Jump to content

Commons:Requests for checkuser

From Wikimedia Commons, the free media repository

Shortcuts: COM:CHECK • COM:RFCU • COM:SOCK

This is the place to request investigations of abuse of multiple accounts or of other circumstances that require use of checkuser privileges.

Requesting a check

These indicators are used by CheckUsers to allow easier at-a-glance reading of their notes, actions and comments.
Request completed
Confirmed  Technically indistinguishable
Likely  Possilikely
Possible Unlikely
Inconclusive Unrelated
 No action Stale
Request declined
Declined Checkuser is not for fishing
Checkuser is not magic pixie dust. 8ball The CheckUser Magic 8-Ball says
 It looks like a duck to me Checkuser is not a crystal ball.
Information
Additional information needed Deferred to
 Doing…  Info

Please do not ask us to run checks without good reason; be aware of the following before requesting a check:

  1. Checkuser is a last resort for difficult cases; pursue other options first, such as posting on the administrator's noticeboard. (This is not a venue for requesting administrative action such as blocks or file clean-up.)
  2. Running a check will only be done to combat disruption on Commons, or as required to assist checkuser investigations on other Wikimedia wikis.
    • Valid reasons for running a check include, for example: vandalism where a block of the underlying IP or IP range is needed and suspected block evasion, vote-stacking, or other disruption where technical evidence would prevent or reduce further disruption.
    • Requests to check accounts already confirmed on other projects may be declined as redundant.
    • Requests to run a check on yourself will be declined.
  3. Evidence is required. When you request a check, you must include a rationale that demonstrates (e.g., by including diffs) what the disruption to the project is, and why you believe the accounts are related.
    • Requests to run a check without evidence or with ambiguous reasoning will result in delays or the request not being investigated.
  4. The privacy policy does not allow us to make a check that has the effect of revealing IP addresses.

Outcome

Responses will be brief in order to comply with Wikimedia privacy policy. Due to technical limitations, results are not always clear. Closed requests are archived after seven days.

Privacy concerns

If you feel that a checkuser request has led to a violation of the Wikimedia Foundation privacy policy regarding yourself, please refer the case to the Ombuds commission.

If this page is displaying outdated contents even after you refresh the page in your browser, please purge this page's cache.

To request a check:

Cases are created on subpages of Commons:Requests for checkuser/Case.

Creating a request
  • Insert the name of the suspected sockpuppeteer (the main account or puppetmaster, not the sockpuppet!) in the box below, leaving out the "User:" prefix. Do not remove the text in the box, add to the end only.
  • Please explain/justify the request by saying what it is you suspect and why it is important that the check be carried out. Indicate the usernames you suspect, using {{checkuser}}. Please do not use this template in the section header, as that makes it difficult to read the account names. Include the diffs or links required to support the request and reason for it.
  • There are people to assist you and help with maintenance of the page. Just ask for help on the admin noticeboard if you really are stuck, or take your best shot and note that you weren't completely sure of what to say.
  • If a case subpage already exists, edit the existing page instead, either adding to the currently open section (if the case is not yet archived) or adding a new section to the top using {{subst:Commons:Requests for checkuser/Inputbox/Sample}} (if the case has been archived). When editing an existing case, be sure to list/transclude the subpage here.
Example
If you want to request a checkuser on User:John Doe, enter the text Commons:Requests for checkuser/Case/John Doe then click "Request a checkuser". You will be taken to a page where you can fill out the request. Please make your request there brief and concise.


Then transclude your subpage on the top of the list at Commons:Requests for checkuser and remove {{Checkuser requests to be listed}} from the top of the case subpage.

Checkuser requests to be listed (empty)
nothing found

Requests

[edit]

Rickard Elofsson

[edit]

Status: resolved • view • edit • history • watch
Filed: 07:46, 13 March 2025 (UTC)

[edit]

Rationale, discussion and results

[edit]

Reason: Hi, never posted a checkuser here before but I've been suspicious about some things on en:Kevin Marx Norén and stumbled on to what I believe is a sock farm. I've got some points of connection, and several timelines.

Connections:

1. All five of the listed accounts were created on the same day, that being yesterday, and several within a few hours or even just a few minutes of each other. If you click the "logs" links above, you'll see that Kamps was created at 8:12, Andresson at 8:17, Smith at 8:40, Engstrom at 10:39, and Smith at 16:44.

2. All five have suspiciously similar one-line bios, some of which sound like they could be AI-generated. Verbiage generally seems the same, as they do with en:User:Rickard Elofsson. Both Smith and Engstrom include the phrase "proud photographer."

3. All five include a full name rather than a username, which is a bit unusual.

4. Most importantly, all five's contribs have, up to this point, solely to re-upload photos from the Norén article that had previously been deleted (see timeline).

Timeline(s):

  • 11 March, 15:03: File:Kevin Marx Noren Live photo (2023).png is deleted by @Krd: for "VRT: invalid ticket permission."
  • 12 March, 8:15: Cara Kemps re-uploads what I believe is the same photo (original title is a little more ambiguous, but figured it via process of elimination) as File:Kevin Marx Norén First Game At Berry Events Center, (2023).jpg.

==

==

==

==

==

==

My suspicion is that these were created in an attempt to make the file permissions look legit as being sourced from "real" people, while hoping nobody dug around to realize all of what I've posted above. The Kip (talk) 07:46, 13 March 2025 (UTC)[reply]

I have the same impression and already mentioned the sockpuppet suspision here... Xgeorg (talk) 08:22, 13 March 2025 (UTC)[reply]
Confirmed --Krd 08:28, 13 March 2025 (UTC)[reply]
@Xgeorg Glad I wasn't the only one. @Krd, considering they're fairly active on enwiki, is there anything I should do over there, or does a sock-block here also get them blocked over there? The Kip (talk) 08:46, 13 March 2025 (UTC)[reply]
@The Kip: I don't know the details, but I believe accounts with evidence of sockpuppetry are blocked on English Wikipedia. Please ask on en:Wikipedia:Administrators' noticeboard. Thanks, Yann (talk) 10:40, 13 March 2025 (UTC)[reply]

Karthikfan

[edit]

Status: resolved • view • edit • history • watch
Filed: 15:51, 12 March 2025 (UTC)

[edit]

Rationale, discussion and results

[edit]

Reason: All accounts (created today) share the same flickrwashing source https://flickr.com/photos/202388330@N02/ (also created today, I blacklisted it) for uploads. --Achim55 (talk) 15:51, 12 March 2025 (UTC)[reply]

Confirmed, all blocked an nuked. --Krd 12:04, 13 March 2025 (UTC)[reply]

Lucyspears

[edit]

Status: resolved • view • edit • history • watch
Filed: 11:13, 11 March 2025 (UTC)

[edit]

Rationale, discussion and results

[edit]

The account Minhquoc12390, which uploaded copyright-violating images, has been confirmed as a sockpuppet of Lucyspears. I have discovered that the account Danhhung2323 has engaged in similar behavior by uploading copyright-violating images of artists, actors, and singers as well. A review of the activity logs suggests that Minhquoc12390 and Danhhung2323 follow a similar pattern in naming their uploaded files. I respectfully invite CU to investigate the connection between these accounts.

Thank you for your time and consideration, P. ĐĂNG (talk) 10:13, 11 March 2025 (UTC)[reply]

 It looks like a duck to me, account is now blocked and uploads are deleted. --Krd 14:38, 11 March 2025 (UTC)[reply]
@Krd Anything related to Funny Man 1999 recent case? Phương Linh (talk) 23:49, 11 March 2025 (UTC)[reply]
No. Krd 12:00, 13 March 2025 (UTC)[reply]

Rdftgghkkoiygvguu

[edit]

Status: resolved • view • edit • history • watch
Filed: 12:48, 11 March 2025 (UTC)

[edit]

Rationale, discussion and results

[edit]

Reason: This disturbing edit caught my attention, and I noticed that in addition to uploading the same kind of sexual content, one account posted messages on the other accounts, see Special:Contributions/Johnnyexpwiki. Christian Ferrer (talk) 12:48, 11 March 2025 (UTC)[reply]

Technically Inconclusive. --Krd 14:28, 11 March 2025 (UTC)[reply]

Funny Man 1999

[edit]

Status: resolved • view • edit • history • watch
Filed: 02:25, 11 March 2025 (UTC)

[edit]

Rationale, discussion and results

[edit]

Repeating the same behavior as the other socks. All the Best -- Chuck Talk 02:25, 11 March 2025 (UTC)[reply]

It's Inconclusive if this account is relatet to the mentioned others, but at least this appears to be LTA, so blocked and nuked. --Krd 07:16, 11 March 2025 (UTC)[reply]
@Alachuckthebuck and Krd: : I can confirm this as DUCK. They are blocked on viwiki for mass-importing viwiki file, some of them do not meet Commons guidelines (lack description, author, or have VRT pending tags). Since 2024, there have been a lot of accounts repeating the same behavior, so I believe there are still sleepers. Phương Linh (talk) 10:49, 11 March 2025 (UTC)[reply]

Moses E Joseph Philip

[edit]

Status: resolved • view • edit • history • watch
Filed: 02:05, 11 March 2025 (UTC)

[edit]

Rationale, discussion and results

[edit]

Reason: user:Moses E Joseph Philip was blocked for self-promotion. After the block, a new user with a similar name has appeared to upload similar files (User_talk:Pastor_Rev_Moses_E_Joseph_Philip#File:Moses.Philip.jpg, User_talk:Pastor_Rev_Moses_E_Joseph_Philip#File:MosesPhilip.jpg). Activity overlap is also found at simplewiki, please see w:simple:Special:Diff/10125901 for the report. MathXplore (talk) 02:05, 11 March 2025 (UTC)[reply]

Please also see w:Wikipedia:Sockpuppet investigations/Moses E Joseph Philip. MathXplore (talk) 02:17, 11 March 2025 (UTC)[reply]
Confirmed, also Pastor Moses Philip (talk • contribs • Luxo's • SUL • deleted contribs • logs • block user • block log ) --Krd 14:26, 11 March 2025 (UTC)[reply]

Jorse García

[edit]

Status: resolved • view • edit • history • watch
Filed: 05:31, 9 March 2025 (UTC)

[edit]

Rationale, discussion and results

[edit]

Reason: There is a high coincidence between the two suspicious accounts in the persistent uploading of Hollywood movie logos, all of them assuming that they are licensed under Creative Commons, when it is obvious that they do not have these licenses. The users have a similar pattern with another account already blocked globally, Erickpérez596 (talk · contributions · Statistics). I have the additional suspicion that one of the suspected accounts bears a striking resemblance to my username, since I was the one who detected the Erickpérez596's puppet. Taichi (talk) 05:31, 9 March 2025 (UTC)[reply]

Confirmed CRITOEP7 = Taichanx. --Krd 05:02, 10 March 2025 (UTC)[reply]

Wemerson Inácio da Silva

[edit]

Status: resolved • view • edit • history • watch
Filed: 12:29, 7 March 2025 (UTC)

[edit]

Rationale, discussion and results

[edit]

Reason: Very same behavior of Emerson and Wemerson Inácio da Silva (talk · contribs), the latter already banned. Probably a duck, but perhaps there are more of them. RodRabelo7 (talk) 12:29, 7 March 2025 (UTC)[reply]

Confirmed --Krd 05:06, 10 March 2025 (UTC)[reply]

Anonymous Hong Kong Photographer 1

[edit]

Status: open • view • edit • history • watch
Filed: 00:42, 24 February 2025 (UTC)

[edit]

Rationale, discussion and results

[edit]

Reason: Raised by m:Requests for comment/Blatant sockpuppetry in good faith, it looks like there may also have sleepers IDK before?! Liuxinyu970226 (talk) 00:42, 24 February 2025 (UTC)[reply]

See Category:Sockpuppets of Anonymous Hong Kong Photographer 1. There are over 650 of these sockpuppets, without a main account that the user is associated. The name "Anonymous Hong Kong Photographer 1" is a term that describes this user by the community (this name was never created by this user). 〈興華街〉📅❓ 09:43, 24 February 2025 (UTC)[reply]
These are a real lot of accounts with a real lot of uploads each. What is the exact behaviour pattern? What is the proposed action against the confirmed socks? --Krd 12:14, 27 February 2025 (UTC)[reply]
Commons:Requests_for_checkuser/Case/Liauyu_Riuhwa#c-Elcobbola-2019-08-12T16:45:00.000Z-Rationale,_discussion_and_results. RoyZuo (talk) 13:21, 27 February 2025 (UTC)[reply]
What is the exact behaviour pattern?
  1. Extremely serious socking without a main account, even though there are no warnings to the user (except FoP-related deletion requests).
  2. Using strange names in accounts.
  3. Serious FoP-violation in respective countries/regions.
  4. Systematic, but inconsistent categorization.
  5. Creation of categories with bilingual names.
  6. User pages only created as galleries.
  7. Never replied in talk pages.
  8. Intentionally removing sockpuppetry tags.
  9. Indirect disclosure of personal information.
What is the proposed action against the confirmed socks?
Getting the user globally locked. And if new socks appear, immediately lock it. 〈興華街〉📅❓ 15:33, 27 February 2025 (UTC)[reply]
There is no use by means of using the admins' noticeboard as this is now a difficult case. The best thing to do is to get the new accounts locked and contribs deleted just like what used to be done with MOHLEAOSONDWN 2300. If this was taken into account, he is deliberately evading blocks, and this is spamming. 〈興華街〉📅❓ 15:49, 27 February 2025 (UTC)[reply]
There are different instances of Confirmed, Likely and  It looks like a duck to me here. All blocked. --Krd 15:58, 10 March 2025 (UTC)[reply]
@Krd: Thanks! See also Category:Sockpuppets of Anonymous Hong Kong Photographer 1.   — 🇺🇦Jeff G. ツ please ping or talk to me🇺🇦 16:27, 10 March 2025 (UTC)[reply]
For the record, I'm currently deleting all uploads of two dozens of the socks mentioned here or found directly connected. Is is real large amount of files, but the majority of them has FOP issues and it is impossible to evaluate them one by one or even crop them individually. The files can be restored by anybody without notice if the issues can be resolved. Krd 18:45, 10 March 2025 (UTC)[reply]
@Krd: Thanks! Along the way, if you could identify the oldest account, that would help with naming.   — 🇺🇦Jeff G. ツ please ping or talk to me🇺🇦 15:41, 11 March 2025 (UTC)[reply]
Impossible to determine. Krd 06:41, 12 March 2025 (UTC)[reply]
@Krd what is this user's abuse for you using checkuser tool here, and then blocking them? can you give some links?
How has this case differed from Commons:Requests for checkuser/Case/Liauyu Riuhwa which was thrown out by @Elcobbola, and multiple community discussions that concluded without any punitive action taken against this user? RoyZuo (talk) 19:25, 11 March 2025 (UTC)[reply]
The mentioned checkuser case is 5 years old, so this abuse, i.e. uploading unfree files after warnings, continues for more than 5 years with hundreds of socks. Krd 06:40, 12 March 2025 (UTC)[reply]
@Krd what do you mean by "unfree files"?
The latest community consensus Commons:Village pump/Archive/2024/11#Derivative works (FOP etc.) is that such derivative works are neither discouraged nor prohibited.
Are you aware of a different community consensus on the matter of derivative works restricted on commons due to com:fop com:packaging etc., that justify a massive deletion by you a single user overriding community discussions and community consensus? If yes, please link.
And what's percentage of such files being unfree due to com:fop com:packaging etc. relative to the total number of files you nuked? Does it reach double digit (>=10%)? RoyZuo (talk) 08:49, 12 March 2025 (UTC)[reply]
I think they are above 50%. What consensus shall that be? Please provide a link. Krd 16:59, 12 March 2025 (UTC)[reply]
I feel that blanket deletion of HKTA ("Hong Kong Throwaway Account") uploads is inappropriate and unwarranted. I'm not even sure we can really say that HKTA has been warned about anything, unless the warning is left during an account's three-day activity period. DS (talk) 14:23, 13 March 2025 (UTC)[reply]

Ricardinho da Souza Silva 7

[edit]

Status: resolved • view • edit • history • watch
Filed: 15:10, 11 February 2025 (UTC)

[edit]

Rationale, discussion and results

[edit]

Reason: All of these accounts -some only registered on Commons- started making banking edits here, and some of them continued the same behavior at eswiki. All of them have similarities to Ricardinho da Souza Silva 7. --Stïnger （会話） 15:10, 11 February 2025 (UTC).[reply]

FYI, I've just found and added six more to the list. --Stïnger （会話） 16:22, 12 February 2025 (UTC).[reply]
+Two more. Will be still updating if I find more. --Stïnger （会話） 15:06, 13 February 2025 (UTC).[reply]
I'm calling MatiasGugli, Iroha suzuki, Chilenopw and Ployol Inconclusive for the moment. The rest is high Likely. If there are accounts to add or to check in more detail, please advise. --Krd 15:37, 10 March 2025 (UTC)[reply]
I've rollbacked all of the vandalism by Klimut and Umbento. Only one sock had extant uploads and I've deleted them as copyright violations. The Squirrel Conspiracy (talk) 00:11, 11 March 2025 (UTC)[reply]


For older requests, please see Commons:Requests for checkuser/Archives
Retrieved from "https://commons.wikimedia.org/w/index.php?title=Commons:Requests_for_checkuser&oldid=1009236708"