Jump to content

Steward requests/Checkuser

From Meta, a Wikimedia project coordination wiki
This is an archived version of this page, as edited by Quentinv57 (talk | contribs) at 08:00, 15 August 2011 (3 requests archived). It may differ significantly from the current version.
Shortcut:
SRCU
Checkuser icons
These indicators are used by CheckUsers and stewards for easier skimming of their notes, actions and comments.
{{Confirmed}}:  Confirmed {{MoreInfo}}: MoreInfo Additional information needed
{{Likely}}: Likely Likely {{Deferred}}: Deferred Deferred to
{{Possible}}: Possible Possible {{Completed}}: Completed Completed
{{Unlikely}}: Unlikely Unlikely {{TakeNote}}: Note Note:
{{Unrelated}}: Unrelated Unrelated {{Doing}}: Doing...
{{Inconclusive}}: Inconclusive Inconclusive {{StaleIP}}: Stale
{{Declined}}:  Declined {{Fishing}}: Fishing CheckUser is not for fishing
{{Pixiedust}}: Pixiedust CheckUser is not magic pixie dust {{8ball}}: 8ball The CheckUser Magic 8-Ball says
{{Duck}}:  It looks like a duck to me {{Crystalball}}: Crystalball CheckUser is not a crystal ball

<translate> This page is for requesting CheckUser information on a wiki with no local CheckUsers (see also [[<tvar name="SRP">Steward requests/Permissions</tvar>|requesting checkuser access]]). Make sure to follow the following instructions, or your request may not be processed in a timely manner.</translate>

<translate> Before making a request:</translate>

  1. <translate> Make sure you have a good reason for the check. It will only be accepted to counter vandalism or disruption to Wikimedia wikis. Valid reasons include needing a block of the underlying IP or IP range, disruptive sockpuppetry, vote-stacking, and similar disruption where the technical evidence from running a check would prevent or reduce further disruption.</translate>
  2. <translate> Be specific in your reasons. Ambiguous or insufficient reasons will cause delays. Explain the disruption and why you believe the accounts are related, ideally using [[<tvar name="diff">mw:Special:MyLanguage/Help:Diff</tvar>|diff links]] or other evidence.</translate>
  3. <translate> Make sure there are no local checkusers.</translate>
  4. <translate> Please ensure that the check hasn't already been done:</translate>


<translate> How to make a request</translate>

<translate> How to make a request:</translate>

  • <translate> Place your request at the bottom of the section, using the template below (see also [[<tvar name="Srcu">Template:Srcu/doc#Usage</tvar>|<tvar name="Srcu2">{{srcu}}</tvar> help]]).</translate>
    === Username@xx.project ===
    {{CU request
     |status          = <!--don't change this line-->
     |language code   = 
     |project shortcut= 
     |user name1      = 
     |user name2      = 
     |user name3      = 
    <!-- Max 10 users -->
     |discussion      = <translate><!--T:11--> [[Example]]<!-- local confirmation link / local policy link --></translate>
     |reason          = <translate><!--T:12--> Reasons here</translate>. ~~~~
    }}
    

    <translate> For example:</translate>

    === Example@en.wikipedia ===
    {{CU request
     |status          = <!--don't change this line-->
     |language code   = en
     |project shortcut= w
     |user name1      = Example
     |user name2      = Foo
     |user name3      = Bar
    <!-- Max 10 users -->
     |discussion      = <translate><!--T:14--> [[:w:en:Example]]<!-- local confirmation link / local policy link --></translate>
     |reason          = <translate><!--T:15--> Reasons here.</translate> ~~~~
    }}
    
  • <translate> Specify the wiki(s) you want to perform the check on.</translate>
Cross-wiki requests
Meta-Wiki requests

Requests

Brox@lt.wikipedia

  • Brox appears to be blocked on only one wiki, nl.wikipedia, where the user had few edits. Brox has not been blocked on lt.wikipedia, where he has 23,282 edits. What has been blocked on lt.wikipedia is Sands (by Brox), Tik-Kon (by Snooker and Brox), Passutis (by Snooker). A quick glance at the contributions of the blocked users revealed that most edits were standing. Whatever they were doing doesn't seem to have been highly disruptive.--Abd 20:34, 7 August 2011 (UTC)[reply]
  •  Confirmed:
    • Sands
    • Tik-Kon
    • Passutis

Based on geolocation, it is Likely Likely that these users are Brox.

  • Unrelated Unrelated:
    • Vitalis
    • Petriukas
  • Stale
    • Žiedas

--PeterSymonds (talk) 20:13, 6 August 2011 (UTC)[reply]

Please Recheck lt:user:Sands, lt:user:Tik-Kon and lt:user:Passutis. it's not my (lt:user:Brox)! Please describe observations/reasoning, as specific addresses were assigned to lt:user:Brox. --Brox 14:41, 7 August 2011 (UTC)[reply]
This is worth an independent examination. Geolocation is the weakest possible connection. This could easily be explained by a single user with the other accounts "confirmed" who sits in the same region covered by ISP(s) as Brox. Any review should explicitly state the weakness or strength of the identification. To my mind, PeterSymonds already did that, but others, not familiar with checkuser evidence, might interpret "likely" as something stronger than it is. My guess is that "Possible" would have been more accurate. I see that on lt.wikipedia, the result here is being treated as if definitive proof, see [2]. What the result actually strongly confirms is the three blocked accounts. The identification with Brox looks weak. --Abd 20:34, 7 August 2011 (UTC)[reply]

I don't have the time to give more information atm, but please see this file on nlwiki, this (still open) global lock request and this RFC. I can provide more info tomorrow if necessary. Trijnstel 22:10, 7 August 2011 (UTC)[reply]

I personally blocked all those accounts that have been confirmed. The problem with Brox is that he has already admitted to using multiple accounts in past, for example Dendrolo is really Brox's account as he himself tagged the user page that it's his past account even those he used it recently. He recently even created a category for his sockpuppet accounts. Also he had problems on nl.wikipedia. So it cannot be a coincidence, but it is strange for me that Brox is denying all those accusations. So I requested further information on this matter, and I suppose that geolocational confirmation has given Brox the reason to deny everything. Trijnstel, please provide information that you have. Thanks in advance. Tomreves 06:06, 8 August 2011 (UTC)[reply]
  • I agree that clarification will be helpful. There is major disruption developing out of what seems unclear about this CU. I'm collapsing my explanations and research, but the same kind of weak ID seems to have taken place with the NL CUs. --Abd 17:43, 8 August 2011 (UTC)[reply]
@Tomreves: Brox used several IPs of Lithuanian mobile phone ranges of "Omntel Lithuania". And for the crosswiki abuse: here is perfectly explained (in English) what Brox did wrong on nlwiki. He did that probably on more projects too (I haven't checked that; MoiraMoira did almost all the work - except for the checkuser of course). Trijnstel 18:55, 8 August 2011 (UTC)[reply]
Brox is clearly Dendrolo, that's not controversial. Did the behavior of Dendrolo and Brox differ? They did not edit at the same time, so IP may have varied, but I'd guess they had the same user agent information, and Brox claims fixed IP, I think. Trinjstel seems to be assuming that Brox is all the accounts using those IP ranges. It's looking like there is no other evidence. --Abd 20:09, 8 August 2011 (UTC)[reply]
Sadly, event faced with problems User:Brox continues his disruptive actions in his home lt.wikipedia creating havoc with his illogical categorization of articles. I can understand User:MoiraMoira, the stubborn position and refusal to cooperate from Brox's side, can drive even most patient users crazy. @Trijnstel, thanks for the reply. Tomreves 19:07, 8 August 2011 (UTC)[reply]
I could write a great deal about Brox now, but this is all irrelevant here. Please don't use this page as a forum from which to defame users. LT wiki has no checkuser, so stewards here will serve. The sole question is checkuser information, and defamation of users just complicates this. Those allegations, true or false, are matters for lt.wiki to address. All I'm saying here is that the identification of these socks is clearly weak, so LT wiki discussion should not be complicated by claims, as you have made, that sock identification beyond the acknowledged socks is clear. It isn't. --Abd 20:09, 8 August 2011 (UTC)[reply]
Sorry for this. I suppose there is no other way to tell for sure whether or not the confirmed LIKELY acounts are User:Brox's. If there is no other way, I suppose the further escalation of discussions is useless because we cant determine new facts with regard to User:Brox.Tomreves 20:17, 8 August 2011 (UTC)[reply]
But you can determine if Brox is being disruptive on lt.wikipedia. Take it one step at a time. Is he causing damage? Sock puppets don't necessarily cause damage, it's important to back up and look at what's important: content and community. If he's got a sock or socks backing him up, that's a form of damage, but if they are really acting independently, doing different things, it's not worth worrying about. If it looks like he is abusively socking, like revert warring with socks or multiple !voting, then is the time to again request checkuser. Even sophisticated puppet masters slip up. But don't harass him. Cooperate with him. It's hard to cooperate with someone who is calling you a liar! --Abd 21:00, 8 August 2011 (UTC)[reply]
Checkuser considerations and emerging disruption. --Abd 17:43, 8 August 2011 (UTC)[reply]
  • It may not be needed. The report above can be compared with [3] on nl.wiki. That report shows that ID is being based on (google trans) Probably. Same Lithuanian mobile operator. That might make some sense for nl.wiki (but probably not. It seems that there may be some Lithuanian connection common to many of the nl.wiki edits.) It makes no sense to consider this "likely" if it's the Lithuanian Wikipedia! "Possible" would be more accurate, and Peter Symonds, to anyone who understands checkuser, stated the basis clearly. Geolocation (which is slightly weaker than the nl.wiki ID, since Peter didn't state it was the same mobile operator.) And the circumstances might be different, these were, after all, different socks. I see checkuser, here, as indicating a clear difference between Brox and the three socks confirmed as the same. With the three, Peter may have observed not only actual IP identity, but also user agent identity. It doesn't really matter, unless my assumptions about the three confirmed socks are incorrect. (They were not disruptive, as to editing, and this fuss, it appears, is only being made out of influence from nl.wiki.) Brox is different, clearly. Possible, sure. All that reduces to is that the three socks and Brox are from the same service area, which could be huge. Yet this user, based on this report, is being treated as a liar. That's offensive. He's being threatened by MoiraMoira that if he doesn't admit and agree to stop the socking, he'll lose, as a result of meta action, access to his admin account at lt.wiki. That's blackmail, and it's highly disruptive. The meta community should make it very clear that meta is not to be abused like this.
  • I have no connection with Brox, and have no opinion about his adminship. MoiraMoira requested a global lock for Brox, and, when that was rejected, MM started an RfC, with dramatic claims backed by no evidence of actual cross-wiki disruption. Tomreves, if Brox is disruptive on lt.wiki, that's the place to address it, where people know the activity and can review it in detail. Stewards cannot get involved in this. The checkuser information could be clarified, that's all. And what I can say about it, as far as what has been revealed here and on nl.wiki, is that the identification of Brox as an operator of sock accounts is obviously neither rejected nor confirmed by the checkuser reports. It's "possible." And it's up to lt.wiki to interpret all this. Not meta. --Abd 16:31, 8 August 2011 (UTC)[reply]
research into acknowledged Brox sox --Abd 17:22, 8 August 2011 (UTC)[reply]
  • Something very strange is going on. Brox has had acknowledged sock accounts.
  • Dendrolo ack, 7 March, 2011. 2 edits since acknowledgment.[4][5] Only 1 more edit in 2011.[6]. All edits are standing, not reverted.
  • Mindofw ack, 7 March, 2011. No edits since 2009.
  • Logos ack, 14 June, 2011 . No edits since Jan 2010.
  • Archiz ack 7 March, 2011. No edits since 2009.
  • Brox, on lt.wikipedia, is being accused of abusive sockpuppetry, and one of his responses is "what's the disruption?" He's referring to his acknowledged socks, only one of which has recent edits, all of which are obviously good edits, or at least reasonable. The above research confirms this. Dendrolo, before the explicit tagging by him, was obviously him, he'd edited his user page with the account. Dendrolo and Brox on nl.wikipedia, then, were indeed the same account, no checkuser was needed for that. I'd noticed that Brox had stopped editing there and Dendrolo had started up. But Brox had not been blocked, as I recall. Dendrolo is quite active on other wikis, and the only blocks (Commons, LT, NL) seem to be stemming from the nl.wikipedia action, with local disuption, if any, only at NL. This is really a mess. I will recommend to Brox that he acknowledge all socks, clearly, on all the wikis, if he has not, and if they have any edits, not because he's done anything wrong with them, necessarily, but because it could avoid useless fuss. --Abd 17:22, 8 August 2011 (UTC)[reply]
  • Acknowledged accounts: lt:q:user:Redagavimas (sysop WQ LT), lt:s:user:Redagavimas (sysop WS LT), lt:user:Brox (sysop WP LT), de.wiki user Dendrolo (Sichter WP DE), ru:w:user:Brox (autoeditor WP RU). "In WP DE I was (and I want to be)" de:Benutzer:Brox" and the user intends to seek account unification as shown in the linked acknowledgment. I have seen no sign of cross-wiki abuse. Some accounts are blocked on some wikis apparently as a result of this checkuser report, which seems an overreaction to me.
  • Brox (CA) is only blocked on NL.wiki
  • Redagavimas (CA) was blocked on NL wiki and, August 7, 2011, on bat-smg.wikipedia, though the account had not edited since 2007. This was likely based on no misbehavior but only this report.
  • Dendrolo (CA) one edit on Commons in 2010, blocked 11:25, 25 July 2011, accusation of sock puppetry, no evidence cited. 4 isolated edits to Lt.wikipedia in 2011, no apparent abuse, account acknowledged as Brox 7 March 2011, blocked there August 6, 2011, by Snooker (Tomreves, filer of this CU request).
  • LT.wikipedia has 19 administrators and 3 bureaucrats and should be well able to handle alleged problems there.
  • Action needed here: clarify identification of Brox with the sock farm, appears to be weak. Common provider in Lithuania would not be unusual for the Lithuanian wikipedia. --Abd 22:49, 9 August 2011 (UTC)[reply]

RFC

Requests for comment/recheck User Brox and Tik-Kon in WP LT. Please recheck User:Brox/Brox and Tik-Kon in WP LT. --Brox 08:05, 10 August 2011 (UTC)[reply]

Review

Doing...I shall make a complete review and post my findings here. fr33kman 17:41, 11 August 2011 (UTC)[reply]

Comment Comment I have redone the Brox@ltwiki CU request and also had another steward recheck and we found the following;
Unrelated Unrelated Users w:lt:User:Sands, w:lt:User:Tik-Kon, and w:lt:User:Passutis are unrelated to w:lt:User:Brox. I have no comment on the results of any investigation that took place on nlwiki, but using ltwiki's data there is no connection to Brox. I'd like to chat in private with a CU from nlwiki so we can compare findings. I've also nothing to say about anything else related to Brox either. fr33kman 21:14, 11 August 2011 (UTC)[reply]
Done I've dealt with nlwiki, you're free to go about your business, Happy Editing! :-) fr33kman 06:33, 12 August 2011 (UTC)[reply]
Further specification: There has been no investigation on nl: into Sands, Tik-Kon and Passutis; they had been blocked there based on PeterSymonds's CU above, then unblocked based on the discussion here. There have been some Dutch CUs regarding Brox and Dendrolo and other suspected sockpuppets. - Andre Engels 08:34, 12 August 2011 (UTC)[reply]
What happened on nl.wiki --Abd 22:22, 12 August 2011 (UTC)[reply]
  • The problem on nl.wiki was that Dendrolo was not responsive to an objection to some fast categorization, and was blocked (The original block seems reasonable to me). Dendrolo was Brox, but I think the linkage had not been made explicit on nl.wiki. Essentially Brox had stopped editing (without problems) and started up as Dendrolo. Brox had ended up with multiple SULs, it happens. Dendrolo was blocked, then CU picked up Brox (no wonder!) Socks that continued to edit "disruptively" were another users, similarly to Tik-Kon etc. on lt.wiki, that appear to have been identified on nl.wiki as Brox, on the same kind of basis as Tik-Kon here, probably: the mobile Lithuanian ISPs. What it looks like is that the nl.wiki checkuser made the same -- possibly incorrect -- assumption as PeterSymonds did here. It's an easy mistake to make!
  • PeterSymonds was very properly explicit about "geolocation" as being the basis, which was the tipoff to me that there was a problem. The CUs on nl.wiki, except for one, didn't state the reason for identification, except for one, whose report matched what PeterSymonds had reported, it was likewise a weak identification, far from conclusive.
  • I suggest that what might have been a simple, short (or quickly lifted based on behavioral agreement) block on nl.wiki, turned into a monster set of accusations, repeated on many wikis on Brox or other Brox account talk pages, with demands that Brox admit the socking or else there would be consequences, and with follow-up on that threat when he did not comply, with a global lock request and an RfC duplicating the lock request. With the latter, I acted to shut it down, and, in the other direction, to shut down the inappropriate RfC filed by Brox, and I assured Brox that a recheck was likely to happen. Brox was responsive.
  • For the future, I hope that checkusers recognize that they may be dealing with local administrators who are not sophisticated about checkuser limitations, and who might take a weak positive indication as meaning more than it does. It was obvious from PeterSymond's report that the three ID'd socks above were truly a common user, but that the much more active Dendrolo was behaviorally different. While a sophisticated puppet master could create this difference, that seemed unlikely for Brox, his requests were clumsy, not apparently understanding CU and what CUs can report. That's not a criticism of Brox! Nor is it really a criticism of some other admins involved, who thought they were relying upon clear evidence, for we don't expect administrators to understand all the nuances of CU. I thank Fr33kman for doing the recheck, and apparently looking more carefully, so as to be able to give a disidentification. I see he consulted with others, which is a good idea!
  • The unblock of those accounts previously alleged to be Brox/Dendrolo might be an error. They were likely socks of each other, if the situation is like that on lt.wiki. Their goal, it's not impossible, could have been to cast mud on Brox. What should be done on nl.wiki is up to that community, but probably there should be an apology to Brox/Dendrolo, and an unblock if there is a satisfactory behavioral agreement, which I really think should be little problem. I've seen Brox as a cooperative user, at least he was with me, even when I undid his RfC. Perhaps he had a bad day on nl.wiki. I also take Snooker as seeking resolution of what was, to him, a puzzle. A little w:WP:AGF can go a long way. --Abd 22:22, 12 August 2011 (UTC)[reply]

Henrda07@es.wikinews

Retiro a los autobloqueos de la lista de usuarios implicados pues no son usuarios ni pueden ser verificados per se. Estudiando la viabilidad de la solicitud (Note: reviewing this request) -- Dferg ☎ talk 21:32, 9 August 2011 (UTC)[reply]

¿Hay alguna razón para sospechar que Jgrullon88 es títere, salvo que supuestamente sean los dos usuarios de la misma procedencia? Saludos, -- Dferg ☎ talk 21:37, 9 August 2011 (UTC)[reply]
La herramienta de CheckUser se debe utilizar como último recurso, para casos difíciles de vandalismo o disrupción tal y como establece la correspondiente política. Si bien una evasión de bloqueo puede llegar a ser objeto de una solicitud, tras conversar con el usuario solicitante por IRC y analizar lo aquí expuesto no puedo encontrar razones para llevar a cabo la solicitud por la siguientes razones:
  • Los autobloqueos que aparecen en la lista automática de bloqueos pueden ser: o usuarios nuevos que comparten la dirección IP del usuario implicado tratando de editar e identificados por el sistema y bloqueados; o bien el mismo usuario iniciando sesión desde diferentes direcciones IP que el sistema asímismo bloquea. Ver Wikipedia:Bloqueo automático para más detalles. Como digo pueden ser usuarios o no pero la política no nos permite utilizar la herramienta para "salir de pesca" y ver lo que hay.
  • La segunda razón expuesta consiste en listar a un usuario aparentemente de la misma nacionalidad que el usuario bloqueado. Ser de un mismo país no está prohibido, no constituye un abuso ni por supuesto es razón para realizar una comprobación por lo expuesto anteriormente: no podemos "salir de pesca". No se han descrito comportamientos ni abusivos ni similares del segundo usuario listado y verificarla por ser supuestamente del mismo país, como digo, sería inapropiado y un mal uso de la herramienta.

Así pues, por tanto, esta petición no puede ser procesada. Si en el futuro apareciese alguna cuenta comportándose de modo similar al usuario bloqueado y cometiendo actividades que contravengan las políticas del proyecto sírvanse pedir verificación de nuevo.

Petición rechazada. --Dferg 21:55, 9 August 2011 (UTC)[reply]

Luoqwer@zh.wikipedia

But CU cannot give you the relationship between account and IP due to wmf's private policy. --Waihorace 13:38, 11 August 2011 (UTC)[reply]
It's funny that u guy only tell me this without telling others.--Zhxy 519 01:14, 12 August 2011 (UTC)[reply]
Fishing CheckUser is not for fishing fr33kman 01:31, 12 August 2011 (UTC)[reply]
Sorry to hear that. --Zhxy 519 04:35, 12 August 2011 (UTC)[reply]
Sorry, those are the rules. Make sure you reread the policy over again. Take care :-) fr33kman 05:20, 12 August 2011 (UTC)[reply]

Maddox@pt.wikipedia

The following request is closed: not done. Please do not modify it. No further edits should be made to this discussion.

See also