Steward requests/Checkuser/2013-12

Please do not post any new comments on this page. This is a discussion archive first created in December 2013, although the comments contained were likely posted before and after this date. See current discussion.

Proofs? In bs.wikipedia one proof was questioned: "Ban Kulin, son of ban Borić". But I show it in a Google ebook: "Banus Culinus, Borichii filius" in Latin means "Ban Kulin son of ban Borić" in English, so I didn't invent it. Second, the blocked user never mentioned this or any other references I used. Rtava (talk) 12:55, 25 October 2013 (UTC)

Inconclusive as no comparative data available. Though I do note that there are two unused accounts created on the same IP and other similarities. Leaving them at the moment. — billinghurst sDrewth 04:03, 27 October 2013 (UTC)

I was specifically asked was one of the other accounts Ideabeach. It is. Personally, I don't count them as socks until used, hence why I didn't specify the account, though when asked, it is appropriate to confirm the check. — billinghurst sDrewth 15:04, 27 October 2013 (UTC)

Thank you for your answer. It was very helpful.--C3r4 (talk) 18:30, 27 October 2013 (UTC)

Any further investigation on hold. — billinghurst sDrewth 14:16, 30 October 2013 (UTC)

Done there is no further information to be provided, beyond to note that case notes have been prepared. — billinghurst sDrewth 14:19, 13 November 2013 (UTC)

 Deferred to have an admin or bureaucrat confirm the request, and further explain the purpose of CU request.— The preceding unsigned comment was added by Billinghurst (talk) 04:09 27 October 2013 (UTC)

Not done no follow up, closing as insufficient need demonstrated by wiki. Please lodge a new request by admin or bureaucrat if required. — billinghurst sDrewth 12:24, 13 November 2013 (UTC)

What would checkuser be useful for, when you already established this on behavioural evidence? Please simply block such users. --MF-W 14:28, 27 October 2013 (UTC)

Actually I want to have those sock puppet accounts globally locked as well, for which I think more evidence is needed.--William915 (talk) 02:28, 28 October 2013 (UTC)

Some of these accounts have significant number of contributions on other projects and therefore are not suitable candidates for global lock. On the other hand, global account Pangal does not exist. Ruslik (talk) 19:00, 28 October 2013 (UTC)

Just check and lock(if applicable) Iedomeneo then.--William915 (talk) 02:37, 29 October 2013 (UTC)

Not done Sounds retributive, not issue management. Sounds like this is account management at a local level, and is not a global issue. Please note that most sock policies are local policy implementations (there is no global policy about general multiple accounts for a user). — billinghurst sDrewth 11:52, 30 October 2013 (UTC)

 Confirmed Respeto, Borg (local only), Cheflektorin, Nuzák, Nordmann (local only), Bedsten, BS-USB. — billinghurst sDrewth 06:51, 2 November 2013 (UTC)

If someone wants to engage in this futile exercise, he is at liberty to do so, but I stopped the usage of this username now. --MF-W 22:48, 15 November 2013 (UTC)

Let us see if it goes away. — billinghurst sDrewth 08:35, 16 November 2013 (UTC)

I personally believe there's grounds for a check, though I doubt that sufficient evidence has been presented above. Both the first two users have been blocked on en.wikipedia for socking, but back in 2008. Let me see if we can present better evidence for running a check. --Rschen7754 10:14, 23 November 2013 (UTC)

w:en:Wikipedia talk:Wikipedia Signpost/2013-10-30/News and notes#The search engine problem indicates that users 1-3 are at least collaborating extensively, if they are not the same. --Rschen7754 10:22, 23 November 2013 (UTC)

The reason why I suspected user 4 is because the user account created on 22 November, and reverted edit of user 3. and interestingly it was mentioned by user 3 ten days ago. I noticed behaviour of user 5 is also very similar.The user 1 is using different proxy ranges dedicated to his different accounts. --Saqib (talk) 11:04, 23 November 2013 (UTC)

I do not think that there is any grounds to check Neotarf. --Rschen7754 11:08, 23 November 2013 (UTC)

Why I suspected User:Neotarf to be sock of user 1 because of very similar behaviour and editing area and some proof is provided : user 5 have no account on WT under username Neotarf so why he said he's editing there?, user 5 is against the CU on Frank, and user takes so much interest in time and date format as Frank do. --Saqib (talk) 12:09, 23 November 2013 (UTC)

Back in 2008, the top two accounts were confirmed to be sockpuppets on en-wiki (there's some leeway as it seems Alice was a legitimate alt-account due to threats supposedly received as part of a very contentious topic area (Northern Ireland/"The Troubles", however, the two later tag teamed in the area. SirFozzie (talk) 11:25, 23 November 2013 (UTC)

118.93nzp has been blocked several times as an anon, you may guess something just having a look at its name.

Those accounts are unrelated by CU (though W.Frank and Alice share something which is currently shared by ~10% of computers), I must underline they never edited at the same time nor the same day. If we had a sockpuppeteer steward, well, it would likely behave and being seen by CU the like them.

MmeLePetomaine is the "most unrelated" one.

Inconclusive--Vituzzu (talk) 12:50, 23 November 2013 (UTC)

Vituzzu: I apologise for coming late to the party, but I have only just become aware of this discussion.

Are you saying that my account is unrelated to any of the others you checked or just that it is inconclusive?

I'm afraid I don't understand your comment: "If we had a sockpuppeteer steward, well, it would likely behave and being seen by CU the like them." May I trouble you to clarify and explain this comment, please?

Is there a reason that you left out the other accounts that were specifically asked to be checked here?

Why were the accounts that were most linked by their peculiar interests and editing patterns (User:Peterfitzgerald, User:Cjensen, User:Ypsilon, User:SpendrupsForAll, User:MmeLePetomaine) omitted? --118.93nzp (talk) 00:23, 24 November 2013 (UTC)

Because no evidence was provided to check those accounts. We can't just ask for accounts to be checked when we feel like it, CheckUser is not for fishing. --Rschen7754 00:25, 24 November 2013 (UTC)

• Looks like it. I'd say it's very Likely they are sockpuppets (likely to confirmed). Trijnstel_talk 19:17, 25 November 2013 (UTC)

Please provide diff-links or so which can prove this. --MF-W 17:10, 26 November 2013 (UTC)

Please lodge a new request if required. — billinghurst sDrewth 13:01, 4 December 2013 (UTC)

It does not appear that you have linked to the ostensible sockmaster's account above. Please list which accounts for which you believe you have local fawiki evidence of sockpuppetry. Note that having multiple accounts on one project does not mean that violations occurred on other projects. Furthermore, the Wikimedia Commons has its own CUs and issues need to be addressed first locally. Thank you. -- Avi (talk) 20:53, 2 December 2013 (UTC)

Time has passed and no response. Please reopen if necessary. — billinghurst sDrewth 14:55, 7 December 2013 (UTC)

The accounts that I could check are confirmed to each other. --Bsadowski1 (talk) 08:16, 1 December 2013 (UTC)

Are there any other accounts?--GZWDer (talk) 08:58, 1 December 2013 (UTC)

There is one legitimate user operating the accounts. They will be contacted privately. --Bsadowski1 (talk) 10:34, 1 December 2013 (UTC)

I'm not trying to be antagonistic, but why isn't that information being released now? The user operating these accounts is in violation of our sockpuppetry policy, and of our bot policy, and should be held accountable. I'm not saying that person needs to be blocked, but the Wikidata community has the right to decide what to do with them. — PinkAmpers&^{(Je vous invite à me parler)} 17:18, 1 December 2013 (UTC)

Bsadowski1 may not be at liberty to release the details because of the user's local privacy laws.--Jasper Deng (talk) 01:50, 3 December 2013 (UTC)

This sounds like bogus. --MF-W 21:00, 3 December 2013 (UTC)

Personally, I think the local community should know who the master of the accounts is, as this is a violation of local policy, barring any extenuating circumstances. I am not aware of anything in the privacy policy that would prevent this disclosure. Or perhaps another option would be disclosing it to the local OS team, as there are (obviously) no local CUs. --Rschen7754 02:26, 4 December 2013 (UTC)

If so, then why not reveal the account?--Jasper Deng (talk) 02:29, 4 December 2013 (UTC)

Where there is uncertainty the stewards are expected to act more conservatively and on this case at this time you should respect our judgement on the matter. The primary account is not being abused, and you have been notified of all secondary accounts, and it is my understanding that one of the stewards is doing follow-up om the matter. The matter is ongoing for stewards. Have some trust people. — billinghurst sDrewth 11:54, 4 December 2013 (UTC)

I don't think anyone wasn't having trust here, billinghurst. We've all got bits of our own, and know how annoying it can be to be needlessly second-guessed. Rschen, Jasper, and myself just asked for some clarification after Bsadowski skirted over a fairly significant point. None of us was saying y'all need to throw someone to the pitchforks straight away, if you think more good can be done for now by talking privately. Now, given another week or so, I think it's reasonable for us to expect either a disclosure of the username to the local community, or a thorough explanation of why this will not be done; but this was just a procedural question, which I thank you for now answering. — PinkAmpers&^{(Je vous invite à me parler)} 10:56, 7 December 2013 (UTC)

Thanks, Dekel E (talk) 20:01, 3 December 2013 (UTC)

CheckUser is not for fishing Blind requests are not going to get done. If the edits are problematic then block them. If they are not then leave them. If there is more to the situation then please provide a reason why a checkuser should be done with a resulting benefit. — billinghurst sDrewth 14:46, 7 December 2013 (UTC)

There is no fishing here. " רוטר נט." is our local Troll. He always return with a new puppet. Dekel E (talk) 18:34, 7 December 2013 (UTC)

You have not explained how a CU is useful, nor explained why it should be done. If the user is problematic, then block them, you don't need to have a CU undertaken to manage a troll. Otherwise please justify your request, rather than the reasoning (or lack of it) as above. There is meant to be rigour to each request made here. — billinghurst sDrewth 10:07, 8 December 2013 (UTC)

Why do you think I He? Why do not you ask the Hebrew Wikipedia ? יונית4 (talk) 13:41, 9 December 2013 (UTC)

dekel, enough with this. Matanya (talk) 13:45, 9 December 2013 (UTC)

Please prove that you are actually accused of sending emails. The block reason does not contain such a thing. --MF-W 18:19, 7 December 2013 (UTC)

https://sh.wikipedia.org/w/index.php?title=Razgovor_sa_korisnikom:Kolega2357&diff=1748290&oldid=1747498

Nemoj ni slučajno pokušati glumiti žrtvu jer vrlo dobro znaš što si mi poslao s svoje službene wiki email adrese.

Da me wikipedija još uvek zanima zabio bi ti blok na razdoblje 6 mjeseci i onda kada bi ga Ripper ili bilo tko drugi maknuo išao bi na metu po zadovoljštinu

Do not accidentally try to act the victim because you know very well what you sent me to their official wiki email address.

To me Wikipedia is still interested you will get block the period of 6 months, and then when it OC Ripper or anyone to unblock you. I will go to the satisfaction of the Meta Wiki

--Kolega2357 (talk) 09:29, 8 December 2013 (UTC)

To me this is a local issue, and needs to be managed locally. There are clearly other issues existing here for such an accusation to have been made; and even if we do make the check of you, how is it going to change the result (noting that our undertaking a CU of you alone will not prove anything). You, the person blocked is now asking for a CU of another person without the community requesting it, in conditions of which we are unaware. It is an edge case for a check, see checkuser#Use of the tool. — billinghurst sDrewth 10:22, 8 December 2013 (UTC)

You are unblocked at shWP, so please continue to resolve this at that wiki, and those admins can make a request if they desire. — billinghurst sDrewth 10:28, 8 December 2013 (UTC)

•  Declined per above; local matter. -- Avi (talk) 18:20, 10 December 2013 (UTC)

 Confirmed the five user accounts identified above are all associated; there is clearly no checkuser required on the IP address, so not considered in the investigation results. — billinghurst sDrewth 11:28, 12 December 2013 (UTC)

Thank you. — Yerpo ^Eh? 13:32, 12 December 2013 (UTC)

Technical evidence indicates the following:

•  Confirmed
  • Κυριάκος Ζαχ (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
  • Vlantmir (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
  • Chin Hale (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
  • Globex (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
  • Earhonex (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
  • Δικαιόπολις (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
  • Kyriakos Zach. (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
  • HGDHF (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
• Unrelated
  • Vikipedi-Wiki (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
  • GiannisKourbelis (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

-- Avi (talk) 19:50, 30 December 2013 (UTC)

zh.wikipedia has local checkusers. Please contact them. --MF-W 17:08, 29 December 2013 (UTC)

Thank you in advance, --Dada (talk) 17:22, 30 December 2013 (UTC)

Ογκόλιθος is Unrelated.

Below is a list of socketpuppets of accounts closely associated with from the checkuser point of view with Eklogarithmos:

 Confirmed

Skylax30

Geraki

Έξι γκόμενες αφράτες

Possible

Archive Lena

RouValentine

Egiannoutsou

Βαγγέλης Φίλος

NKPapadopoulos

Fralence

Tsenos2

Artemispapadakis

Con marcon

Andromeas

ΑΝώΔυΝος

Ruslik (talk) 19:05, 30 December 2013 (UTC)

I would like to ask another checkuser to get involved and confirm the relationship of

Eklogarithmos

Skylax30

Geraki

Έξι γκόμενες αφράτες

The reasons are that:

Geraki is highly unlikely to be Eklogarithmos. Very old user, admin, attacked by Eklogarithmos, different interests, different style and other personal characteristics

Skylax30 is very unlikely to be Eklogarithmos. Different interests, different style.

Έξι γκόμενες αφράτες is possible

Thank you. --FocalPoint (talk) 22:39, 30 December 2013 (UTC)

The results indeed look very surprising. To make sure that they are really robust, I would also like to request an additional check by another steward, if possible. Thanks, --Dada (talk) 23:32, 30 December 2013 (UTC)

:-)

Some notes that must be taken on account:

On evidence based on geolocation: Any steward doing checks on users from Greece, should have in mind that almost every greek ISP assign the same IP blocks to any adsl connection in Greece. So every IP will be reported to be in "Athens" although the actual connection can be in a town hundreds of kms away. Geolocation should never be taken on account if the result of the report is "Athens". Even "Thessaloniki" in some cases can mean just "Northern Greece".

On evidence based on IP: At least half of my activity comes through the transparent proxies of the public administration network. I guess Skylax is also using the same network, as many other users accessing Wikipedia at work from their public offices. Of course, personally I am also editing from home which is on another network. It would be a nice question if Eklogarithmos is using the same public network, as we evidently knew that he was based in Germany at least until some time ago.

Since it is reported that Eklogarithmos and Ογκόλιθος are "unrelated", although it was almost admitted by himself that they are the same person, I can say that he has learned how to cover his tracks, so any check user will be inconclusive. We must stick on the duck test.

-Geraki ^T_L 08:16, 31 December 2013 (UTC)

This result was based on an exact match of both IP and UA string. Of course, it is possible that it is because of the same public network. However, from the checkuser point of view your contributions are indistinguishable from those of Eklogarithmos and Skylax30. Ruslik (talk) 12:19, 31 December 2013 (UTC)

I struck some conclusions above. It seems that checkuser tool is useless in this case. You will indeed need to rely on behavior evidence. Ruslik (talk) 15:27, 31 December 2013 (UTC)

• {{inprogress}} The results are being reviewed. -- Avi (talk) 14:35, 31 December 2013 (UTC)

  After further review, I agree that the technical evidence that exists regarding Geraki and Skylax is Inconclusive for various reasons, including those listed above, and should not be used to infer a link between the two accounts. Behavioral evidence will be necessary to confirm or refute any such link. Thank you. -- Avi (talk) 15:35, 31 December 2013 (UTC)

  I supervised the whole process and can confirm that it's not impossible but very unlikely that Geraki and Skylax30 are the same accounts. Without evidence for same edit patterns and abuse of these accounts, we cannot complete this request. Cheers, —DerHexer (Talk) 16:09, 31 December 2013 (UTC)