Steward requests/Checkuser/2017-10

From Meta, a Wikimedia project coordination wiki
Jump to navigation Jump to search

Requests

Ibdianajohns@hi.wikipedia

शिवम कुमार श्रिवास्तव@hi.wikipedia

Agadirhaha@commons

Tracked in Phabricator:
task T174342
Deferred Deferred to c:COM:RFCU. Hello. Commons has their own CheckUsers, you should request them on their request page. Regards, —MarcoAurelio (talk) 10:03, 26 August 2017 (UTC)
Is this still the case when Phabricator uses www.mediawiki.org for OAuth login? Dispenser (talk) 11:49, 26 August 2017 (UTC)
I cannot really answer that question because I do not know if OAuth logins leave CU trace. I think they don't, but I'll ping @Tgr (WMF) and BDavis (WMF) for clarification. In any case, I think Phabricator administrators can access IP data about users so if there's sockpuppetry problems over there maybe @AKlapper (WMF) and MModell (WMF) will be able to assist. —MarcoAurelio (talk) 09:53, 27 August 2017 (UTC)
Indeed they don't (although the user had to login to MediaWiki at some point, that you could look up). We can add something to the system logs if you think that would be important, feel free to open a phab task about it. Creating MediaWiki log records would be too much effort compared to how rarely it would be useful, IMO. (Also probably not something CUs should have access to, as OAuth authentication can be used for third-party logon and whatnot.) --Tgr (WMF) (talk) 20:26, 27 August 2017 (UTC)
Phab administrators can access IP data of users. If anything is wanted, please elaborate. In the case of Agadirhaha, I can see several IPs but no other users who used these exact IPs (might be WP0 anyway). Based on behavior in Phab I pesonally believe that mw:User:Vaporitoo, mw:User:Monadamat_almajanyat, mw:User:Said_raz, mw:User:Samurai_rider, mw:User:About_spindab, mw:User:Adriano_gagazoo, mw:User:Vampire_dracula, mw:User:Darcula, mw:User:Wikishopia, mw:User:Milanooooooooo, mw:User:Disponsable, mw:User:Skillboy_ghost are sock puppet accounts. --AKlapper (WMF) (talk) 10:25, 28 August 2017 (UTC)
I'll have a look at those on mediawiki. —MarcoAurelio (talk) 10:33, 28 August 2017 (UTC)
There are not conclusive results at mediawiki. They might be sockpuppets based on what they do, but so far the only connection I see is continental procedence, which is not much. The ranges are also crowded to do a safe IP range block. If someone else with more experience does want to have a look, feel free. —MarcoAurelio (talk) 11:27, 28 August 2017 (UTC)
@MarcoAurelio: Can you confirm any of Aklapper's previously seen /16 ranges? Dispenser (talk) 13:49, 3 September 2017 (UTC)
I've filed a phabricator task. Cleaning up phabricator requires console commands which is why a /8, /11s, and /12s are blackholed, but they still somehow got through two filters. Dispenser (talk) 13:04, 28 August 2017 (UTC)
Closing as done, no further action needed here. – Ajraddatz (talk) 18:58, 15 October 2017 (UTC)

Cont Periculos@ro.wikipedia

Yes check.svg Done @Victor Blacus: all accounts are  Confirmed. The following confirmed accounts are still unblocked: Cont Periculos, Cont Vechi, and Cont Nou. If you block the accounts with autoblock, it will block the two IPs being used. – Ajraddatz (talk) 17:37, 7 October 2017 (UTC)

Cont Deblocat@ro.wikipedia

Yes check.svg Done @Victor Blacus: All these accounts are  Confirmed socks. I also found few more - Cont Pescuit, Cont_Provocator, Hqflforshglh, Jvxvcrqvn and Gjti that are unblocked. --Pmlineditor (t · c · l) 10:32, 13 October 2017 (UTC)
Thanks! -- Victor Blacus (talk) 11:13, 13 October 2017 (UTC)

Shivam artistss@hi.wikipedia

 Confirmed as well as Shiwam Kumar (Actor), Shiwam--(Hindu Actor), Shiwam Kumar Shrivastava, Shiwam Kumar Shriwastawa, Redirected name, Draft Shiwam Kumar, Shiwam-Kumar-Shriwastaw24, Shivam-- (Actor)--sks, HGVioo, GrX this part post, Shhiwam Kumaar, Television Graff pvtd, Megha punjaa, Shivam Sriwashtav official, SF dpoje, बहु लक्ष्मी, Shivam Srivastav, Alisha was, Shivam Kumar Srivastav, Shivam Kumar Shrivastava, Shiwam - Indian Actor, Shiwam Kumar Sriwastaw (TV Actor). It is related to en:Wikipedia:Sockpuppet_investigations/Shiwam_Kumar_Sriwastaw/Archive. Ruslik (talk) 18:05, 15 October 2017 (UTC)

Sci-fi-@en.wikiversity 2

Adding new disruption on meta:
Creating a new account here in order to show multi-user support is classic sock puppetry. If Logos is back is actually w:User:Logos, when Logos is not blocked on meta, nor anywhere, in fact, is sock abuse. Because this LTA often impersonates others, this cannot be seen as showing actual abuse by Logos.
As well, if "Guerrilla Skepticism member" is an actual active Wikipedian working with GSOW, an organization promoting "skepticism on Wikipedia," this would also be abusive socking. I would think that legitimate GSOW members would avoid anything like that. No claim is made of any GSOW abuse on the pages under attack or here. The sock master either lies about affiliations, or there is an even deeper problem, not to be addressed here. This report is only about possibly abusive socking, here or anywhere in the WMF family. --Abd (talk) 18:25, 15 October 2017 (UTC)
Abd is perm blocked on Wikipedia. He is not an admin or check-user here but pretends to be one. He now uses Wikimedia to write slander and false allegations about Wikipedia users he does not like [1]. He makes allegations but does not use check-user data. He has no evidence linking any of the above accounts to AngloPyramidologist or Logos. Why does he have two pages attacking Wikipedia users? He accuses innocent users of impersonation and owning socks they do not own. This is abuse. Bruce Canada (talk) 16:59, 15 October 2017 (UTC)
Btw this is not a fair check-user request. It is clear some of the accounts above are indeed the same person i.e. "Abd stop stalking people", "Why are you reviving all this i will not tolerate it", "I run away in a desert" etc which were active only recently. These belong to a user like myself who Abd has been harassing. Of course an exact match will occur on those accounts I suspect because they were likely editing from the same IP. But you will not individually check all the above old accounts such as Rome Viharo WWHP, that is an old account that will come up stale. But 100$ dollars says the check-user will match three of these recent accounts and then claim all of the accounts including the old unrelated accounts are all the same person. It is easy to just say that but, Wrong. I have every reason to believe at least four different people are responsible for the above accounts. Btw one of the above accounts was mine. Bruce Canada (talk) 17:16, 15 October 2017 (UTC)
  • I assume that stewards know what they are doing, and I hope that they will be careful, and specific, i.e., between definitive identification and possible relation. Behaviorally, all but one of the reported socks could be locked, but that's not my decision and this is not a lock request. --Abd (talk) 18:25, 15 October 2017 (UTC)
I (and some others) have done these checks. All but Bruce Canada are  Confirmed on the same IP. There is no technical evidence that Bruce Canada is related to the other accounts, though I wouldn't expect any with the type of IP he was using. – Ajraddatz (talk) 19:08, 15 October 2017 (UTC)
In discussing it with Ajraddatz, we have found that Bruce Canada is indeed connected to Guerrilla Skepticism member, Logos is back, Logos Tumbleman Manul Abd Jamenta Dan Skeptic, Muslim atheist, Big Bang happened and is a fact etc so there is technical evidence enough for Likely Likely at least. RadiX 20:27, 15 October 2017 (UTC)
Out of caution, please explicitly confirm, if possible, the relatedness of the account below, which appears to be an account impersonating a real person who operates a blog called WWHP, and known to be a long-term target of this sock family.
Given the duck test, "likely" is good enough here for us to assume connection, if not identity. --Abd (talk) 21:19, 15 October 2017 (UTC)
Unfortunately, CU data on that account will be Stale by now. RadiX 21:28, 15 October 2017 (UTC)
  • Yes check.svg Done Thanks. --Abd (talk) 22:03, 15 October 2017 (UTC)

Aydinsalis@az.wikipedia

I've checked the accounts, and there is only very weak technical evidence connecting some to others. Afrasiyab and Xananxanxana are Likely Likely. The rest jump between multiple mobile ranges. You'll need to block based on behavioural evidence, I'm afraid. – Ajraddatz (talk) 19:19, 18 October 2017 (UTC)
Thanks Ajraddatz. --Sortilegus (talk) 19:41, 18 October 2017 (UTC)

शिवम कुमार श्रीवास्तव - अभिनेता@hi.wikipedia

What I posted here might be better off brought to Commons and/or enwiki, but I'm posting here just for reference. On enwiki, the article Kundali Bhagya has been persistently added images of Kundali Bhagya, which then get deleted (from Commons) for copyright violation. Examples:
  1. Addition by Amzon-net india: 1, delink due to Commons deletion: 2
  2. Addition by Kundali Bhagya: 1, delink due to Commons deletion: 2
As for Commons, Kundali Bhagya 2017.jpg, Kundali-Bhagya.jpg and Kundali Bhagya.jpg are the ones that got repeatedly uploaded by Shiwam's socks. Also notable is that all these three accounts listed have several contributions at Commons, but almost all of them have been deleted.
So there have been some accounts keep uploading the same image at commons, and in the mean time putting them to enwiki. -★- PlyrStar93. Message me. 01:13, 24 October 2017 (UTC)
All  Confirmed as belonging to the same LTA. No sleepers found. RadiX 01:45, 24 October 2017 (UTC)

Bertrand101@ceb.wikipedia

 Confirmed. Also found: DYMA-AM. RadiX 02:05, 24 October 2017 (UTC)

Various Impersonator@th.wikipedia

Symbol wait.svg Doing... Ruslik (talk) 19:51, 30 October 2017 (UTC)
All accounts appear to be blocked. I did not find any master account. Ruslik (talk) 20:02, 30 October 2017 (UTC)
https://meta.wikimedia.org/wiki/Steward_requests/Checkuser/2017-10
meta.wikimedia.org
crawl=CC-MAIN-2021-49
271123
application/http; msgtype=response
sha1:HREAFVOKOLTGWUM3FQLSCRYAKQI3WNF7
<urn:uuid:da0eb615-aa31-4845-a145-a182d4e2ab17>
2021-12-05T09:26:34Z
208.80.154.224
text/html
sha1:2GCMIJXLKHU37KJTTZNWM7VUH2Q2XVB6
<urn:uuid:628a3526-d324-4b22-bda2-486cb3d43d14>
https://meta.wikimedia.org/wiki/Steward_requests/Checkuser/2017-10
response
<urn:uuid:94b4a75e-7dc2-46a0-8b47-6c74829b3b1a>
isPartOf: CC-MAIN-2021-49
publisher: Common Crawl
description: Wide crawl of the web for November/December 2021
operator: Common Crawl Admin (info@commoncrawl.org)
hostname: ip-10-67-67-45
software: Apache Nutch 1.18 (modified, https://github.com/commoncrawl/nutch/)
robots: checked via crawler-commons 1.3-SNAPSHOT (https://github.com/crawler-commons/crawler-commons)
format: WARC File Format 1.1
conformsTo: https://iipc.github.io/warc-specifications/specifications/warc-format/warc-1.1/