Commons:Requests for checkuser

Shortcuts: COM:CHECK· COM:RFCU· COM:SOCK This is the place to request investigations of abuse of multiple accounts or of other circumstances that require use of checkuser privileges. Requesting a check These indicators are used by CheckUsers to allow easier at-a-glance reading of their notes, actions and comments. Request completed Confirmed Likely  Possilikely Possible Unlikely Inconclusive Unrelated Stale Request declined Declined Checkuser is not for fishing. Checkuser is not magic pixie dust. The CheckUser Magic 8-Ball says  It looks like a duck to me Checkuser is not a crystal ball. Information Additional information needed Deferred to  Doing…  Info Please do not ask us to run checks without good reason; be aware of the following before requesting a check: Checkuser is a last resort for difficult cases; pursue other options first, such as posting on the administrator's noticeboard. Running a check will only be done to combat disruption on Commons, or as required to assist checkuser investigations on other Wikimedia wikis. Valid reasons for running a check include, for example: vandalism where a block of the underlying IP or IP range is needed and suspected block evasion, vote-stacking, or other disruption where technical evidence would prevent or reduce further disruption. Evidence is required. When you request a check, you must include a rationale that demonstrates (e.g., by including diffs) what the disruption to the project is, and why you believe the accounts are related. Requests to run a check without evidence or with ambiguous reasoning will result in delays or the request not being investigated. The privacy policy does not allow us to make a check that has the effect of revealing IP addresses. Requests to run a check on yourself will be declined. Outcome Responses will be brief in order to comply with Wikimedia privacy policy. Due to technical limitations, results are not always clear. Closed requests are archived after seven days. Privacy concerns If you feel that a checkuser request has led to a violation of the Wikimedia Foundation privacy policy regarding yourself, please refer the case to the Ombudsman commission.

If this page is displaying outdated contents even after you refresh the page in your browser, please purge this page's cache.

To request a check: Cases are created on subpages of Commons:Requests for checkuser/Case. Creating a request Insert the name of the suspected sockpuppeteer (the main account or puppetmaster, not the sockpuppet!) in the box below, leaving out the "User:" prefix. Do not remove the text in the box, add to the end only. Please explain/justify the request by saying what it is you suspect and why it is important that the check be carried out. Indicate the usernames you suspect, using {{checkuser}}. Please do not use this template in the section header, as that makes it difficult to read the account names. Include the diffs or links required to support the request and reason for it. There are people to assist you and help with maintenance of the page. Just ask for help on the admin noticeboard if you really are stuck, or take your best shot and note that you weren't completely sure of what to say. If a case subpage already exists, edit the existing page instead, either adding to the currently open section (if the case is not yet archived) or adding a new section to the top (if the case has been archived). When editing an existing case, be sure to list/transclude the subpage here. Example If you want to request a checkuser on User:John Doe, enter the text Commons:Requests for checkuser/Case/John Doe then click "Request a checkuser." You will be taken to a page where you can fill out the request. Please make your request there brief and concise. Then transclude your subpage on the top of the list at Commons:Requests for checkuser and remove {{Checkuser requests to be listed}} from the top of the case subpage.

Requests

Sealle

view • edit • history • watch
Filed: 13:59, 12 March 2020 (UTC)

• Sealle (talk • contribs • Luxo's • SUL • deleted contribs • logs • block user • block log • checkuser)

Suspected related users

• 1.129.105.244 (talk • contribs • WHOIS • RBL • tools • luxo's • crossblock • block user • block log • checkuser)
• 1.144.106.243 (talk • contribs • WHOIS • RBL • tools • luxo's • crossblock • block user • block log • checkuser)
• 1.129.108.27 (talk • contribs • WHOIS • RBL • tools • luxo's • crossblock • block user • block log • checkuser)
• 1.144.110.8 (talk • contribs • WHOIS • RBL • tools • luxo's • crossblock • block user • block log • checkuser)

Rationale, discussion and results

Reason: This IP troll reverted Bidgee, which was exactly what Sealle wanted. Sealle also reverted Bidgee to a revision by one of the IPs.

See Commons:Administrators' noticeboard#User:Sealle. I personally haven't had many interactions with Sealle, I don't know them very well, I can't say if Sealle is actually behind the IPs. But I have seen so much stupid shit in my time here (including LTA admins and trolls reverting themselves) that I think a CU is warranted, even if only to clear the air. - Alexis Jazz ^{ping plz} 13:59, 12 March 2020 (UTC)

Nah, this is just too much. I'd say the master of those IPs is the cross-wiki vandal The Biggest Critic. I think this is proof enough that the vandal is behind the harassment, not Sealle. Unless you're saying Sealle is the vandal, but I don't think that's possible. pandakekok9 14:16, 12 March 2020 (UTC)

It's most likely the IP took advantage of Sealle's warning and trolled out of it. Both Sealle and Bidgee are victims here. pandakekok9 14:17, 12 March 2020 (UTC)

Quite possible. But I've seen stranger behaviour from trolls. I'm not betting any money on any outcome. - Alexis Jazz ^{ping plz} 15:05, 12 March 2020 (UTC)

• Even if CUs would connect a registered account to an IP address, which they won't, it may be a bit of a stretch to say that a user who speaks Russian and uploads own photos from Moscow is suddenly showing up in Australia. GMG^talk 14:41, 12 March 2020 (UTC)

@GreenMeansGo: been there, done that. Also, if checkusers effectively can't work with IPs, why do we still allow IP-editing? Any registered user could make vandal edits as an IP and never be connected to the main account. Either way, if the IPs and account are unrelated, a CU should be able to state that publicly. If there is a (possible) relation, perhaps the WMF could handle it. - Alexis Jazz ^{ping plz} 15:05, 12 March 2020 (UTC)

Well, the IP was kind enough to vandalize AN enough for me to narrow down a couple ranges. Maybe that solves that at least for a little while. GMG^talk 15:07, 12 March 2020 (UTC)

• Declined: 1) COM:RFCU clearly says "The privacy policy does not allow us to make a check that has the effect of revealing IP addresses"; 2) Sealle makes no secret about being in Russia; checking against Austrialian IPs would not be expected to yield useful information; 3) We do not run CUs "to clear the air"; and 4) COM:RFCU also clearly says "Checkuser is a last resort for difficult cases; pursue other options first" Ephemeral trolling by throw-away IPs is not a "difficult case," and I see no genuine attempt to consider other options. Эlcobbola _talk 15:07, 12 March 2020 (UTC)

@Elcobbola: why does the form even allow adding IPs if you can't do anything with them? Also, aren't you allowed to run such checks and report any found abuse directly to the WMF without making any result public? (I'm asking, I'd think this would be allowed) - Alexis Jazz ^{ping plz} 16:30, 12 March 2020 (UTC)

IPs can provide us with additional behavioural evidence; IPs can assist in determining historical ranges, and appropriate ranges for range blocks; etc. You conflate a mere inability to connect publicly an IP to an account with inability to "do anything with them." Information is not devoid of utility merely because it has aspects that flow only in one direction. Your request was declined for multiple reasons; we, of course, could non-publicly report abuse through appropriate channels. Эlcobbola _talk 17:02, 12 March 2020 (UTC)

Alright, clear. I was just curious. - Alexis Jazz ^{ping plz} 21:43, 12 March 2020 (UTC)

@Elcobbola: Maybe I was overcautious filing this request. Or maybe we'll regret at some point not having done this check. I just don't know, but I accept the request being declined. I'll note however: the first reason to decline shouldn't be a reason to decline, only a reason not to make any results public. The second reason is not so good, if there is abuse, it would make perfect sense. It would possibly even make it easier to confirm whether or not there is a relation. The third reason, I'll give you that one. The fourth reason, I disagree. I don't think this is "ephemeral" ("something which lasts for a short period of time", interesting word choice), this troll knew exactly how to push everyone's buttons. This is not a bored high school kid who just discovered Commons. No way. They severely upset Bidgee (who I hope won't leave forever) and managed to get Sealle to walk right into their trap (assuming Sealle is not the troll), the consequences of which are not yet clear but depending what Sealle says next could, worst case, eventually lead to a desysop. No unexperienced troll achieves that. - Alexis Jazz ^{ping plz} 12:43, 13 March 2020 (UTC)

This isn't an inexperienced troll; it's a cross wiki troll that followed them here from English Wikipedia [1]. Their en.wiki talk page was protected 10:59, 11 March 2020, and the disruption on their Commons talk page began at basically the same time. GMG^talk 13:06, 13 March 2020 (UTC)

Tchahal1979

view • edit • history • watch
Filed: 10:50, 11 March 2020 (UTC)

• Tchahal1979 (talk • contribs • Luxo's • SUL • deleted contribs • logs • block user • block log • checkuser)

Suspected related users

• Gchahal2020 (talk • contribs • Luxo's • SUL • deleted contribs • logs • block user • block log • checkuser)

Rationale, discussion and results

Reason: Users uploading the same or similar images. Ankry (talk) 10:50, 11 March 2020 (UTC)

I call this technically Inconclusive. --Krd 12:08, 11 March 2020 (UTC)

Davey01

view • edit • history • watch
Filed: 19:53, 8 March 2020 (UTC)

• Davey01 (talk • contribs • Luxo's • SUL • deleted contribs • logs • block user • block log • checkuser)

Suspected related users

• Gracey0121 (talk • contribs • Luxo's • SUL • deleted contribs • logs • block user • block log • checkuser)
• Ellie1021 (talk • contribs • Luxo's • SUL • deleted contribs • logs • block user • block log • checkuser)
• Andy 23xx (talk • contribs • Luxo's • SUL • deleted contribs • logs • block user • block log • checkuser)

Rationale, discussion and results

Reason: Suspected block evasion. Same behavior of bulk uploading unfree images of stadiums. Please check for sleepers. --Achim (talk) 19:53, 8 March 2020 (UTC)

• Declined - The suspected sock, Gracey0121, is already blocked as such. We can't just "check for sleepers"; that is fishing. What are unblocked suspected users to be checked, and what is the related evidence? Эlcobbola _talk 14:33, 9 March 2020 (UTC)

Davey01 is now blocked for 2 months. If they would be confirmed that should be extended to indef. That's why I did ask. --Achim (talk) 16:58, 9 March 2020 (UTC)

Adding one more sockpuppet Ellie1021 is adding similar copyvio photos of stadiums and editing in the same cartegory of en-wiki articles. Ytoyoda (talk) 16:53, 10 March 2020 (UTC)

• Confirmed that Ellie1021 = Davey01, also Georgiap2020 and Abbyavfc01. Эlcobbola _talk 17:05, 10 March 2020 (UTC)

Adding one more sockpuppet Andy 23xx also recently uploaded copyrighted aerial pictures of stadium and claimed that was "own work".--QTHCCAN (talk) 17:49, 10 March 2020 (UTC)

• As a technical matter,  Possilikely that Andy 23xx is Davey01, et. al., but Confirmed that Andy 23xx = Georgie 20. That all of these are related:  It looks like a duck to me. Эlcobbola _talk 18:04, 10 March 2020 (UTC)

---

For older requests, please see Commons:Requests for checkuser/Archives