Wikimedia Meta-Wiki

Steward requests/Checkuser/2013-02

< Steward requests | Checkuser
Latest comment: 11 years ago by Quentinv57 in topic Requests

Requests

Latest comment: 11 years ago55 comments24 people in discussion

Noag070yne@outreach

Status:    Done

as well as

Please consider checking if these are related and if the underlying IP addresses/open proxies can be blocked. Mathonius (talk) 14:55, 1 February 2013 (UTC)

Yes, they're spambots. I can't find any blockable range. They all come from different ranges; although it's confirmed that they're spambots via other technical evidence. Locking all. -- MarcoAurelio (talk) 16:22, 1 February 2013 (UTC)
I'd recommend setting some restriction on user creation over there. Most of the local user creations there are spambots. -- MarcoAurelio (talk) 16:30, 1 February 2013 (UTC)
Create a blacklist? Kevin Rutherford (talk) 21:45, 2 February 2013 (UTC)

[email protected]

Status:    Done
List of users
Collingwood (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Poetlister (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): Collingwood has self-nominated as a Bureaucrat on English Wikiversity. Discussion has queried whether Collingwood is an account used by globally banned user Poetlister. -- Jtneill - Talk 02:18, 24 January 2013 (UTC)
Poetlister is   Stale

. --Shizhao (talk) 06:54, 24 January 2013 (UTC)

Did Poetlister have other accounts? Some of them may be still active. Ruslik (talk) 12:44, 24 January 2013 (UTC)
Yep, he does: link #1 & #2. Keeping this open for now pending an official reply. Trijnsteltalk 23:07, 24 January 2013 (UTC)

  Done. Positive. Account globally locked as per Requests for comment/Global ban for Poetlister. --Millosh (talk) 22:41, 1 February 2013 (UTC)

Thanks for your help. Is someone able to explain a little more how this was confirmed, given that the Poetlister IP was stale? -- Jtneill - Talk 11:07, 4 February 2013 (UTC)
Presently, I am not able to disclose the details. But, I think that the details will be presented in the next couple of weeks. --Millosh (talk) 16:29, 16 February 2013 (UTC)

[email protected]

Status:    Done

All of these spambots belong to this group and haven't been locked yet. Please consider investigating and locking them. Thanks, Mathonius (talk) 21:10, 4 February 2013 (UTC)

Related in some cases, but can't think of a range, but they are locked. — T. 06:27, 5 February 2013 (UTC)

two [email protected]

Status:    Done

Completely same spam pattern(Third account is just for reference). Please consider investigating and locking. Thank you, Sotiale (talk) 04:19, 10 February 2013 (UTC)

The following account are   Confirmed and locked:
EugeniaVi
OlauBinkl
MaribelBr
WilsonZar
MarlaVale
WillardCo
SonjaCaste
Ruslik (talk) 15:24, 10 February 2013 (UTC)

大纱布@zhwiki

Status:    Done
List of users
大纱布 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
妈陪搞 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
田伟博 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): Activities of the two account are very similar to this. The user(s) seem to be engaging in disruptive editing by removing content in a non-NPOV way using multiple accounts. The evidence is that these accounts remove the traditional Chinese - simplified Chinese conversion code in articles in an identical way. Please see if there are any more sleeper accounts. These accounts seem to be disposed after a few days of editing. Regards.--維基小霸王 (talk) 10:54, 10 February 2013 (UTC)

[email protected]

Status:    Done
List of users
Footwiks (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Kyumma (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Boojanam01 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Wikipoliceman (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Wikiholicman (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Pfrd (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Temwikier (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): On discussion about page related to soccer, Kyumma appears and supports Footwiks opinions. Because Kyumma's account creation is new, highly suspected by community. Local consensus reached and Footwiks agrees himself checkusing[1]. please see local discussion, thank you. Sotiale (talk) 11:42, 13 February 2013 (UTC)
Footwiks and Wikiholicman are   Confirmed.
Kyumma is   Inconclusive, rest are   Stale. --Bencmq (talk) 13:43, 13 February 2013 (UTC)

[email protected]

Status:    Done
List of users
Herzbrennen (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Rigoletto (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): User:Herzbrennen create some articles which violate copyrights and User:Rigoletto edit those articles immediately after User:Herzbrennen's creating articles, adding a {{publish}} tag and let the copyvio articles appear on the main page of the site. Purpose of checking is to confirm whether User:Rigoletto is a sock-poppet of User:Herzbrennen or not as he use publish tag incorrectly. I suspect they are sock-poppet as User:Rigoletto had quick action after User:Herzbrennen work. Also, please help checking whether there are any more sock-poppet account, and list them out if available. --HWChat - zhwp 14:38, 14 February 2013 (UTC)
  Confirmed--Vituzzu (talk) 14:51, 14 February 2013 (UTC)

而我不知道啥皮九是誰@zh.wikipedia (2)

copy/pasted from section 而我不知道啥皮九是誰@zh.wikipedia above

Status:    Done
Some more:
Impersonation and vandalism. --Makecat 05:01, 24 January 2013 (UTC)
Add:

--Shizhao (talk) 06:19, 24 January 2013 (UTC)

New ones:
--Makecat 07:26, 25 January 2013 (UTC)
  Done you have all the accounts. I am not sure what a CU especially proves, beyond it looks like a couple of different users abusing the system from several ranges of IP addresses. — billinghurst sDrewth 11:58, 18 February 2013 (UTC)

[email protected]

Status:    Done

Hitshelps was blocked for 3 months, because he repeatedly added incorrect information, created hoax articles and replacing images with unrelated ones. After his block, several very similar accounts appeared. According to w:Wikipedia:Sockpuppet investigations/Hitshelps on English Wikipedia, it's possible that Hitshelps used the account 王明毅. This user may also related to #而我不知道啥皮九是誰@zh.wikipedia (2) above. --Makecat 05:07, 1 February 2013 (UTC)

[email protected]

Status:    Done
List of users
POTTER6278 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
PAN6278 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): They are very similar.For example, The accounts has "6278", and they made the same speechs and editons.What the most important is when the "POTTER6278" has been blocked, the "PAN6278" was created.
Yes, they look directly related. — billinghurst sDrewth 12:11, 18 February 2013 (UTC)

Katharina

Status:    Done

There's a non-sul account/spambot named "Katharina". So far, it has spammed at nl.wikibooks and en.wikiversity. I'd like to know if the other recently created accounts with this username are related. Mathonius (talk) 23:14, 15 February 2013 (UTC)

  Done at enwikiversity and nlwikibooks. I sent the results on the checkuser mailing list. However, I'm not comfortable with blocking/checking the other ones right now, because we lack data and proofs. Regards, -- Quentinv57 (talk) 08:41, 16 February 2013 (UTC)

Fexinshenfd@... & [email protected]

Status:    Done

These spambots from the English Wikiversity are obviously related, judging by their usernames and the way they've tried to spam. Are there any open proxies or IP addresses here that can be blocked? Mathonius (talk) 13:26, 17 February 2013 (UTC)

  Confirmed and   Locked. Ruslik (talk) 19:35, 17 February 2013 (UTC)

愛莎@zh.wikipedia

Status:    Done
List of users
愛莎 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
義茜 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
魯塔利 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
友鼠 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
諾卜 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
文學主子 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
鄧子謙 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
法蘭克斯洛斯 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Unfairking (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
124.244.81.243 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): Editing similar entries, and similar destruction. 乌拉跨氪 (talk) 16:34, 18 February 2013 (UTC)
文學主子 and Unfairking are   Stale. Other account that are   Confirmed include:
Fuhp2009
春卷柯南
北極企鵝觀賞團
陳麗珍告狀英國威廉
Kiddy 19822003
SoHome
Horaceho
Flowers kingdom
Jackac
奇俐
義茜
傑樂
友鼠
愛莎
獵奔
TYC
YWong
Kayat941183
陳麗珍皇后法國亨利王帝
Izumiakazawa
陳麗珍王后英國帥王安德魯
Makivan1234567890
陳麗珍東皇后
陳麗珍帥后湯魯告斯帥王
陳麗珍瑞典皇后
陳麗珍西王后
Brucewong
Phatomof
宇宙滾豆
Wilsonyung
稀兔
魯塔利
諾卜
舒特
酷爪虎
Apple v
SunnyHUANGXiaolin
法蘭克斯洛斯
鄧子謙
Marvel Avengers Alliance
Ruslik (talk) 14:58, 19 February 2013 (UTC)
Seriously? Well, 春卷柯南 and 北極企鵝觀賞團 should not be the same person. Maybe they are sharing the same mobile public IP or whatever.--Yhz1221 (talk) 19:45, 19 February 2013 (UTC)
And TYC, Jackac, SoHome etc.--Shizhao (talk) 02:57, 20 February 2013 (UTC)
All accounts mentioned by you share exactly the same IP address (apparently a Wi-Fi hotspot in Hong Kong). Their UAs heavily overlap. So, from the CU point of view they are virtually indistinguishable. Ruslik (talk) 10:09, 20 February 2013 (UTC)
see en:Wikipedia:Sockpuppet investigations/Marxistfounder，Kayat941183 here--Shizhao (talk) 02:45, 20 February 2013 (UTC)

[email protected]

Status:    Done
List of users
Copyangry7fcvc (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Keysagain148 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Plusspacere (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
36.236.50.212 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): Editing similar entries with similar destructions. --Yhz1221 (talk) 07:41, 19 February 2013 (UTC)
The following accounts are   Confirmed:
Djruwqqqs
Copyangry7fcvc
Ikaridon
Clerkwheeltrie
Quickbest5t6
Todaythink231499
Keysagain148
Plusspacere
Ruslik (talk) 11:30, 20 February 2013 (UTC)

Kstrjtcols@species

Status:    Done

Are these spambots related? Are there any open proxies that can be blocked? Mathonius (talk) 22:56, 20 February 2013 (UTC)

They are related, but it's not clear whether any of the IPs are open proxies. -- Mentifisto 16:04, 21 February 2013 (UTC)

Impersonator on zh.wikipedia

Status:    Done
List of users
Liangeint-bot (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Liantgient-bot (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Liantgeint-bot (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Lacokat (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Monaperry (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Makehoax (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): These recently created vandanlism-only accounts are very likely to be sockpuppets of the LTA who impersonates zhwiki users on many projects. Previous check: Steward_requests/Checkuser/2013-02#Hitshelps.40zh.wikipedia, Steward_requests/Checkuser/2013-02#而我不知道啥皮九是誰@zh.wikipedia and Steward_requests/Checkuser/2013-02#而我不知道啥皮九是誰@zh.wikipedia (2). Also, please consider lock confirmed socks to prevent further cross-wiki abuse. Makecat 02:27, 25 February 2013 (UTC)
Everyone except Makehoax is confirmed as the same person. Makehoax is a sockpuppet of someone already blocked locally. --Bsadowski1 (talk) 04:12, 25 February 2013 (UTC)

[email protected]

Status:    Done
List of users
Dikirbaratpahang (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Pancungdayung (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Selangorkinimaju (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Aku cunla (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Panasaran di hari mengundi (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): Several new accounts created solely for editing Malaysian politicians' articles. All mix unreferenced controversial information with referenced information. There could be others I missed. ...Aurora... (talk) 08:23, 25 February 2013 (UTC)
The list of   Likely socks:
Dikirbaratpahang
Musimelection001
Pancungdayung
Aku cunla
Anakjebat
Kukukakiku
Coklatbasi
Jeritsenyap
Ameba parasit
Adakah aku UMNO
Panasaran di hari mengundi
Selangorkinimaju is   Possible. Ruslik (talk) 19:14, 25 February 2013 (UTC)
Thanks. ...Aurora... (talk) 06:44, 26 February 2013 (UTC)

[email protected]

Status:    Done

Are these pattern spambots related? Are there any open proxies to be blocked here? Mathonius (talk) 12:00, 26 February 2013 (UTC)

Also found some matching this pattern at Commons and Wikisource:
I've filed a local CU request at Commons, see commons:Commons:Requests for checkuser/Case/Pp91gs82e7. Mathonius (talk) 12:10, 26 February 2013 (UTC)
And also at the English Wikipedia, see en:Wikipedia:Sockpuppet investigations/K8wdfg1y2u. Mathonius (talk) 12:15, 26 February 2013 (UTC)
  Confirmed and   Locked.
Just a classic wave of Chinese spambots.
FYI, here are other related matches : Y8mytt0fj, Wanjq1ha, Bcko106zef -- Quentinv57 (talk) 12:59, 26 February 2013 (UTC)
Retrieved from "https://meta.wikimedia.org/w/index.php?title=Steward_requests/Checkuser/2013-02&oldid=24950702"