Commons:Requests for checkuser

From Wikimedia Commons, the free media repository
Jump to navigation Jump to search

Shortcuts: COM:CHECK • COM:RFCU • COM:SOCK

This is the place to request investigations of abuse of multiple accounts or of other circumstances that require use of checkuser privileges.

Requesting a check

These indicators are used by CheckUsers to allow easier at-a-glance reading of their notes, actions and comments.
Request completed
Confirmed  Technically indistinguishable
Likely  Possilikely
Possible Unlikely
Inconclusive Unrelated
 No action Stale
Request declined
Declined Checkuser is not for fishing
Checkuser is not magic pixie dust. 8ball The CheckUser Magic 8-Ball says
 It looks like a duck to me Checkuser is not a crystal ball.
Information
Additional information needed Deferred to
 Doing…  Info

Please do not ask us to run checks without good reason; be aware of the following before requesting a check:

  1. Checkuser is a last resort for difficult cases; pursue other options first, such as posting on the administrator's noticeboard. (This is not a venue for requesting administrative action such as blocks or file clean-up.)
  2. Running a check will only be done to combat disruption on Commons, or as required to assist checkuser investigations on other Wikimedia wikis.
    • Valid reasons for running a check include, for example: vandalism where a block of the underlying IP or IP range is needed and suspected block evasion, vote-stacking, or other disruption where technical evidence would prevent or reduce further disruption.
    • Requests to check accounts already confirmed on other projects may be declined as redundant.
    • Requests to run a check on yourself will be declined.
  3. Evidence is required. When you request a check, you must include a rationale that demonstrates (e.g., by including diffs) what the disruption to the project is, and why you believe the accounts are related.
    • Requests to run a check without evidence or with ambiguous reasoning will result in delays or the request not being investigated.
  4. The privacy policy does not allow us to make a check that has the effect of revealing IP addresses.

Outcome

Responses will be brief in order to comply with Wikimedia privacy policy. Due to technical limitations, results are not always clear. Closed requests are archived after seven days.

Privacy concerns

If you feel that a checkuser request has led to a violation of the Wikimedia Foundation privacy policy regarding yourself, please refer the case to the Ombuds commission.

If this page is displaying outdated contents even after you refresh the page in your browser, please purge this page's cache.

To request a check:

Cases are created on subpages of Commons:Requests for checkuser/Case.

Creating a request
  • Insert the name of the suspected sockpuppeteer (the main account or puppetmaster, not the sockpuppet!) in the box below, leaving out the "User:" prefix. Do not remove the text in the box, add to the end only.
  • Please explain/justify the request by saying what it is you suspect and why it is important that the check be carried out. Indicate the usernames you suspect, using {{checkuser}}. Please do not use this template in the section header, as that makes it difficult to read the account names. Include the diffs or links required to support the request and reason for it.
  • There are people to assist you and help with maintenance of the page. Just ask for help on the admin noticeboard if you really are stuck, or take your best shot and note that you weren't completely sure of what to say.
  • If a case subpage already exists, edit the existing page instead, either adding to the currently open section (if the case is not yet archived) or adding a new section to the top using {{subst:Commons:Requests for checkuser/Inputbox/Sample}} (if the case has been archived). When editing an existing case, be sure to list/transclude the subpage here.
Example
If you want to request a checkuser on User:John Doe, enter the text Commons:Requests for checkuser/Case/John Doe then click "Request a checkuser". You will be taken to a page where you can fill out the request. Please make your request there brief and concise.


Then transclude your subpage on the top of the list at Commons:Requests for checkuser and remove {{Checkuser requests to be listed}} from the top of the case subpage.

nothing found

Requests[edit]

Arado Ar 196[edit]

Suspected related users[edit]

Rationale, discussion and results[edit]

Reason:Appeared from the nowhere and started arguing with me.

The alleged sock puppet account was created on August 27, the alleged sock puppeteer stopped contributing on August 21.
Both users seem to be interested in military aircraft Kelly The Angel (talk) 09:51, 19 September 2023 (UTC)Reply[reply]

Moonrivers[edit]

Suspected related users[edit]

Rationale, discussion and results[edit]

Reason: The sockmaster has previously been blocked several times on Commons ([1], [2], [3], [4]), with the longest period for uploading unfree files being a one year block.

The majority of the sockmaster's activity on Wikimedia projects has been on Wikimedia Commons. Here, the user has taken up the task of creating svgs of logos. I was patrolling on Commons when I noticed that some of the logos had copyright problems, and I was a bit surprised when I saw that so many of the logos had been added to articles on EnWiki even though their creator was blocked.

Lo and behold, I encountered the apparent sock account, Jamil.V.Estorninos who seems to also have an interest in corporate logos. The account's most recent 500 undeleted contributions on the English Wikipedia (i.e. all of their undeleted contributions) seem to be very larely focused on adding images/logos to articles. I've taken a sample of ten out of their most recent 50 edits to EnWiki, and all edits in the sample involved doing so.

But, not only does it involve adding just any images to Wikipedia, but all of those images appear to have been created/edited by Moonrivers right before they were placed by the sockpuppet on EnWiki:

  1. This edit adds File:Haus Labs logo.svg to an article a mere two minutes after the image's creation.
  2. This edit adds File:Encyclopaedia Brittanica Inc logo.svg to an article a mere 5 minutes after the image's creation
  3. This edit adds File:TCB&TL_wordmark.svg a mere four minutes after the image's creation.
  4. This edit adds the (now-deleted) File:Chuck-E-Cheese_new_logo.svg to an article a mere 8 minutes after the logo was created.
  5. This edit adds File:Swarovski new logo.svg to an article a mere three minutes after the logo was created.
  6. This edit adds File:PDEA seal.svg to an article less than ten minutes after the seal was posted to Commons.
  7. This edit adds File:National Economic and Development Authority (NEDA).svg to an article a mere 12 minutes after that image had been edited by the sockmaster.
  8. This edit adds File:Avatar franchise logo.svg to an article a mere five minutes after the vector file was uploaded to Commons by Moonrivers.
  9. This edit adds File:Seeker new logo.svg a mere three minutes after the vector was uploaded to Commons.
  10. This edit adds File:BoysTown logo.svg to an article within ten minutes of the final version being uploaded to Commons by the sockmaster.

What's more, the sockpuppet created their global account a mere three days after the master was first blocked for three months.

This appears to be way more overlap than would be expected for mere coincidence. Indeed, this appears to be a pretty convincing behavioral case that we've got some sort of coordination between the two accounts: the master (who is on their last chance for copyright violations) appears to be creating the images, and the sock appears to be placing the images on the English Wikipedia.

Because the master account has a history of being blocked for copyright violations, this appears to be evasion of scrutiny as to their uploads, and several of the sockpuppet's uploads have been deleted or nominated for deletion as copyright violations. There also would have been historical block evasion, as the account made edits to Commons when Moonrivers was blocked here (I note this only as an aside, since it is not ongoing). Because of this, I am requesting checkuser to evaluate the extent of technical connection between these two accounts.

The IPs here obviously cannot be confirmed publicly, but they also appear to be related to this; just like the sockpuppet account has a habit of placing Moonrivers-created logos on other projects, so too do they (see: wikidata:Special:Contributions/223.25.62.82 for evidence as to the one IP, and note that the second IP added an image to an EnWiki article that had been uploaded by Moonrivers a mere two minutes prior). I'm including the IPs more for the ease-of-checkuser's sake, since both are within the same range. I would be unsurprised if there were other socks I've missed, or if there's a sleeper or two.

Red-tailed hawk (nest) 21:15, 14 September 2023 (UTC)Reply[reply]

I've done a bit more auditing; it looks like 203.189.119.110 and 203.189.119.115 have been active on Wikidata with a heavy focus on adding logos created by Moonrivers to relevant items very shortly after the logos were uploaded. Again, not abusive on Commons, so not asking for a check of it, but I'm noting it for posterity and completeness sake. — Red-tailed hawk (nest) 04:50, 15 September 2023 (UTC)Reply[reply]

Alizadehzahra4036[edit]

Suspected related users[edit]

Rationale, discussion and results[edit]

Reason: Much like the other users who were confirmed below, this user has uploaded images of a particular individual (compare File:Hadi bagheri damavand summit.jpg, which was uploaded by Bzahra, to versions previously uploaded by the master and previously confirmed socks at File:Hadibagheri 02.jpg, File:Climb to Damavand Peak.jpg, and File:هادی باقری.jpg). All of the images for this sockpuppet appear to be depicting the same man. The account is blocked on Wikidata for block evasion, which ordinarily would give me enough confidence to block, so I will. However, the Wikidata block summary mentions Zahrab1393, a global account not mentioned on Commons, and it looks like there's some evidence of sleepers being associated with this farm.

For these reasons, I am requesting a checkuser conduct a technical investigation of this sock (as well as related ones previously confirmed) to determine if there are any sleepers immediately obvious. I believe that the likelihood of sleepers, as demonstrated by the existence of alternate accounts used by this master on other projects, would make a narrow check narrowly tailored towards preventing future abuse on Commons.

Red-tailed hawk (nest) 04:05, 14 September 2023 (UTC)Reply[reply]

Tokugawanaotora[edit]

Suspected related users[edit]

Rationale, discussion and results[edit]

Reason: They recreated personal photos originally created by Tokugawanaotora, such as File:鈴木博彦.jpg. Checkuser is requested to find more sleepers. Please refer to ja:Category:Tokugawanaotoraの操り人形だと疑われるユーザー and en:Category:Wikipedia_sockpuppets_of_ぽんずめし for currently comfirmed socks. NmWTfs85lXusaybq (talk) 06:53, 14 September 2023 (UTC)Reply[reply]

  • Declined - Accounts are already CU blocked on ja.wiki; results are valid across projects for SUL accounts. Please review COM:RFCU, including "Requests to check accounts already confirmed on other projects may be declined as redundant". Checkuser is not for fishing. Эlcobbola talk 13:04, 14 September 2023 (UTC)Reply[reply]

Johnthemanstan[edit]

Suspected related users[edit]

Rationale, discussion and results[edit]

Reason: Repeated submissions with false licensing info, on overlapping subjects (see related en:Wikipedia:Miscellany for deletion/Draft:Donald Cheney) where this user got IP blocked. JFHJr (talk) 23:48, 13 September 2023 (UTC)Reply[reply]

Also, IP owns these edits, so I'm not outing anyone. JFHJr (talk) 00:16, 14 September 2023 (UTC)Reply[reply]

  • Johnthemanstan has not edited the Commons since 1 May and would thus be Stale. Although therefor moot, no evidence of disruption on the Commons is offered (what "submissions"?); it is not the job of CUs to build cases. Эlcobbola talk 01:49, 14 September 2023 (UTC)Reply[reply]
    Contribs (links in heading) are what I meant by submissions. I don't expect you to build a case, but looking at the pre-loaded links is not out of orbit. One being stale, if there's actually nothing to check here, please go ahead and close. JFHJr (talk) 02:18, 14 September 2023 (UTC))Reply[reply]
    It is, actually. "Repeated submissions with false licensing" describes thousands of uploads per day and is devoid of genuine descriptive value. Is Electricalmotor a sock because they just uploaded a file with false licensing? It is not the duty of CUs to a) divine which files you may be referencing; b) cross-reference them between accounts; and c) determine similarities in style, subject, etc. that may suggest a connection. That is building a case, your job, which was not done. Эlcobbola talk 02:28, 14 September 2023 (UTC)Reply[reply]

Nguyễn Năng Quang[edit]

Suspected related users[edit]

Rationale, discussion and results[edit]

Reason: The master and sock are both similarly named and have uploaded several of the same photographs (File:Mặt trước tờ tiền 100 đồng.jpg and File:Giấy bạc 100.jpg from the master correspond to File:100 Vietnamese Dong 1991 (Front side).jpg from the sock). The master is also tagged on EnWiki as a sockpuppet of Trieu Thuan Son, an account that is probably stale (it's been globally locked since December 2022, so I don't anticipate that there's anything logged on Commons).

The master was blocked on 7 September 2023 for uploading non-free files after warnings. However, the sock has continued to edit after the block on the master has been put in place, which is per se block evasion.

Because of the history of socking here on other wikis, and the apparent connection between the two accounts behaviorally, I am requesting a checkuser examine these accounts to determine the extent of technical connection as well as to see if any sleepers are immediately visible. — Red-tailed hawk (nest) 22:43, 10 September 2023 (UTC)Reply[reply]

APiggingPig[edit]

Suspected related users[edit]

  • Unknown

Rationale, discussion and results[edit]

Reason: This user is very suspicious. They are Chinese, but have no edits at all on the Chinese Wikipedia. Created just a couple of days ago, their first edits were to translate into Chinese the blocking policy of Commons. Later on they requested (unsuccessfully) for autopatrolled and license reviewer rights. Their user page contains a custom userbox that reads: "TA has a global account, he registered in [undefined undefined]. Although TA may be banned on a certain site for making up" (see original Chinese in User:APiggingPig/GlobalUser). The user does know how to edit and knows certain things which make me think they are not a beginner at all. Bedivere (talk) 03:08, 9 September 2023 (UTC)Reply[reply]

  • While I expect that this request will get declined per 'Checkuser is not for fishing' since Bedivere can't supply a suspected sockmaster, I will second that their behavior doesn't seem like a new user, including applying for VRT two days after account creation, and knowing about things like bureaucrats - the kind of inside baseball that it takes a while of mucking around in the project space to learn. The Squirrel Conspiracy (talk) 13:04, 9 September 2023 (UTC)Reply[reply]
  • Checkuser is not for fishing - Please review COM:RFCU, including the very first sentence of "This is the place to request investigations of abuse of multiple accounts", where "abuse" is not "use". Per the Meta Checkuser Policy that governs all projects, "alternative accounts are not forbidden, so long as they are not used in violation of [...] policies". That a new account has the appearances of being a reincarnation is not in and of itself disruptive and is certainly not a basis to run a check. Эlcobbola talk 01:31, 14 September 2023 (UTC)Reply[reply]

Thiago Juliaci[edit]

Suspected related users[edit]

Rationale, discussion and results[edit]

Reason: The account was clearly created to attack me, "pau no cu" means "pain in the ass" in Brazilian Portuguese. Also, they re-uploaded File:Thiago-Juliaci.png.--Kacamata! Dimmi!!! 22:51, 8 September 2023 (UTC)Reply[reply]

  • Thiago Juliaci, and known socks indicated below, has not edited since late 2022 and would thus be Stale (nothing to which to compare Kacamata-paunocu). Kacamata-paunocu is a blatant SPA/PA account and can be, and has been, handled on that basis ("Checkuser is a last resort for difficult cases; pursue other options first"). Эlcobbola talk 13:07, 9 September 2023 (UTC)Reply[reply]


Srabanta Deb[edit]

Suspected related users[edit]

Rationale, discussion and results[edit]

Reason: "User:Radha Krishna Nama" uploaded File:Ramdas Kathiababa.wav 20 mins later "user:Srabanta Deb" added that to bnwiki. Same with other upload of User:Radha Krishna Nama. user:Srabanta Deb is blocked on commons for sock, i am suspecting that they are using this account to bypass block. Also all of uploads of User:Radha Krishna Nama is copyvio. আফতাবুজ্জামান (talk) 13:57, 4 September 2023 (UTC)Reply[reply]

Likely --Krd 04:49, 8 September 2023 (UTC)Reply[reply]


Leonardida87826[edit]

Suspected related users[edit]

Rationale, discussion and results[edit]

Reason: Gyanpansingh uploaded this image to Commons. 2 minutes later, Charmander45 added it to the English Wikipedia. M.Bitton (talk) 18:21, 2 September 2023 (UTC)Reply[reply]

Adeena De[edit]

Suspected related users[edit]

Rationale, discussion and results[edit]

Reason: All spamming the same domains: discountciggs.com (now globally blacklisted) and kcomsolutions.com. There might be sleeper socks. Count Count (talk) 08:30, 31 August 2023 (UTC)Reply[reply]

  • Declined - Hanokin jazz, the only non-blocked account, is Stale. As other accounts are blocked, there is no disruption to be prevented by a CU. Эlcobbola talk 12:51, 31 August 2023 (UTC)Reply[reply]
  • I suggested a RFCU to find dormant accounts. Yann (talk) 19:52, 31 August 2023 (UTC)Reply[reply]

Abayomi01[edit]

Suspected related users[edit]

Rationale, discussion and results[edit]

Reason: The sockmaster has uploaded a good number of images, though some (such as File:Adrian Perez Ramirez.jpg, File:WhatsA Image 202f3-08-25 at 3.23.08 AM (2).jpg, File:Filmfinity.jpg, File:WhatsApp Imag 2023-08-25 at 3.16.53 AM.jpg, etc.) have been deleted for a number of reasons, including copyright and use of commons to advertise. The master was given a warning for uploading out-of scope files the morning (UTC) of 27 August, and was given another warning for advertising at 16:37 that same afternoon. After receiving these warnings, the sockpuppet account was created at 23:15 on 27 August and proceeded to re-upload photos that had previously been uploaded by the master and had been deleted for scope or copyright reasons (i.e. File:Adrian Perez Ramirez (2).jpg, File:Adrian Perez Ramirez (3).jpg, File:WhatsApp Imae 2023-08-25 at 3.23.08 AM.jpg). As such, I suspect that the two accounts are connected in some way.

If these accounts are run by the same individual, this would appear to be a case of evasion of scrutiny on one's own uploads after having received multiple warnings, which would amount to disruption of Commons via the abuse of multiple accounts. As such, I am requesting a checkuser examine these accounts to evaluate the extent of technical connection between them. — Red-tailed hawk (nest) 03:25, 28 August 2023 (UTC)Reply[reply]

These two are likely the same person. However this conclusion is subject to the same caveat as 서울출장 below -- they are two of at least a dozen accounts (including those listed under 서울출장 below) that are likely students at the same institution. While these two quack like the same duck, I doubt that all of them are the same person. I have blocked Gajifast.     Jim . . . (Jameslwoodward) (talk to me) 13:35, 28 August 2023 (UTC)Reply[reply]

Also noting Abayomi43, who was blocked by Mdaniels5757 and was confirmed to master at an EnWiki SPI. I'm indefing the master. — Red-tailed hawk (nest) 03:47, 30 August 2023 (UTC)Reply[reply]
And also Sulitake01, who in their first three uploads re-uploaded an image previously uploaded by master. — Red-tailed hawk (nest) 03:54, 30 August 2023 (UTC)Reply[reply]
Noting that Mariaman81, who joined Commons this morning, is also uploading similar WhatsApp/garbled filenames and another photo of Adrian Perez Ramirez (File:Adrian Perez Ramirez (3).jpg). Belbury (talk) 10:56, 1 September 2023 (UTC)Reply[reply]
I've also blocked Walikomu for doing the same sort of thing as described above.
@Jameslwoodward: Would it be possible for a rangeblock to work here, or would there be too much collateral?
Red-tailed hawk (nest) 14:08, 1 September 2023 (UTC)Reply[reply]
For posterity sake, I'm going to also make note of Ticket:2023083110009876. — Red-tailed hawk (nest) 14:26, 1 September 2023 (UTC)Reply[reply]
Another new sock account at Obaraka2, a few minutes ago. Belbury (talk) 15:16, 4 September 2023 (UTC)Reply[reply]

Uthmanleee[edit]

Suspected related users[edit]

Rationale, discussion and results[edit]

Reason: This is a case of self-promotion where someone tries to create a Wikidata item with portrait photos for themselves, see Q121816191 with a history of previously deleted items. Associated are self-portraits File:Gbolahan.jpg (uploaded by Uthmanleee) and File:Gbolahan 001.jpg (uploaded by Classic28) with the previous upload of File:Gbolahan8.jpg by Gbolahan8. AFBorchert (talk) 15:04, 25 August 2023 (UTC)Reply[reply]

Caution. These four are part of a group of thirty accounts that are probably students at the same institution -- see (Abayomi01 (above) and 서울출장 (below)). Therefore CU can tell you they are related in a way, but I can't confirm that they are the same person -- I doubt that all thirty are the same person, although there are at least a few socks in their number (see above and below). You'll have to apply the duck test with the knowledge that the CU says they may be the same person. .     Jim . . . (Jameslwoodward) (talk to me) 13:59, 28 August 2023 (UTC)Reply[reply]

Thank you, this is helpful. The activities in the cases of Abayomi01 and 서울출장 do not match this case. As far as I can see, the other cases look very much like advertising/paid editing with numerous copyvios while this one appears simply self-promotion which is just out of scope. There is no intersection, at least not in the edits I've access to. I've indef'd Uthmanleee, Gbolahan8, and Classic28 as their single-purpose self-promotion cross-wiki activities support the assumption that these are indeed sockpuppets of the same person. --AFBorchert (talk) 20:42, 28 August 2023 (UTC)Reply[reply]
With respect to The activities in the cases of Abayomi01 and 서울출장 do not match this case, perhaps, but I'm looking at Gbolahan012 (a behavioral+technical sock of 서울출장), and it's very similarly named to Gbolahan8. I feel like we may have adequate reason to suspect that they are indeed related. — Red-tailed hawk (nest) 03:40, 30 August 2023 (UTC)Reply[reply]

서울출장[edit]

Suspected related users[edit]

Rationale, discussion and results[edit]

Reason: The master account has taken all of one action on Commons: uploading an apparently advertorial file (File:피치 메인1.jpg). The file was deleted by Túrelio as an advertisement on 21 August. On 23 August, the sockpuppet created its account on Commons and re-uploaded the same file, repeatedly (see deleted contributions of File:피치 메인1.jpg and File:피치 메인1 (1).jpg). The sockpuppet has also uploaded other file with advertorial description, such as File:Wise loan.png, so it looks like this may well be a spambot. If these accounts are indeed run by the same individual or group, then this would amount to evasion of scrutiny as to the use of Commons to advertise, which is not a permissible use of multiple accounts.

I am requesting checkuser to investigate:

  1. Whether or not these two users are indeed technically connected; and
  2. Whether or not the technical data may be indicative of whether or not these are spambots or simply human-operated users.

Red-tailed hawk (nest) 01:53, 25 August 2023 (UTC)Reply[reply]

All of the following are closely related, using several IP addresses at the same ISP. I can't be sure whether these are sock puppets, meat puppets, or simply students at the same school who are either using the same lab computer or have their own computers all set up in the same way. I raise that possibility because several of them have uploaded nothing but a selfie showing a young person. It's not clear, therefore, that they all should be blocked. I have blocked Kesaritheking because the behavior cited above makes its status clear. Feel free to block others if you think it appropriate.

.     Jim . . . (Jameslwoodward) (talk to me) 14:39, 25 August 2023 (UTC)Reply[reply]

Thank you for running this check.
  1. I'm at least also going to block Gbolahan012; their contributions look similarly advertorial to the master and I'm fairly confident that these are the same people.
  2. Also of note: both File:Olanrewaju Rodiat.png was uploaded twice by two different users within three days of each other: Adeyemo Taoheed (not in the list above) and Ridypage. The former is blocked for scope issues, and is blocked on several other wikis for spam/advertising. The two accounts also both uploaded an image at File:Lolly beeh.png, though they were different photographs of what appears to be the same subject. @Jameslwoodward: Is there any technical overlap between these two users as far as you can tell?
Red-tailed hawk (nest) 18:20, 25 August 2023 (UTC)Reply[reply]
Yes, Ridypage and Adeyemo Taoheed appear to be the same user, but the same caution applies -- they may simply be classmates. .     Jim . . . (Jameslwoodward) (talk to me) 20:55, 25 August 2023 (UTC)Reply[reply]
Ok. Looking at the two accounts, I'm also going to block them; it would be odd for them to have technical connection and upload the exact same out-of-scope image but also be different people. I have to run through the rest again to see if I'm missing anything behaviorally. — Red-tailed hawk (nest) 02:50, 28 August 2023 (UTC)Reply[reply]

For older requests, please see Commons:Requests for checkuser/Archives