that the account is a sockpuppet or meatpuppet. However, I do not have any evidence proving that Spring2000 is a sockpuppet for Sepehrnoush. I would like to request checkuser information for Spring2000 against active users of Farsi wikipedia. Your prompt answer is appreciated. Huji 09:18, 6 June 2007 (UTC)

It would be grateful if someone would also fulfill this request. Huji 19:21, 13 June 2007 (UTC)

Given the recent issues surrounding fa-wiki checkuser requests, I ask that at least 3 other sysops confirm the necessity of this request.--Shanel 06:11, 15 June 2007 (UTC)

Given that we have only five active sysops, I will try my best so at least 2 other sysops would confirm this here. Huji 06:16, 15 June 2007 (UTC)

Well; I confirm the necessity of this checkuser request. And I am a sysop there :) Raamin 16:59, 15 June 2007 (UTC)

I give the green light too. Behaafarid 04:05, 19 June 2007 (UTC)

I am real <Sepehrnoush>.
I agree to chcking with anyone.([Validation]).

• excuse me, I`m not a sysop, but must say that we`re having only 9 sysop in fa.wiki now that 5 of them are really active, then I confirm this request is very necessary for prevent the future vandalises and attacks. further, if Huji confirm, please after checking fa:User:Spring2000 with fa:User:Sepehrnoush, check it with fa:User:Senemmar or fa:User:Hoseyn 1, or both of them. thanks a lot & regards,--Gordafarid 17:58, 17 June 2007 (UTC)

I see no reason for specifying the users fa:User:Spring2000 should be checked to. I have no "robust" reason showing any of the above three accounts were running fa:User:Spring2000 but I have good reasons for claiming the latter was a sockpuppet. I hereby request the steward handling this case, to kindly not report the suspected accounts here (to prohibit misinterpretation of results by non-professionals). In case the checkuser information suggests a possible (but not obvious) sockpuppetry, it would be nice if the account names would only be sent to me (and one of the other Fa WP sysops) by email. Huji 22:40, 17 June 2007 (UTC)

I am sysop on fa.wikipedia(fa:User:ظهیری) and i confirm the necessity of this checkuser too. Zahiri 15:09, 19 June 2007 (UTC)

Done. I checked only Spring2000 and Sepehrnoush. Let me know if I should check any more users.

Spring2000 edited on June 6 from two different proxies, one open and one transparent. Sepehrnoush, on the other hand, has edited almost consistently from one range. Sepehrnoush has no user agent string data so I can't compare to Spring2000's. --Shanel 06:01, 20 June 2007 (UTC)

Thank you Shanel, for the information you provided. Huji 15:42, 21 June 2007 (UTC)

Sock puppet voting @ fawiki

On an AfD page on Farsi Wikipedia, some newly created accounts and anonymous users have voted against the article deletion. These include fa:User:Mehti ip (contribs) who has a previous edit history on related topics, fa:User:Mojtaba ce (contribs) with no edit history except in that AfD and the related article (first edit was on AfD, and he/she emptied the AfD page once too), fa:User:Wiliamin (contribs) with a single edit history posting opposing vote on the AfD page, and fa:User:Feergusen (contribs) with a similar single edit history. The last three accounts are all created on June 10th or afterwards; the AfD case was opened on June 10. The anonymous edits are from IPs in 217.219.62.* range, which locates inside Iran. I would like to request a checkuser of these accounts, to find possibly sockpuppets.

Thanks in advance. Huji 18:20, 16 June 2007 (UTC)

I confirm that they are all in the same range; Mojtaba ce and Mehti ip share the same IP. Wiliamin and Feergusen do not share IPs with anybody, but are in the same range. Jon Harald Søby 18:43, 16 June 2007 (UTC)

Please also include information regarding the similarity of their useragent information, if this helps confirming the possibility of sockpuppetry Huji 19:24, 16 June 2007 (UTC)

Yeah, they all used WinNT 5.1 and IE 6. Jon Harald Søby 16:13, 17 June 2007 (UTC)

Thank you Huji 16:14, 17 June 2007 (UTC)

Vandals @ nowikisource

Two user accounts were used for "on wheels" vandalism today: no:s:Bruker:Willy on Wheels, no:s:Bruker:Rodelero. It would be intresting to know if both are the same. Thank you, --Thogo (talk) 22:30, 30 May 2007 (UTC)

Isn't it obvious they're the same? drini ^[es:] _[commons:] 13:25, 1 June 2007 (UTC)

I would imagine that they were after some insight or action into the source of the user accounts. So many are open proxies or trojaned machines? --Herby ^{talk thyme} 13:59, 1 June 2007 (UTC)

No, it is not obvious, because Rodelero started with other vandalism (without "on wheels"). He did only one "on wheels" page move and only after I started to move the WoW-vandalisms back. So it might be a copycat. And both of them vandalized parallel. So it would be interesting if WoW does "work" this way (I mean using two accounts parallel) or not. --Thogo (talk) 16:23, 1 June 2007 (UTC)

Done Confirmed to be the same (and yes it was obvious, he tried to make it look different, but it was ovious it was the same). drini ^[es:] _[commons:] 18:56, 1 June 2007 (UTC)

And the information that should come out here is exactly why such checks should be made - Drini may wish to consult the block log on en Wikipedia --Herby ^{talk thyme} 18:58, 1 June 2007 (UTC)

What information? They being the same? It could be assumed it was obvous. Enwiki blocklog is irrelevant —The preceding unsigned comment was added by Drini (talk • contribs) 21:08, 1 Jun 2007 (UTC)

• reset

The IP is the issue. It has now been CU checked on 6 different wikis by 7 CUs in just a month. The IP is blocked on en Wikipedia indefinitely as a "sock farm". I would suggest it is a source of considerable disruption to Wikimedia projects --Herby ^{talk thyme} 11:57, 2 June 2007 (UTC)

Vandals @ mswiki

• ms:Pengguna:Itu memang gay!
• ms:Pengguna:Yaahoodee
• ms:Pengguna:Pontianak cantik

Vandalism-only accounts (with bad usernames) created on the Malay Wikipedia. We are looking to see if they were created by the same IP address, and if so, please block that IP with account creation disabled.Master2841 08:38, 5 June 2007 (UTC)

• ms:Pengguna:Allah swt
• ms:Pengguna:I hate Jewish people
• ms:Pengguna:Zakar123

Vandalism-only accounts (with bad usernames) created on the Malay Wikipedia. We are looking to see if they were created by the same IP address, and if so, please block that IP with account creation disabled, together with above request. Yosri 04:51, 6 June 2007 (UTC)

Done , each group comes from a single ip. Both IPs were blocked. drini ^[es:] _[commons:] 03:32, 11 June 2007 (UTC)

Holhuashi @ dvwiki

One of our users, namely Khazaanaa on Dhivehi Wiki posts on my user talk page, saying that he remembers registering himself on the same wiki previously. He assumes that on 22nd September 2006 he registered himself as Holhuashi. What he would like to know is whether a Check User could clarify the IP address this User Holhuashi has registered. If it is possible i would like to ask some one to check it.

Thanking You!!

--Glacious 10:25, 10 June 2007 (UTC)

Not done Is not possible to retrieve CU info from a date long in the past. drini ^[es:] _[commons:] 20:32, 10 June 2007 (UTC)

Several accounts on same IP range @ ukwiki

Please check:

• uk:Користувач:Minia
• uk:Користувач:SirJ.M.(R)‎
• uk:Користувач:Вовка

and

• uk:Користувач:Jack
• uk:Користувач:Вася Амур

They may be have similar IP-addresses--Ahonc 23:08, 16 June 2007 (UTC)

They all have similar IP addresses, and they change IPs quite often, usually within the same day. However, there is no user agent data, so I can't really tell you more than you already know. --Shanel 05:08, 19 June 2007 (UTC)

Meta - User:Bastard on wheels

Given the "on wheels" connection this may well indicate an open proxy or a blacklisted IP that has been used cross wiki at some stage. Thanks --Herby ^{talk thyme} 16:12, 28 June 2007 (UTC)

Done by Lar, results emailed me. Not surprising but this is a source of a number of vandal accounts here including user:Penis and others. There are at least 6 blacklisting for this IP too and a history on a number of wikis. It would seem likely that it is either a trojaned machine or an open proxy. Larry has blocked the IP here and there are blocks of at least 6 months on a number of Wikis. Anyone wants the info to check their wiki let me know, Cheers --Herby ^{talk thyme} 11:07, 29 June 2007 (UTC)

Cross-wiki checkuser info on ru:wikipedia:User:Николай Колпаков and en:wikipedia:User:Nikolay Kolpakov

Please confirm the identity of ru:wikipedia:User:Николай Колпаков and en:wikipedia:User:Nikolay Kolpakov. Additionally, please checkuser and confirm (or not confirm) if en:wikipedia:User:Green54321 and en:wikipedia:User:Green12345 are the same as en:wikipedia:User:Nikolay Kolpakov and/or ru:wikipedia:User:Николай Колпаков. The ru:wikipedia:User:Николай Колпаков is known in ru.wikipedia as a creator of many abusive sockpuppets, most of which are now blocked.

The reason why I'm asking for cross-wiki checkuser is that this user has made the same edits (renaming of en:wikipedia:Homophobic propaganda to en:wikipedia:Antihomosexual propaganda and ru:wikipedia:Пропаганда гомофобии to ru:wikipedia:Антигомосексуальная пропаганда) in en.wikipedia and ru.wikipedia, using sockpuppets to avoid being blocked for 3RR violation, and also made offensive comments etc. See this edit - first revert, one more revert, and one more.

The case of Nikolay Kolpakov is now subject of ru.wikipedia Arbcom decision, as well as the case with the page title, and it does matter for our Arbcom if the user is the same in ru.wp and en.wp or not. Rombik 14:50, 4 July 2007 (UTC)

No matches found for en:User:Nikolay Kolpakov.

One IP address is shared between ru:User:Николай Колпаков and en:User:Green54321 on last May, 17th to 20th. The provider is from Russia.

Hope this helps. --Paginazero - Ø 19:35, 4 July 2007 (UTC)

Yes, it really helps :-) Thanks, Paginazero :) Rombik 20:06, 4 July 2007 (UTC)

Tennis@it.wikibooks

Please ceck if b:it:user:tennis, b:it:user:Ligabue and b:it:user:Scienziato are sockpuppets, the former two are great vandals among various wikis the last is an active user that created two books. --The Doc 11:04, 8 July 2007 (UTC)

Done

Nessun riscontro per b:it:user:Ligabue.

Riscontro positivo per b:it:user:Tennis e b:it:user:Scienziato: nei giorni 5 e 6 luglio hanno condiviso due indirizzi IP negli stessi orari. --Paginazero - Ø 14:42, 8 July 2007 (UTC)

Emrrans @ meta

Per: [66] which reports on a claim of puppetry by the user Emmrans here: [67]

• Emrrans (talk • contribs • deleted contribs • logs • block user • block log • checkuser) claimant
• Aeonimitz (talk • contribs • deleted contribs • logs • block user • block log • checkuser) claimed sock
• Lokey3310 (talk • contribs • deleted contribs • logs • block user • block log • checkuser) claimed sock

++Lar: t/c 18:24, 10 July 2007 (UTC)

• A user claims sockpuppetry of himself here and requests for blocking two of his accounts. Please check if the mentioned accounts are really of the same person. Thank you. --Thogo (talk) 18:21, 10 July 2007 (UTC)

Results
No relation found between Emmrans and Aeonimitz. Contributions of Lokey3310 are too old to check. Possible relation based on contribs (same pages edited) but I just don't think so based on gut feel. I characterise this assertion by Emmrans as spurious or malicious. Grant his boon (of being blocked) and leave the other users be. ++Lar: t/c 18:39, 10 July 2007 (UTC)

Qwertysrevenge2 @ meta

• Qwertysrevenge2 (talk • contribs • deleted contribs • logs • block user • block log • checkuser)

"On wheels" vandal account. Should expose an open proxy or similar. Thanks --Herby ^{talk thyme} 07:39, 5 July 2007 (UTC)

Results
Ordinary vandal, nothing connected to anything else found at this time. CUs: Mail me for results if you think there is a connection to another wiki ... ++Lar: t/c 10:57, 6 July 2007 (UTC)

Again thanks - no real history I would find BUT some (5 at least) blacklistings. I'll do some memo blocks at least --Herby ^{talk thyme} 14:20, 6 July 2007 (UTC)

Bobabobabo @ meta

• Bobabobabo (talk • contribs • deleted contribs • logs • block user • block log • checkuser)

Given the cross wiki history of this and very similar names this one should be checked too - thanks --Herby ^{talk thyme} 18:17, 5 July 2007 (UTC)

Results
Certainly is active across multiple wikis but nothing out of the ordinary on Meta was found. CUs: Mail me for results if you think there is a connection to another wiki ... ++Lar: t/c 11:02, 6 July 2007 (UTC)

Thanks - Open proxy, blocked Meta, Commons, & en Quote (already blocked en Books & en WP). --Herby ^{talk thyme} 11:07, 6 July 2007 (UTC)

Anime sockpuppets @ enwikiquote

The anime-editing sockpuppet wars on English Wikipedia (see w:en:Wikipedia:Requests for checkuser/Case/Zarbon, w:en:Wikipedia:Suspected sock puppets/Frieza-Bomber, and related pages) and Simple English Wikipedia (see below) are happening on English Wikiquote as well. I would like to request a CheckUser to determine the relationships between the following en:WQ editors that have participated in the edit warring:

• q:en:User:24.115.238.8
• q:en:User:24.215.185.81
• q:en:User:71.176.195.122
• q:en:User:71.176.197.33
• q:en:User:71.176.199.13
• q:en:User:71.176.206.154
• q:en:User:71.176.206.212
• q:en:User:71.176.203.106
• q:en:User:72.227.129.181
• q:en:User:80.212.124.60
• q:en:User:96.228.1.2
• q:en:User:168.216.112.15
• q:en:User:168.216.75.64
• q:en:User:219.89.161.229 (suspected sockpuppet of Recoome)
• q:en:User:219.89.167.99 (suspected sockpuppet of Recoome)
• q:en:User:219.89.171.159
• q:en:User:219.89.173.8
• q:en:User:219.89.175.215 (admitted sockpuppet of Recoome)
• q:en:User:Andymack1986 (admitted sockpuppet of Zarbon)
• q:en:User:BJ Blazkowicz (admitted sockpuppet of Zarbon)
• q:en:User:A Link to the Past
  • This is also w:en:A Link to tha Past; note "tha" instead of "the", as in existing w:en:User:A Link to the Past
• q:en:User:Brendan Filone
• q:en:User:Chickensword
• q:en:User:Frieza
• q:en:User:General Cui
• q:en:User:H*Bad12345
• q:en:User:H*bad
• q:en:User:Klatsh
• q:en:User:Link
  • Attempted impersonation of w:en:User:A Link to the Past
• q:en:User:Lord Frieza
• q:en:User:Master Batour
• q:en:User:NicAgent
• q:en:User:NoUcan't (admitted sockpuppet of Zarbon)
• q:en:User:Pickle89
• q:en:User:Poetic Decay
• q:en:User:Prince Zarbon
• q:en:User:Recoome
• q:en:User:Remove-All-Content
• q:en:User:Sk8terhata
  • I suspect this might also be w:en:User:TheClownPrinceofCrime based on similarity of q:en:User:Sk8terhata page and old User:TheClownPrinceofCrime page, and from a bad history with with w:en:User:Poetic Decay)
• q:en:User:SlavicZarbon
• q:en:User:Sweetness32
• q:en:User:Taracka
• q:en:User:Uglyguy2006 (likely sockpuppet of Zarbon)
• q:en:User:Ufundoa
• q:en:User:Wiki-star
• q:en:User:YogaKing34
• q:en:User:Zarbon

Additional discussion on this issue is taking place at q:en:WQ:AN#Anime article edits, VfD, and sockpuppetry. ~ Jeff Q (talk) 17:47, 21 June 2007 (UTC)

In case the research on this has already begun, please note I just added q:en:User:24.215.185.81 to the list above. Thank you. ~ Jeff Q (talk) 18:42, 21 June 2007 (UTC)

And here's another: q:en:User:219.89.171.159, who claims to be q:en:User:Recoome. I am advising the blocked users to stop harrassing folks through anon posts and emails until the CheckUser results are made available, but given the past history of block-evasion from these usernames on WP, I don't expect it to end here. ~ Jeff Q (talk) 04:05, 22 June 2007 (UTC)

And now q:en:User:Prince Zarbon. I hope this request can be processed soon, because in the meantime I must keep blocking new usernames and IPs with similar editing patterns without firm evidence. If indeed this is the same one or two people, they are making a regular effort of evading these blocks. ~ Jeff Q (talk) 18:37, 23 June 2007 (UTC)

And now q:en:Chickensword, who claims to be Wiki-star and vandalized a number of pages as well as re-editing at least one anime page with a contested edit per this ongoing dispute. We have no problems blocking obvious vandals, but the sooner we get a CU report, the sooner we can unblock anyone we might have blocked on circumstantial but ultimately insufficient evidence. ~ Jeff Q (talk) 01:59, 27 June 2007 (UTC)

And now vandal q:en:User:NicAgent, vandal q:en:User:SlavicZarbon, and self-implied q:en:User:Link sockpuppet q:en:A Link to the Past, who should not be confused with w:en:A Link to the Past. This list will keep getting longer every day until we can find out what IPs are behind these sockpuppet/vandals. ~ Jeff Q (talk) 23:27, 27 June 2007 (UTC)

I've just added the following set of IPs that have made anime-related nonsense/vandalism edits to some articles in the past few weeks, the period during which this sockpuppetry has been going on:

• q:en:User:71.176.195.122
• q:en:User:71.176.197.33
• q:en:User:71.176.199.13
• q:en:User:71.176.206.154
• q:en:User:71.176.206.212
• q:en:User:71.176.203.106
• q:en:User:96.228.1.2

I'd like to know if these are related to the anime sockpuppets as well. If not, we'll deal with them separately. ~ Jeff Q (talk) 00:33, 28 June 2007 (UTC)

New likely sockpuppets: q:en:User:219.89.161.229, q:en:User:219.89.175.215, and q:en:User:NoUcan't. Just to be clear, I am adding each of these new ones to the master list above as they occur, so when someone finally gets around to checking it, they need only examine the bulleted list at the top. ~ Jeff Q (talk) 12:01, 1 July 2007 (UTC)

I've added q:en:Uglyguy2006, a probably Zarbon sockpuppet, to the list at the top. ~ Jeff Q (talk) 14:30, 3 July 2007 (UTC)

I've also added q:en:User:BJ Blazkowicz, q:en:User:Pickle89, and q:en:User:Remove-All-Content. ~ Jeff Q (talk) 05:27, 4 July 2007 (UTC)

And I've added q:en:User:219.89.167.99 as a suspected Recoome sockpuppet. ~ Jeff Q (talk) 05:34, 4 July 2007 (UTC)

And now q:en:User:Andymack1986. ~ Jeff Q (talk) 02:51, 5 July 2007 (UTC)

Results

• Andymack1986 = Remove-All-Content = BJ Blazkowicz = Pickle89 = Uglyguy2006 = NoUcan't = Prince Zarbon = Brendan Filone = Frieza-Bomber = General Cui = Sk8terhata = Link = Master Batour =Lord Frieza =Taracka = Frieza = YogaKing34 = Wiki-star =Dodoria

• SlavicZarbon = A Link to the Past = Chickensword = Sweetness32 = Link = Wiki-star

• IDENTITYCONFIRM = Markie = Ufundoa = Nanobug Locked Out! = Erpnaternac = Staying Anon = 24.115.238.8 = n:user:MyName =~ Zarbon (95%) =~ NicAgent (90%) =~ Rulliblehaxxer (90%) =~ 24.215.185.81 (90%) =~ 72.227.129.181 (95%)

weak matchs:

H*bad

H*Bad12345

Klatsh

71.176.195.122

71.176.197.33

71.176.199.13

71.176.206.154

71.176.206.212

71.176.203.106

168.216.75.64

168.216.112.15

96.228.1.2

Poetic Decay

(Weak matchs should not be considered socks unless there is other strong evidence to support it)

• NicAgent = Rulliblehaxxer
• H*Bad12345 =~ H*bad (95%)
• Recoome = 219.89.161.229 = 219.89.167.99 = 219.89.171.159 =219.89.173.8 = 219.89.175.215
• 80.212.124.60 highly unlikely to be related to anything above

--Cspurrier 17:33, 7 July 2007 (UTC)

Thank you very much, Cspurrier, for working on this massive collection of names and IPs, and for your follow-up assistance as well. ~ Jeff Q (talk) 15:26, 9 July 2007 (UTC)

FortHuntington/QuackyQuackDuck @ enwikiversity

• v:User:FortHuntington
• v:User:QuackyQuackDuck

Same guy I talk about in all of my other requests.—Ryūlóng (竜龍) 01:04, 22 June 2007 (UTC)

Done Ichtragekeineschuhemorgen = Ichtragekeineschuhemorgen =QuackyQuackDuck =FortHuntington =Ichhabevielesocken2 =Ichhabevielesocken --Cspurrier 17:39, 7 July 2007 (UTC)

yi.wiki

• [68] uses my name and tries to give away privacy please block him and do checkuser for more names of his to be blocked thanks--יודל 01:07, 2 July 2007 (UTC)

  Done, although it was not very necessary, considering the user essentially announced on his user page that he was joel.m's sockpuppet.--Shanel 01:42, 2 July 2007 (UTC)

• also this user yi:באַניצער:יואל אראן created a blocked account yi:באַניצער:יודלזלמןלייב due to vandalism, please make throughou checkuser to see all his names to block. thanks--יודל 01:15, 2 July 2007 (UTC)

  Done, no other users found.--Shanel 01:56, 2 July 2007 (UTC)

  Since shanel is away can somebody say what it means her results that joel.m is the sockpupet, does this mean this user Joel.m? [69] isn't blocked today, can somebody please make a second check user to clarify shanels results?--יודל 11:05, 2 July 2007 (UTC)

  I re-blocked Joel.m for admitted creation of a sock puppet coupled with violation of privacy. —{admin} Pathoschild 15:29:00, 02 July 2007 (UTC)

Sorry but I did not attend to violate any ones privacy and I still believe that it is not his name he just claims so, so he can keep me blocked. Please unblock my account joel.m. --66.174.79.241 19:09, 2 July 2007 (UTC)

A name can always be proven who's it is there is the telephone company directory and there is ID cards from the government like drivers license and more. So there is no point in arguing here. If the stewards want i can provide everything for proving a vicious vandal who has degenerated himself to destruction of our wiki by exposing personal information and identity of other users. Thank you Pathoschild and shanel for doing your responsibility to block him out.--יודל 14:00, 4 July 2007 (UTC)

BOTH, FIGHT, OUT OF HERE. drini ^[es:] _[commons:] 01:48, 5 July 2007 (UTC)

Varahram10 @ fa.wikipedia

fa:User:Varahram10 appears to have similar wiki skills, interest in arguing similar people, and is created during the one-month block period of fa:User:گردآفرید (see the block log). گردآفرید has had a previous history of sockpuppetry during blocks (here).

I have informed the other local sysops, including Hessam, User:Behaafarid and User:Zahiri in this regard; we are concerned about ending with a negative checkuser result because of the user having learned how to confuse the CU. Nevertheless, I would like to request CU for Varahram10 against the blocked user گردآفرید. It is also possible that there are other newly created SPs for User:گردآفرید, and I would be grateful if they are located. (You can email me if you prefer not to publish the information about the other accounts on this page).

Thanks in advance Huji 09:27, 7 July 2007 (UTC)

Done. گردآفرید is editing from the same range and ISP. None of his IPs are shared with Varaham10. Varahram10 is switching between a range resolves to Chennai (although the country is listed as Iran), and one that resolves to Huston, Texas. He does so within the same day. Needless to say, that's quite suspicious. I've checked all of Varaham10's IPs, and he's not the only user using them; however I have not looked into it fully. I've dumped all the results offline and will look after I've written my midterm. --Shanel 18:29, 9 July 2007 (UTC)

Thank you very much for doing it Shanel ;) guillom 21:10, 9 July 2007 (UTC)

I would like to thank you again, Shanel Huji 09:17, 10 July 2007 (UTC)

Albi Vargas Osito@es.wikipedia

Debo informar sobre múltiples cuentas con similares intereses que han realizado una prolongada guerra de ediciones en artículos relacionados con Costa Rica es es.wikipedia. He informado a otros administradores locales y tras no poder encontrar a un checkuser disponible, hago la solicitud aquí. (Disculpen por hacer la solicitud en español) Pedro Nonualco 16:34, 7 July 2007 (UTC)

Done Los usuarios mencionados (junto con otros con nombres similares (albi osito, albi vargas osito), han estado realizando una prolongada guerra de ediciones en artículos sobre Costa Rica, y política de Libre Comercio. drini ^[es:] _[commons:] 16:35, 7 July 2007 (UTC)

En.dmcdevit @ Meta

En.dmcdevit (talk • contribs • deleted contribs • logs • block user • block log • checkuser) - vandal account, given the impersonation of dmc if might be someone who has a "history" somewhere - cheers --Herby ^{talk thyme} 13:02, 13 July 2007 (UTC)

Result

Already blocked. Only using one IP. Other recent user on the IP Mbajangle (talk • contribs • deleted contribs • logs • block user • block log • checkuser) also a vandalism only account. Likely match but not definite. Blocked other user as well, the IP already blocked (by you?... no, .anaconda). No activity found on Commons. Perhaps you can check en:books, Herby, and ask (oh the irony) Dmcdevit to check en:wp?++Lar: t/c 13:26, 13 July 2007 (UTC)

Open proxy on en wp - gone blocking! Thanks --Herby ^{talk thyme} 13:29, 13 July 2007 (UTC)

Smileupperauto @ Meta

Smileupperauto (talk • contribs • deleted contribs • logs • block user • block log • checkuser) - vandal account, probably a history somewhere, thanks --Herby ^{talk thyme} 07:10, 14 July 2007 (UTC)

Results

Seems garden variety at meta, nothing untoward found (but he does like forward slashes!). Results sent to Herby for further investigation, available to other CU's on request. ++Lar: t/c 19:15, 14 July 2007 (UTC)

QuankingHogFern @ Meta

QuankingHogFern (talk • contribs • deleted contribs • logs • block user • block log • checkuser) not that important, just someone who wants me to die in a nasty way (again!). I'm hoping for an open proxy to be revealed, not urgent. Thanks --Herby ^{talk thyme} 11:05, 17 July 2007 (UTC)

Result

Same old same old, nothing found. Style points for this one's oppose on the 'crats though. Resuls sent for analysis. ++Lar: t/c 21:39, 17 July 2007 (UTC)

Shambaitatmeta @ Meta

Shambaitatmeta (talk • contribs • deleted contribs • logs • block user • block log • checkuser) - my pages across wiki were under attack quite a bit yesterday - this looks like another "friend" I've made. Given the similarity in names it might link with a CU check I just made on en Books who had me as a target too, thanks --Herby ^{talk thyme} 08:34, 15 July 2007 (UTC)

Result

Already blocked. Only using one IP. No other recent users on the IP which is autoblocked. Results sent to you for further analysis. Available to other CU's on request. ++Lar: t/c 14:54, 15 July 2007 (UTC)

Same IP as the books one - thanks --Herby ^{talk thyme} 15:00, 15 July 2007 (UTC)

Lindsay1980 @ simplewiki

Please check if User:Lindsay1980 and User:S-man and User:71.231.130.56 are of the same IP. They are persistent trolls which masquerade as young people. Cheers.--Tdxiang 09:52, 9 July 2007 (UTC)

Also, please chekc if Jessicagirl is a sockpuppet too. Thanks.--Tdxiang 09:24, 10 July 2007 (UTC)

Done Choosnink^(blocked), Jessicagirl, JustJacklen^(blocked), and Lindsay1980^(blocked) share the same IP address and software profiles. S-man does not seem to be related to the other users. 71.231.130.56's checkuser data has expired, but it is an IP address in a different range owned by the same Internet service provider the aforementioned edited from, though none of the other users edited from that range in the last month.

This does not prove a direct link by itself; they may simply edit from the same school or workplace computer network. These checkuser results should only be used to confirm other evidence, such as similar behaviour. —{admin} Pathoschild 23:14:32, 11 July 2007 (UTC)

Akan Wikibooks - new Willy on Wheels/ offensive username spree

This is my block log from Akan Wikibooks - where I'm ak:b:User:SunStar Net. A spree of offensive user-name creation happened today, as seen below:

1. 17:34, 7 July 2007 SunStar Net (Talk | contribs) blocked "ak:b:User:Willy shirty (contribs)" with an expiry time of indefinite (Please contact an administrator for verification purposes, as described on this page)
2. 17:33, 7 July 2007 SunStar Net (Talk | contribs) blocked "ak:b:User:My penis is a penis with wings (contribs)" with an expiry time of indefinite (user...)
3. 17:31, 7 July 2007 SunStar Net (Talk | contribs) blocked "ak:b:User:A tangled penis (contribs)" with an expiry time of indefinite (user...)
4. 17:30, 7 July 2007 SunStar Net (Talk | contribs) blocked "ak:b:User:I'VE GOT 40 TONS OF BOMBS FOR YOU (contribs)" with an expiry time of indefinite (user...)
5. 17:25, 7 July 2007 SunStar Net (Talk | contribs) blocked "ak:b:User:J0mbo W0les (contribs)" with an expiry time of indefinite (user...)
6. 17:24, 7 July 2007 SunStar Net (Talk | contribs) blocked "ak:b:User:Willy's willys willy on willywheels on wax (contribs)" with an expiry time of indefinite (user...)
7. 17:23, 7 July 2007 SunStar Net (Talk | contribs) blocked "ak:b:User:Willy riding on motorbike wheels (contribs)" with an expiry time of indefinite (user...)
8. 17:21, 7 July 2007 SunStar Net (Talk | contribs) blocked "ak:b:User:WILLY ON WHEELS ON wheels FUI (contribs)" with an expiry time of indefinite (user...)

taken from ak:b:Special:Logs/block

Please block the underlying IP, and if it is blocked, use the local checkuser block template in the block summary. --WiganRunnerEu 21:56, 7 July 2007 (UTC)

Done drini ^[es:] _[commons:] 04:45, 13 July 2007 (UTC)

Cross-wiki checkuser info on en:wikipedia:User:Francisco_Tevez and es:wikipedia:Usuario:Francisco_Tevez

Following confirmation that these two accounts are both en:wikipedia:User:Molag Bal socks, I'm wondering if it would be possible to check for any other Molag Bal socks hiding on other WMF wikis. His latest method would appear to involve creating a simple user page (which I was told, was nothing more than a machine conversion) on a foreign language wiki, making a few edits, before returning to enwiki with a more convincing cover story, as was the case this time.

If possible, could all socks on foreign wikis be blocked and enwiki provided a list of socks to look out for and block.

Nick (Heligoland) 23:57, 6 July 2007 (UTC)

Well, of course they match to the same user. However, no other user was found on eswiki. It had a hundred or so ips on enwiki, andmany socks, but pretty much everything was already blocked. drini ^[es:] _[commons:] 05:22, 13 July 2007 (UTC)

As I understand: Done Effeietsanders 21:03, 13 July 2007 (UTC)

Siliamaav@fiwiki(quote|books|source)

There has been a vandalism spree spanning three Finnish wikis. The accounts concerned are:

• fi:b:User:Siliamaav
• fi:b:User:Vandalism attack!!!
• fi:b:User:Fuck you Jon!
• fi:b:User:Fuck you!
• fi:b:User:Dr. Feel Good
• fi:q:User:Siliamaav
• fi:s:User:Siliamaav

Jhs has already Checkusered the Wikibooks accounts. Please check the rest and block them as necessary. Thanks, Tangotango 15:23, 28 June 2007 (UTC)

Done drini ^[es:] _[commons:] 15:44, 13 July 2007 (UTC)

Morton Blitz @ en Wikiquote

Vandalism is the same pattern as Flannigan_Hittagan below. It seems likely to me that there is either a new open proxy that this has come from or that the one found previously remains unblocked (now blocked tho). Thanks --Herby ^{talk thyme} 08:51, 25 June 2007 (UTC)

Done drini ^[es:] _[commons:] 15:47, 13 July 2007 (UTC)

Thanks Drini - another Open proxy, tends to be so --Herby ^{talk thyme} 15:54, 13 July 2007 (UTC)

Sce03173 @ kowiki

There are suspicious accounts that is regarded as a blocked user's sock puppets in Korean Wikipedia again. Please check the underlying IP addresses of them.

• ko:사용자:Sce03066, ko:사용자:Sce03173 (the blocked User)
• ko:사용자:Jce_0542 (the suspicious account)

-- JongGuk 08:37, 1 June 2007 (UTC)

I'm on it. Effeietsanders 21:11, 13 July 2007 (UTC)

Done It is very likely that the three users are working on the same computer or company (school) network. Effeietsanders 21:21, 13 July 2007 (UTC)

Ahonc @ ukwiki

Please check:

• uk:Користувач:Ahonc
• uk:Користувач:Anastassia‎
• uk:Користувач:Indus

and

• uk:Користувач:Darvin
• uk:Користувач:Riwnodennyk

It is more likely first three belong to one person. Other one has evil character and last one has old gramatic style, may be have the same IP address. All these accounts were involved in similar edits made at same articles. Accounts actively use to vote for renaming, deleting pages, for new rules on wikipedia and to elect administrators. Most of them have talks only with Ahonk what is unusual for wikipedia, and these talks are very friendly talks out stood his usual style.--Xkbz 15:20, 20 June 2007 (UTC)

Unrelated. MaxSem 21:44, 23 June 2007 (UTC)

Can you give more details?--Xkbz 22:03, 23 June 2007 (UTC)

He can't say our IP-addresses (it is personal information).
Чекюзеры не могут разглашать персональных данных.--Ahonc 22:35, 23 June 2007 (UTC)

P.S. Умышленное искажение имени участника является личным оскорблением.--Ahonc 00:24, 24 June 2007 (UTC)

I ask for second opinion, but from western country. --Xkbz 22:03, 23 June 2007 (UTC)

I confirm MaxSem finding. Yann 20:23, 24 June 2007 (UTC)

Are there proxy IP's were used for some accounts?--Xkbz 19:25, 26 June 2007 (UTC)

If they say unrelated, they are probably unrelated. It is not allowed per privacy policy to give more information as stictly needed. Done Effeietsanders 21:24, 13 July 2007 (UTC)

Banned user @ bgwiki

Hello! At the Bulgarian Wikipedia there is a community decision to ban a user and his sockpuppets (Jimbo and the Board were informed), and there is a reasonable doubt that the user is creating many new sockpuppets as well as editing via open proxies, violating the official Wikimedia policy.

I would like to request a checkuser on the IP-addresses by the following usernames:

• bg:User:Магистъра
• bg:User:Berzelius
• bg:User:Spiritius (blocked)
• bg:User:Спиритий (blocked)
• bg:User:Спириций (blocked)
• bg:User:Енциклопедист (blocked)
• bg:User:Кънчо Путкодеров (blocked)
• bg:User:Stoymenov
• bg:User:Грундигчо Камиона
• bg:User:Сенегалец
• bg:User:Селския
• Note that some of these accounts are already blocked, as thay made obvious edits and remarks, clearing any doubt that it is the same banned user.
• Note that we use the Cyrillic alphabet, and there are cyrillic letters in the usernames, I hope you can check these too.

You may discover other, additional accounts, created recently by the same person at the same time.

This banned person is a very experienced computer specialist and for him it is easy to bypass any blocks by using an open proxy, so it is probable that all accounts have different IP addresses.

What we would ask to be checked, please, in addidion to the normal "checkuser" is if, actually, these IP addresses are proxies. The easiest to check this is by doing a Google search like this one: "201.6.121.46" Proxy which finds the IP address in many public online catalogs. Thanks a lot. (My name is Petko Yotov, wikipedian since 2003, you may also contact me privately by e-mail). --5ko 22:18, 27 June 2007 (UTC)

I would also be grateful for having this request processed. Thank you in advance, Spiritia (sysop on BG Wikipedia) 07:49, 28 June 2007 (UTC)

Woof, that was a tough investigation. Its results are the following:

• A motherlode of socks: ИнжИнера=Енциклопедист=Спириций=Спиритий=Mozart=Stoymenov=Ролерчо=Berzelius=Кънчо Путкодеров=М.Пищова=Пан Кмичиц=Негър=Николай Спасов=Камионетчо=Марионетчо=IvayloValentinov=Колю Спасов=Горския=Vrmenen=Фургончо=Камазчо=Фолцфагенчо=Pety Stoeva=Сенегалец=Селския=Mi4urin=Kabeljiqta=Николай Спасов=К Спасов=Kilsat
• No evidence: Грундигчо Камиона
• Proxies need to be blocked:
• 201.6.115.7
• 202.41.167.246
• 202.21.176.50
• 202.41.167.246
• 220.217.50.197
• 80.58.205.43
• 62.39.176.6
• 193.251.181.135
• 216.129.98.144
• 200.238.102.162
• 125.248.152.26
• 125.136.136.78
• 206.222.198.98
• 69.182.47.102
• 193.64.251.245
• 12.180.115.15

I will keep myself this permission for a while, I have more IPs to investigate thoroughly. MaxSem 16:10, 28 June 2007 (UTC)

Thanks a lot for your research. --5ko 13:43, 29 June 2007 (UTC)

Hi. Thanks for helping us with that mess. I would only explicitly ask you to check whose sockpupet is bg:User:Пикапчо as it made only two edits but very offending and they serverd as a launch for the whole campaign. --Петър Петров 12:57, 30 June 2007 (UTC)

Strange, I found him immediately, but forgot to include him into my first report. He is definitely Николай Спасов, and therefore ИнжИнера too. MaxSem 13:11, 30 June 2007 (UTC)

"Николай Спасов" is listed twice, maybe that's the reason :) And thanks for support. --Петър Петров 15:16, 30 June 2007 (UTC)

Just to add something: I have some suspicions that there may be two swarms of puppets - one by ИнжИнера and one by someone trying to force a ban on ИнжИнера. The second group include "Николай Спасов" and definitely "Пикапчо". The banned user has many enemies and was always playing on the gray border, for years, just close enough to avoid the ban. Maybe someone "helped" him this time. Just check that there is certain evidence that ИнжИнера=Николай Спасов. --Петър Петров 15:26, 30 June 2007 (UTC)

There is a small chance of doubt, as both ИнжИнера and Спасов upgraded their browsers during the checked periond, but most likely it's the same person. MaxSem 15:39, 30 June 2007 (UTC)

I won't go paranoid any further and I will accept your checkuser skills as sufficient enough. Allow me to thank you one more time for what you have done for bg wikipedia, for the community content and the ИнжИнера case. Drop me a note if you ever come in Bulgaria, the beer is from me :) --Петър Петров 16:55, 30 June 2007 (UTC)

Max, thank you for all your efforts. I'd only ask you to explicitly confirm or reject bg:User:Магистъра? Regards, Spiritia 16:05, 1 July 2007 (UTC)

Spiritia, the banned user Injinera stated that Магистъра is himself while asking one of his supporters to help him. These edits are done after the ban was voted and the account should be blocked on sight. --5ko 01:57, 12 July 2007 (UTC)

Apperently Done - Effeietsanders 21:28, 13 July 2007 (UTC)

User:Stargate756 @ zh.wiki

According to this discussion, I request to check zh:User:Stargate756 in Chinese Wikipedia.

User:Stargate756 is suspected using IP accounts to attack other users' pages and talk pages for a long time.

The following IP accounts was suspected sockpuppets of User:Stargate756.

• 218.170.12.113 @ 2007/05/30 18:07 (UTC)
• 218.170.175.251 @ 2007/06/10 15:34 & 15:37 (UTC)
• 218.170.168.55 @ 2007/06/26 15:00 (UTC)
• 218.170.175.203 @ 2007/06/28 08:02 & 08:39 (UTC)
• 218.170.170.242 @ 2007/06/29 09:29 & 09:33 (UTC)
• 218.170.177.243 @ 2007/07/04 14:48, 15:00 & 15:15 (UTC)

--百楽兎 07:03, 5 July 2007 (UTC)

Done, 所有IP都为Stargate756所使用 --Shizhao 06:16, 11 July 2007 (UTC)