Wiktionary:Requests for checkuser

From Wiktionary, the free dictionary
Latest comment: 5 days ago by Theknightwho in topic Shokomoshiko
Jump to navigation Jump to search

Not to be confused with WT:CHU.

Request for CheckUser investigation

[edit]

Information

[edit]

A CheckUser investigation is a method by which certain Wiktionary users are able to determine IP and device information for logged in users, information which is normally hidden by the MediaWiki software. This ability allows them to determine whether a given set of usernames are or are not connected to a specific IP address, range, ISP or geographical region. Because of the privacy implications, CheckUser requests are only to be used with long-term, persistent suspected sockpuppets and vandals. More information can be found on the Meta policy page. If you feel that your privacy has been violated through the misuse of this tool by a CheckUser enabled person, there is a CheckUser ombudsman service available.

Policy

[edit]
  1. CheckUser investigations will only be conducted with the following cause:
    • with reasonable suspicion of the misuse of sockpuppets, including block evasion, persistent vandalism and vote fraud (a suspected sockpuppet may be investigated solely as a result of its edit behaviour if this reflects that of a persistent vandal);
    • to identify an underlying IP range of a persistent vandal in order to prevent likely repeat vandalism;
    • upon the request of a user to be checked themselves for cause.
  2. CheckUser enabled users are restricted in their use of the tool by the Meta CheckUser policy.

Procedure

[edit]
  1. If a CheckUser investigation is in order, request one below including the following information:
    • Usernames and IPs suspected of association.
    • Concise examples of reasons for suspicion (diffs and deletion logs).
    • Other applicable notes and comments.
    • Sign your request.
  2. If the CheckUser investigation is merited, a CheckUser investigation will be made, with the results posted on this page.
  3. The results of an investigation are posted in a very succinct manner, per Wikimedia's privacy policy requirements. Because of the nature of the tool, often results will be inconclusive and no determination is possible.
Indicator
Confirmed
Likely
Possible
Inconclusive
Unrelated
Additional information needed.
Note:
Declined
Checkuser is not for fishing.
Rejected

Completed requests

[edit]

All completed investigations are archived yearly at Wiktionary:Requests for checkuser/archive.

New requests

[edit]
Click here to make a new request.

Looks very similar to Enix150 (talkcontribsglobal account infodeleted contribsnukeabuse filter logpage movesblockblock logactive blocks), although the data may be too old to compare. — SURJECTION / T / C / L / 05:41, 4 January 2023 (UTC)Reply

@Surjection: Likely. The IPs geolocate in the same area as one of Enix150's geolocations (there were at least a couple), and the device is consistent with one of Enix150's devices, if you allow for a year or so of software upgrades. The obsession with (mostly lame) portmanteus and blends is pretty distinctive, anyway. There was a case with Enix150 where I saw an IP editing a pretty normal existing entry on a slightly different IP address with a different device configuration, and I thought it must be unrelated- until I noticed that the entry had a blend in its etymology. Chuck Entz (talk) 15:15, 4 January 2023 (UTC)Reply
Aquatic Stoned Ape is still actively editing. But their last few edits have actually been high-quality (e.g., they've been providing citations). 70.172.194.25 06:57, 12 January 2023 (UTC)Reply

Suspected sockpuppet of User:咽頭べさ. Thadh (talk) 16:29, 29 January 2023 (UTC)Reply

I'm not him, you can check my Ip. I've never edited Wiktionary pages only Talk User
Sometimes I ask Octahedron80 something I want to know. Tmaoa492s (talk) 21:10, 29 January 2023 (UTC)Reply
Inconclusive. The IP addresses are on different ISPs, but the geolocation is close enough that I can't rule out one device that has access to two different Internet connections (mostly because geolocation isn't very good at pinning things down to precise physical locations). The device configurations are similar, but not identical- though I don't know enough about those to rule out it just being the same device using different browsers. In other words, it looks different but someone could fake that with the right setup. Chuck Entz (talk) 23:49, 29 January 2023 (UTC)Reply
I just want justice for User:咽頭べさ block him forever is too much maybe a month or 2 is enough. Tmaoa492s (talk) 01:20, 30 January 2023 (UTC)Reply

And Technicalrestrictions01 (talkcontribs). Same style, appeared from nowhere to second one another in the same RFD discussion. —Al-Muqanna المقنع (talk) 15:48, 28 February 2023 (UTC)Reply

@Al-Muqanna: Confirmed, and both are socks of Beaneater00 (talkcontribsglobal account infodeleted contribsnukeabuse filter logpage movesblockblock logactive blocks), as is the unused account Leroy Patterson IV (talkcontribsglobal account infodeleted contribsnukeabuse filter logpage movesblockblock logactive blocks). All blocked. Chuck Entz (talk) 05:56, 1 March 2023 (UTC)Reply

I think I know the answer, but this is Kamen Ugalj (talkcontribs) block evading, isn't it? Thadh (talk) 20:48, 3 March 2023 (UTC)Reply

Special:Contributions/87.116.160.193 another one. Thadh (talk) 17:54, 4 March 2023 (UTC)Reply

@Thadh: that would require disclosing IP addresses used by a logged-in account, which I'm not allowed to do except under very limited circumstances. You might consider whether the recent edits by Special:Contributions/87.116.160.0/24 are bad enough to merit a block on their own. Chuck Entz (talk) 18:47, 4 March 2023 (UTC)Reply

By themselves they probably don't merit a block since the user was blocked for continuing to add ill-formated entries despite requests to stop and not answering to any communications, and I haven't approached the IPs yet. Thadh (talk) 19:50, 4 March 2023 (UTC)Reply

And 72.138.91.178 (who has been blocked for a week). The account has added the error-ridden entry كيبك (Quebec), which is pretty suspicious given that the IP had added أونتاريو (Ontario) shortly before being blocked, and also geolocates to Canada. The IP also added a (bunk) Mongolian entry at ї, while this user added a request to Wiktionary:Requested entries (Mongolian). Doesn't feel like a coincidence. Theknightwho (talk) 23:20, 3 March 2023 (UTC)Reply

@Theknightwho: as above, I can't tie IP addresses to logged-in accounts. Without running a check, though, I can see a similar pattern of adding translations in lots of unrelated languages and getting languages mixed up (Hungarian and Thai as well as Icelandic in Hebrew script at Jack Frost, all in the same edit- really?). It bears all the signs of vacuuming up data from word lists and/or transwiki links and spewing it here without checking. Chuck Entz (talk) 19:08, 4 March 2023 (UTC)Reply

Bumblebesam

[edit]

And Getsnoopy. This appears to be clearly related to WT:Beer parlour/2023/March#Getsnoopy and canonical forms. FYI @J3133 @Benwing2. Theknightwho (talk) 16:37, 25 March 2023 (UTC)Reply

Unrelated. Wrong continent. Chuck Entz (talk) 18:35, 25 March 2023 (UTC)Reply

User:Man with a boon

[edit]

Behaviorally very similar to Shāntián Tàiláng (talkcontribs). — SURJECTION / T / C / L / 22:05, 8 April 2023 (UTC)Reply

Confirmed and blocked. Two of their IP ranges are already blocked anonymous-only. There are unrelated accounts on one of them, so we can't increase the block to logged-in users. Chuck Entz (talk) 22:59, 8 April 2023 (UTC)Reply

Special:Contributions/LarryOfficial**

[edit]

Possible logged-out editing after being blocked. I will not reveal the IP here in case I am wrong again about this user, though. — SURJECTION / T / C / L / 21:57, 27 May 2023 (UTC)Reply

@Surjection: I checked all of the IP ranges they've used, and none have done any logged-out editing recently, nor during any of their previous blocks. Chuck Entz (talk) 03:47, 28 May 2023 (UTC)Reply

User:Teddymollek

[edit]

Looks a lot like Paragraphseven (talkcontribs). — SURJECTION / T / C / L / 08:49, 16 September 2023 (UTC)Reply

@Surjection: It's borderline: the device details are identical, if somewhat generic. They managed to find a new IP range, but the geography matches precisely. The behavior, though, was what convinced me: first, they created an account with the main IP range, Formerlybanned (talkcontribsglobal account infodeleted contribsnukeabuse filter logpage movesblockblock logactive blocks), that they never used. Then they created this account using a foreign proxy before starting to edit normally with the main IP range. The latter is something this person has done before: originally it was necessary to get around IP-range user-creation blocks, but not this time. Combined with the editing patterns, it looks solid enough to me. Chuck Entz (talk) 12:55, 16 September 2023 (UTC)Reply
Recycled1 (talkcontribsglobal account infodeleted contribsnukeabuse filter logpage movesblockblock logactive blocks)SURJECTION / T / C / L / 07:51, 18 September 2023 (UTC)Reply
Soulfulmoves (talkcontribsglobal account infodeleted contribsnukeabuse filter logpage movesblockblock logactive blocks), Contactpage1 (talkcontribsglobal account infodeleted contribsnukeabuse filter logpage movesblockblock logactive blocks), Goodcriteria (talkcontribsglobal account infodeleted contribsnukeabuse filter logpage movesblockblock logactive blocks), Sundaydriver1 (talkcontribsglobal account infodeleted contribsnukeabuse filter logpage movesblockblock logactive blocks), Oliver201013 (talkcontribsglobal account infodeleted contribsnukeabuse filter logpage movesblockblock logactive blocks) are all obviously them, but there are probably more accounts (e.g. sleepers or ones that I'm forgetting). — SURJECTION / T / C / L / 07:19, 1 December 2023 (UTC)Reply
@Surjection: The first three are Confirmed, but Oliver201013 seems unrelated, while Sundaydriver1 consistently uses a different browser and a different IP range (proxies geolocating to another continent), so Inconclusive at best. The problem is that the tendency to do masses of mediocre entries based on content scraped from Wikipedia and similar sources seems to have been picked up by several editors: StuckinLag Toad and VGPaleontologist come immediately to mind. My gut tells me that Sundaydriver1 is somebody we've dealt with before, but the checkuser tool doesn't find anything actionable. Chuck Entz (talk) 18:34, 1 December 2023 (UTC)Reply
One obvious sock was Russianmenaresosexy (talkcontribsglobal account infodeleted contribsnukeabuse filter logpage movesblockblock logactive blocks). Breeca (talkcontribsglobal account infodeleted contribsnukeabuse filter logpage movesblockblock logactive blocks) is almost certainly related. — SURJECTION / T / C / L / 07:18, 7 December 2023 (UTC)Reply
@Surjection Confirmed. Really boring: all the same IP ranges, so it looked exactly like last week's with a couple of new accounts and their edits added. Chuck Entz (talk) 14:52, 7 December 2023 (UTC)Reply
@Chuck Entz Another one: Mynewfiles (talkcontribsglobal account infodeleted contribsnukeabuse filter logpage movesblockblock logactive blocks) has similar editing patterns to Goodcriteria above, including quirks like always changing ‘person’ to ‘individual’ in definition lines when adding wikilinks. — Vorziblix (talk · contribs) 13:11, 17 April 2024 (UTC)Reply

Special:Contributions/PapasUlysse

[edit]

Borderline incomprehensible rambleposting on WT:ES with very little matter-of-fact contribution? Sure sounds familiar. — SURJECTION / T / C / L / 13:35, 28 October 2023 (UTC)Reply

See also User talk:Chuck Entz § A sense of déjà vu.... PUC16:54, 28 October 2023 (UTC)Reply
As I said on my talk page, they were making decent contributions at the time, so I didn't feel comfortable running checkuser on them. I did say that the person in question can't keep it up for long, so if it was them that would change. Sure enough, they've unambiguously gone off the deep end. I ran a check on them, with predictable results. They're now blocked and their ramblings on the current ES page have been reverted. Chuck Entz (talk) 17:58, 28 October 2023 (UTC)Reply
@Chuck Entz UpperPolices (talkcontribsglobal account infodeleted contribsnukeabuse filter logpage movesblockblock logactive blocks)SURJECTION / T / C / L / 18:19, 20 January 2024 (UTC)Reply
Yep. Chuck Entz (talk) 18:31, 20 January 2024 (UTC)Reply
IncrediblyBendy (talkcontribsglobal account infodeleted contribsnukeabuse filter logpage movesblockblock logactive blocks)SURJECTION / T / C / L / 15:28, 7 April 2024 (UTC)Reply
Sorry I didn't have time to deal with it at the time- Confirmed and blocked. Chuck Entz (talk) 21:39, 7 April 2024 (UTC)Reply

User:Sapphire Juniper

[edit]

Created the same day S ḳʷnṭHls (talkcontribsglobal account infodeleted contribsnukeabuse filter logpage movesblockblock logactive blocks) was blocked. Exact same interests: PIE (particularly 'modernizing' transcriptions) and Kartvelian, and other behavioral similarities. — SURJECTION / T / C / L / 07:07, 1 November 2023 (UTC)Reply

@Surjection Confirmed. Also Professor Pedantic (talkcontribsglobal account infodeleted contribsnukeabuse filter logpage movesblockblock logactive blocks), which seems to be the original account Chuck Entz (talk) 08:11, 1 November 2023 (UTC)Reply

User:I abhor Zionism

[edit]

Probably Yuzerneim (talkcontribsglobal account infodeleted contribsnukeabuse filter logpage movesblockblock logactive blocks) - same interests. — SURJECTION / T / C / L / 09:30, 25 November 2023 (UTC)Reply

Account spam

[edit]

Whatever is going on with accounts like this and this, which are all obviously linked. — SURJECTION / T / C / L / 00:09, 25 December 2023 (UTC)Reply

@Surjection, Theknightwho: It's exactly what it looks like: they're all the same device on the same IP range. I blocked a few that you missed, but that's about it. Someone is obviously tinkering with the idea of setting up a bank of sleeper accounts that they can draw on after the checkuser data goes stale. The flaw in that approach is that such an unusual and unnatural pattern is enough to show that there's an overall plan behind the creations, and therefore reason to block them all. I don't think they're dumb enough to try that specific approach again, but I'm sure they'll be back. Chuck Entz (talk) 03:01, 25 December 2023 (UTC)Reply

User:SamuelBilu

[edit]

SamuelBilu (talkcontribsglobal account infodeleted contribsnukeabuse filter logpage movesblockblock logactive blocks) removed an RFV tag (and the discussion from the RFV page!) out of process for luftgeschaeft, for which I blocked them. Now RandalKeithNorton (talkcontribsglobal account infodeleted contribsnukeabuse filter logpage movesblockblock logactive blocks) has tried removing the tag as well - I suspect these are all accounts of the same person who insists we document this word. — SURJECTION / T / C / L / 09:30, 17 March 2024 (UTC)Reply

Homiebro (talkcontribsglobal account infodeleted contribsnukeabuse filter logpage movesblockblock logactive blocks) as well — SURJECTION / T / C / L / 11:24, 17 March 2024 (UTC)Reply
@Surjection: This is a bit messy. These are all the same country, with the non-cellphone IPs in the same location and the cellphone IPs consistent with that location, if broader in area. RandallKeithNorton and SamuelBilu are probably the same person: the first logged out, then the second was created and edited using the same IP. They used different browsers and the IP was a proxy, so it's not 100%. It's also possible they were two people sharing the same internet connection. Homiebro seems to be a different person, but geographically in the same area. I do think they knew each other. My best guess is that Homiebro came up with the idea of removing the tags, then RandallKeithNorton eventually followed suite, first as SamuelBilu, then with their own account when SamuelBilu was blocked. Chuck Entz (talk) 15:56, 17 March 2024 (UTC)Reply

SeaGrassSea

[edit]

SeaGrassSea (talkcontribsglobal account infodeleted contribsnukeabuse filter logpage movesblockblock logactive blocks); potentially block evasion of SnivyPokemon (talkcontribsglobal account infodeleted contribsnukeabuse filter logpage movesblockblock logactive blocks). — SURJECTION / T / C / L / 07:27, 8 April 2024 (UTC)Reply

A Hungarian IP, creating a lot of stubs for minor languages. I suspect this is User:Rajkiandris evading the block. Vahag (talk) 18:15, 16 April 2024 (UTC)Reply

@Vahagn Petrosyan: Plausible, but the data the checkuser tool looks at only goes back 90 days and it's been a year and a half since they were blocked. I make a point of keeping data from most of my checks for future reference, but I never had reason to run a check on that account before it went stale. Chuck Entz (talk) 04:32, 17 April 2024 (UTC)Reply

Equinox (oversight request)

[edit]

I recommend oversight/suppression of this edit. Generally, sharing user-generated files like this isn't allowed. Also, this file possibly contains personal attacks or outing of other editors. We don't have oversight as a user right and this seemed the closest place Purplebackpack89 01:28, 30 May 2024 (UTC)Reply

I looked through it- pretty harmless. There's one zip file that might contain questionable content, but it's password-protected. Equinox has gone off the rails more than once, but always in an impulsive, uncontrolled manner. He just doesn't do devious, scheming things like that. Chuck Entz (talk) 06:25, 30 May 2024 (UTC)Reply
@Chuck Entz "Equinox has gone off the rails more than once, but always in an impulsive, uncontrolled manner" isn't exactly a ringing endorsement, particularly since hate slurs were part of his impulses. People have been indeffed for less. Sometimes it feels like there's one set of rules for people like Equinox and one set for the rest of us. Purplebackpack89 14:57, 30 May 2024 (UTC)Reply
There are all kinds of bad things people do here, but oversighting is only for ones that involve violations of privacy or very serious legal transgressions that need to be hidden even from admins. Your reasoning seems to be that there might be something bad in the file because Equinox might be trying to sneak in something improper. My point was that Equinox has never been known to try to sneak anything in, so that's just not plausible. Chuck Entz (talk) 15:19, 30 May 2024 (UTC)Reply
@Purplebackpack89: "Generally, sharing user-generated files like this isn't allowed." According to? Ioaxxere (talk) 15:56, 30 May 2024 (UTC)Reply

Shokomoshiko

[edit]

Seems like SamuelBilu (talkcontribsglobal account infodeleted contribsnukeabuse filter logpage movesblockblock logactive blocks), RandalKeithNorton (talkcontribsglobal account infodeleted contribsnukeabuse filter logpage movesblockblock logactive blocks), and/or Homiebro (talkcontribsglobal account infodeleted contribsnukeabuse filter logpage movesblockblock logactive blocks) again. Theknightwho (talk) 18:49, 19 June 2024 (UTC)Reply

@Theknightwho: your guess is as good as mine. The checkuser tool only has access to the last 90 days, and those accounts were all blocked by March 17. I had no reason to save any data, so I've got nothing. Chuck Entz (talk) 19:30, 19 June 2024 (UTC)Reply
@Chuck Entz I'm pretty sure it's them: they've got 2 mainspace edits, on Asaf and luftgeschaeft. Looking over the luftgeschaeft entry, I was reminded of the (dubious) 2024 cite, which is a poem called "Luftgeschaeft" by Asaph Wagner - whoever that is - which only exists in the form of a YouTube video, so far as I can tell; in the very earliest form of the entry at Luftgeschaeft (now deleted), it was also added as an image, so no prizes for guessing who was behind the first set of accounts.
The fact that this new user crops up, edits Asaf first, and then just-so-happens to edit luftgeschaeft several hours later is beyond unlikely to me. Had Shokomoshiko edited them the other way around, I could see an argument for them having stumbled across luftgeschaeft and seen AsaphAsaf there, but there's absolutely nothing that would lead an ordinary user from Asaph to luftgeschaeft ([1]), unless they were seeking out entries they were already familiar with, which narrows things down quite a lot given it's only had 11 views in the past month. @Surjection, what do you think? Theknightwho (talk) 20:21, 19 June 2024 (UTC)Reply