Wikimedia Meta-Wiki

Steward requests/Checkuser/2016-07

< Steward requests | Checkuser
Latest comment: 8 years ago by AntanO in topic Requests

Requests

Latest comment: 8 years ago66 comments21 people in discussion

Mitko12@bg.wikipedia

Status:    Done
List of users
Mitko12 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Mitko12345 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Sherifa123 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Hristo01 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Plovdiv12 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
The FM Boy (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Stefan012345672 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Dimitur12344 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
АдМинистратор (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Petko17 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): The first four accounts, together with a number of IP addresses, have recently been involved in a wave of vandalism across a number of pages, of notable example being bg:w:Диема Спорт, bg:w:Булсатком and bg:w:Феминизъм. I see this also caught the attention of some stewards and global-rollbackers like User:Tegel, User:Eurodyne, User:Matiia and User:HakanIST (thank you, guys!) According to our colleague User:The TV Boy, the vandals are most likely his former pals from the time a few years ago when he was leading a vandal group -- a group that had been terrorising our project for months (he later did mend his ways, though). A strong indication is both the group's modus operandi (with a particular focus on TV stations) and especially the personal harassment towards The TV Boy. In any case, I'd appreciate if you could confirm whether these accounts are sockpuppets, so that we can block them indefinitely without hesitation. Concerning the fifth account, Plovdiv12, he/she hasn't been involved in the vandalism acts, but his/her edits are almost the same as the few non-vandalism edits of the other four listed accounts. Plus, "Plovdiv" is the name of the city that group comes from, and "12[345]" is the typical naming habit of the group for their socks (though, of course, it's very common in general too). It will be especially helpful if any so far unrecognised socks can be identified as well. Many thanks in advance. — Luchesar V. ILIEV • T/C 20:38, 5 June 2016 (UTC)
Hello, I am bg:User:The TV Boy. I would like to add one more account to be checked: bg:user:The FM Boy, which is created especially to parody my username, used on bgwiki - The TV Boy. This harassment towards me continues for almost a month now and I would like to thank Luchesar for drawing attention to this problem. This vandal group originally spawned from the accounts bg:User:Модернатор (Modernator) and bg:User:Хейтър (Hater), after these accounts were blocked in 2011 the group halted for a while, but returned the previous month with direct attacks towards me, as well as other TV based articles, such as bg:Диема Спорт, bg:Диема, bg:Булсатком, bg:Хоум Бокс Офис, and others. I would really appreciate your help for the problem. Thanks in advance! --The Wiki Boy (talk) 22:47, 5 June 2016 (UTC)
I should probably add as a background info that the associated anonymous edits come so far from one specific ISP, Vivacom / Bulgarian Telecommunications Company, which is known for using DHCP with easily changeable addresses throughout their services: mobile and fixed. I've been thus forced to block entire network ranges to stop the persistent vandalism; the blocks are listed here (I also wouldn't be surprised if the vandal(s) pop up from another one -- this particular ISP has quite many -- as they had done previously). — Luchesar V. ILIEV • T/C 11:04, 6 June 2016 (UTC)
Hello, is there a reason why the check is delayed so much? There are couple more users with the same edit pattern as the listed above, but we need to see the results from the check in order to decide what to do next.--The Wiki Boy (talk) 19:58, 9 June 2016 (UTC)
We are all volunteers and this includes the checkusers. The check will be done when it's done. Also, I'd appreciate if you first share things about "couple more users" on our RfAA rather than here (unless you have very good reasons to add them directly to the request, which -- I agree here -- has been the case with User:The FM Boy). Let's really not complicate this any more than it's necessary. — Luchesar V. ILIEV • T/C 21:04, 9 June 2016 (UTC)
Added User:Stefan012345672 too. I'm afraid this really resembles very much the schizophrenic case from five years ago. Some of the puppets then presented themselves as mere "bystanders", yet were making suspiciously similar edits to the other socks; others were playing "vigilantes", mixing combating the vandalism of other socks with their own acts of vandalism; and there were even "the really good guys", who got caught only by the CU. It's exactly this "multiple personality disorder" on behalf of the socks that makes these cases so complicated: if they were pure vandals, we would've blocked them right away without any need for a CU. In the end, I'll probably block them all only on the basis of "reasonable suspicion", but any corroborating evidence from the CU would definitely be much appreciated. — Luchesar V. ILIEV • T/C 08:47, 10 June 2016 (UTC)
Added User:Dimitur12344. Pretty sure Plovdiv 10 [stalktoy] – [cross-wiki edits] is also involved, but their last edits are from almost an year ago, so not CU-able. The Wiki Boy, were these (Stefan012345672 and Dimitur12344) the two "other" users you had been referring to? — Luchesar V. ILIEV • T/C 09:01, 10 June 2016 (UTC)
And another two, although the one named "АдМинистратор" is to be blocked anyway only because of the name: "Administrator" in Bulgarian. This is yet another flashback of the previous case: the ring master, Модернатор, was a play on the word "moderator" in Bulgarian. — Luchesar V. ILIEV • T/C 09:13, 10 June 2016 (UTC)
The other two that I was referring to are Ivan1234567891011 (talk • contribs • block • xwiki-contribs • xwiki-date (alt) • CA • gblock • ST • lwcheckuser), and bg:User:АдМинистратор. Can't add the "Ivan" user account to the check board because it says "max 10 users". The "Ivan" account showed up the previous week. Plovdiv 10 (talk • contribs • block • xwiki-contribs • xwiki-date (alt) • CA • gblock • ST • lwcheckuser) also seems to be an incarnation of user "Plovdiv12". Also, as Luchesar pointed out the account "АдМинистратор" showed up, paralleling the name of bg:User:Администратор, who was blocked last year because the name literally means "Administrator". I am pretty sure that one and the same person stands behind those accounts.--The Wiki Boy (talk) 12:33, 10 June 2016 (UTC)
And one more pop-up Триъгълник (talk • contribs • block • xwiki-contribs • xwiki-date (alt) • CA • gblock • ST • lwcheckuser) (Triangle).--The Wiki Boy (talk) 13:39, 10 June 2016 (UTC)
Indeed, the same edit pattern. Thx. — Luchesar V. ILIEV • T/C 13:43, 10 June 2016 (UTC)

┌───────────────────────┘
 And yet one more: Виваком [stalktoy] – [cross-wiki edits]. This one bears the name of the involved ISP I mentioned earlier, Vivacom (Виваком in Bulgarian) / Bulgarian Telecommunications Company, and the user states on their page that the account is operated by Vivacom employees. The edit pattern however is the typical one for the group. — Luchesar V. ILIEV • T/C 17:18, 11 June 2016 (UTC)

Another one, Ivan001234567 [stalktoy] – [cross-wiki edits]. Pretty sure this one comes from a different IP, because the original IP–at least the one I suspect to be behind most of these accounts (not going to put it here for reasons of privacy)–apparently got caught by the autoblock: it has never missed a day without (mixed vandal/semi-productive/"vigilante") edits since May 1st, yet after I started blocking some of the suspected socks, it suddenly ceased editing. I'll wait a bit more and then will block it directly and indefinitely (or for a pretty long period). As a bonus, whoever is behind the IP has also already admitted in their own words to being behind User:The FM Boy. But while I already feel pretty confident about the extent of the vandal group and their IP ranges, I'll still very much appreciate any additional confirmation from a CU. I'll also be grateful for any suggestions on additional IP ranges to block (beside the ones already listed here), especially if they are suspected open proxies (of which we already have quite a bunch of networks blocked due to rather heavy vandalism from different sources recently). Many thanks in advance again. — Luchesar V. ILIEV • T/C 12:26, 12 June 2016 (UTC)
Feminism has again been vandalised in the very same way as it was the first time this case caught my attention. I suppose this might be a retaliation for the blocks that I started to impose on the suspected socks. The address is from a different network (obviously, as the original ones are still blocked), but from the same ISP. I wouldn't be surprised if the aforementioned User:Ivan001234567 comes from that very block too (though not from the same very address, because of the autoblock; but as mentioned earlier, this ISP is known for using DHCP, which is very easily abused for vandalism: with each reset, the cable/DSL modem picks up a different address from the pool). — Luchesar V. ILIEV • T/C 13:33, 12 June 2016 (UTC)
Yet one more, Ivan00123456 [stalktoy] – [cross-wiki edits], which is quite obviously a sock. This might come from the IP I mentioned earlier, because one of the autoblocks expired a minute before the account was created (and it may have been the one that caught it). Because the topic becomes pretty long, here's a table with all suspected accounts (I'll be updating it with any new ones):
— Luchesar V. ILIEV • T/C 18:08, 12 June 2016 (UTC)
So, the vandal behind those socks apparently became nervous and sloppy and tried—rather stupidly—to gain access to my (sysop) account. This of course revealed their IP address and it turned out to be the one I had already been strongly suspecting and which seemed affected by the autoblock that I mentioned earlier. Needless to say, the IP is now blocked indefinitely. I'm pretty sure they'll try to continue with their vandalism from other addresses though, and therefore I'd be grateful if you don't mind me keeping the case open here. It's quite probable that I'll need your assistance if the vandal decides to retaliate by a new wave of massive vandalism. Thanks.
— Luchesar V. ILIEV • T/C 15:24, 16 June 2016 (UTC)
The vandal behind this sock puppet group turned out to be with IP <deleted>, identifying himself as "TV-FEN". So far there is a probability that he might try avoiding the block using other IP, but if you can still check if there are any other sock puppets that this IP registered that yet don't have edits, but might be used for vandalism in the future.--The Wiki Boy (talk) 16:31, 16 June 2016 (UTC)
That's not necessary. The IP is prohibited from editing even through registered accounts and the other accounts can simply be blocked based on their edit pattern. I'm rather more interested in open proxies that the socks might've used or any other network ranges indeed, so I can possibly (depending on the collateral damage estimate) block them too. — Luchesar V. ILIEV • T/C 17:00, 16 June 2016 (UTC)
I've also removed the IP from your post. It's visible in other places (e.g. the diff I provided earlier), and I feel we shouldn't make it more public than absolutely necessary. Sorry about this.
— Luchesar V. ILIEV • T/C 17:14, 16 June 2016 (UTC)

моля за отблокиране на мобилната мрежата на Виваком в БГ Уикипедия, тъй като повече няма да правим лоши редакции в нея. За фиксираната мрежа -оставете я така,тъй като не правихме ние вандализмите там. Пишем тук, защото няма как да пишем на заявките към администраторите. 

С уважение,

бивши вандали от мобилната мрежа на БТК. 212.5.158.32 06:52, 20 June 2016 (UTC)

  Confirmed list of locked accounts

-- masti <talk> 15:37, 24 June 2016 (UTC)

Outstanding! Thank you very much, indeed! — Luchesar V. ILIEV • T/C 17:25, 24 June 2016 (UTC)
masti, could you please check these too? Or are they not connected?
Cheers, — Luchesar V. ILIEV • T/C 19:34, 24 June 2016 (UTC)

  Confirmed

Special:Contributions/MariittsaUNI|contr]] · [[
Special:DeletedContributions/MariittsaUNI|deleted]] · block · log · block log · CA · guc · checkuser · lwcheckuser)

--masti <talk> 14:22, 25 June 2016 (UTC)

I have locked and two other accounts simmilar to the pattern used above (The * Boy) by the confirmed accounts on the lists above. But unlocked the later as they are not the part of the sockpuppet group. masti <talk> 21:09, 28 June 2016 (UTC)

Pending

Two more. The second one may in fact be unrelated, but the intuition strongly tells me from the edit pattern that it is, even though the tactics has apparently been changed:

masti, when you have time for it, could you also please review the things that I wrote you about off-wiki. Thanks! — Luchesar V. ILIEV • T/C 13:22, 27 June 2016 (UTC)

Apparently, they're active again...

— Luchesar • T/C 18:31, 30 June 2016 (UTC)

This one may either belong to the group above, or be part of the PavelStaykov group, more precisely connected with the recent sock Dulovokil146 [stalktoy] – [cross-wiki edits] (en:w CU):

— Luchesar • T/C 11:12, 1 July 2016 (UTC)

P.S. A second one added. This seems like an indication that they are part of the current investigation after all, rather than the one from en:w that I mentioned above. — Luchesar • T/C 12:24, 1 July 2016 (UTC)

Graaf_Statler@nl.wikiquote (2)

Status:    Done
List of users
Graaf_Statler (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Zinloos, zinloos. (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Sirtaki hop hop hop. (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Kon het ff niet laten, maar stop er nu mee. (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Sunset Boulevard were the Sun Is Shining (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
  • CU log
  • Discussion: The saga continues
Reason(s): User continues to return to NL-WQ with self-confessed sock puppets which he says he creates through proxies. Don't need confirmation these are sock puppets, that much is clear, but can you identify the proxies through which these are created and through which he logs in and can these be locked down? Whaledad (talk) 18:16, 30 June 2016 (UTC)
I do not see any evidence for use of proxies. The user has connected either through a fixed ADSL line or a public wi-fi network. You can try to range block 217.166.253.0/24 Ruslik (talk) 17:19, 8 July 2016 (UTC)

Some more cross wiki insulting accounts

Status:    Done
List of users
Ip80.123 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Maxjob314 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
ChryslerMEcoupe (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Kreuzdessüdens (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Stephan S, der Coole (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Ungerechtfertigter Sperrer (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Bbb231 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Jebactegojwbe (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): The requested accounts have been blocked today, see Steward requests/Global#Global block for Ip80.123 and the following some 8 requests; they belong to one and the same user; the edits: harassment and heavy insulting. The accounts are not new, all have been created a time ago; we must assume that there are some accounts like these ones. Pls see what is possible to do. -jkb- 13:15, 1 July 2016 (UTC)
Done; I found no other accounts. The data from the creation is already too old. --MF-W 20:03, 1 July 2016 (UTC)
Thanks. It was just an idea, the chance to find another ones was too small - the accounts that have been editing today were created a long time ago and activated just today; I am sure there are some more ones, but we can get them only when reactivated.
By the way, I suppose all accounts have been operated by one person - ? If yes: it wouldbe good to note the range for the case, the vandal will start his harassment and insulting again.
Thanks. -jkb- 20:31, 1 July 2016 (UTC)
Yes indeed. I noted down the IP (they all just used one). --MF-W 15:26, 2 July 2016 (UTC)
Wau! -jkb- 15:33, 2 July 2016 (UTC)

AmirMuhammad1@fa.wikipedia

Status:    Done
List of users
AmirMuhammad1 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
PersianGuyz (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

Reason(s): User:AmirMuhammad1 has been blocked for 3 months since July 1st. According to this discussion, three other users and I believe that user:PersianGuyz (created on July 2nd) is the new sockpuppetry of user:AmirMuhammad1. There are some signs, for instance, this history of a template which is created by user:AmirMuhammad1 and used by PersianGuyz on their user page. They both have also voted in several AFDs. Some examples: 1, 2, 3. MRG90 (talk) 22:06, 2 July 2016 (UTC)

  Confirmed Ruslik (talk) 13:23, 7 July 2016 (UTC)

Θεσσαλονικάρα@el.wikipedia

Status:    Done
List of users
Θεσσαλονικάρα (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
ΣΕ ΘΕΛΩ (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Νικόλας Παπαποστόλου 3 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Νικόλας Παπαποστόλου 2 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Jeremy GMA (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Stratos 2003 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
SJ GMA (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

Reason(s): User Θεσσαλονικάρα asked (as an IP) block for user Νικόλας Παπαποστόλου "for creating sock puppets" (Νικόλας Παπαποστόλου 2, Νικόλας Παπαποστόλου 3 and Γιουγκοσλαβια - the former name of Νικόλας Παπαποστόλου). Both the accounts where blocked as user Νικόλας Παπαποστόλου said they parodied his user name. Given the speed that user Θεσσαλονικάρα, for whom there is no evidense that checks recent changes, marked the user as sock puppet plus that the relations between the two users are tense, makes it possible that user Θεσσαλονικάρα actually created the accounts to punish Νικόλας Παπαποστόλου.

The edits of Θεσσαλονικάρα (and IPs used), are very similar to that of Γιάννης 10, who has been blocked for extensive use of puppets. User ΣΕ ΘΕΛΩ is a recent possible sock, blocked for aggresive behavior. Also, one of the first edits of Θεσσαλονικάρα was to edit the page of Jeremy GMA (related with Stratos 2003 -sock puppet or just friend - and SJ GMA -possible sock). --C messier (talk) 17:29, 27 June 2016 (UTC)
I confirm that Νικόλας Παπαποστόλου 3, Νικόλας Παπαποστόλου 2 and Θεσσαλονικάρα belong to the same person. However I found no evidence that they are related to Γιάννης 10 and their socks. Ruslik (talk) 17:34, 8 July 2016 (UTC)
He was confirmed by duck test. --C messier (talk) 09:48, 9 July 2016 (UTC)

AzorAhai@fa.wikipedia

Status:    Not done
List of users
AzorAhai (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
مهرنگار (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): User Mehrnegar (user:مهرنگار) made this page and nominated user:AzorAhai for Bureaucrat permission in fa@wiki and inserted her vote. But they have lots of semi edit in fa wiki and we think they are same! . 151.244.27.105 06:41, 28 June 2016 (UTC)
This request is unreasonable.. Both users are super active and really old and well known to the communityAmir (talk) 20:56, 2 July 2016 (UTC)
But I sent many reasons in persian lang to @Mardetanha:! --151.244.58.4 04:32, 3 July 2016 (UTC)
  Not done We do not accept CU requests from unregistered users. Ruslik (talk) 17:07, 8 July 2016 (UTC)
@Ruslik0:Why not? I'm active user in lots of projects but i couldn't sign this request with my username! U can ask a question about this request from @Mardetanha: --151.244.3.111 10:11, 11 July 2016 (UTC)

Tikeem pees at Oracle Arena@enwikisource

Status:    Done
List of users
Tikeem pees at Oracle Arena (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
HurricaneFan26 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
ThisAccountIsblocked (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

Reason(s): Local vandal definitely, with indications that there is a xwiki vandal. Please identify the range and place a local IP or IP range block at enWS, if this cannot be handled globally. If such block is not possible, please identify to s:Administrators' noticeboard that an IP range is not possible and we will see what other defences are required. Thanks.  — billinghurst sDrewth 04:22, 9 July 2016 (UTC)

Addendum. These three accounts have all vandalised at a broader level at enWS in the past week, and have subsequently been blocked, so the requirement is the prevention of future issues.
Results

@Billinghurst:

  • Group 1: ThisAccountIsblocked and ThisAccountIsblocked1
  • Group 2: Tikeem pees at Oracle Arena and HurricaneFan26
  • Group 1 and Group 2   Likely/  Confirmed related.
  • You'll be sent an email.

—MarcoAurelio 12:08, 9 July 2016 (UTC)

Zhangrehan@wuuwiki

Status:    Done
List of users
Zhangrehan (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
UCAS-translation (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): Create almost the same nonsense pages. Stang 07:05, 11 July 2016 (UTC)
You can just block them. Why do you need CU information? Ruslik (talk) 11:11, 11 July 2016 (UTC)
Yep, but maybe there's some sleppers there? But I am not quite sure. --Stang 14:42, 11 July 2016 (UTC)
  Confirmed. Esiymbro, 华丽的转身 and Dict2016 are   Possible. Ruslik (talk) 09:42, 12 July 2016 (UTC)

500ГОДИНИСТИГАТ@bg.wikipedia

Status:    Done
List of users
500ГОДИНИСТИГАТ (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Dulovokil146 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): Dulovokil146 is a known sock from enwiki of PavelStaykov [stalktoy] – [cross-wiki edits], blocked indefinitely there. We've allowed this particular sock to continue editing on bgwiki in the hope that he'll mend his ways after he promised he'll refrain from using other socks and open proxies (which he had extensively and aggressively abused in the past). Unfortunately, his behaviour has so far been on the verge of the acceptable. After numerous altercations, today a new user, 500ГОДИНИСТИГАТ, suddenly popped up and started making edits virtually identical to those of Dulovokil146 (the specific personal insults in the edit summaries are especially telling). Although the duck test passes, it's not entirely impossible that this is in fact another prank of Mitko12. Therefore, an additional confirmation from the CU tools would help us decide if the user has indeed betrayed the community's trust and if a permanent block, like on enwiki, should be imposed. Many thanks in advance! — Luchesar • T/C 11:45, 20 July 2016 (UTC)
@Iliev:
  •   Confirmed 500ГОДИНИСТИГАТ = Утигур
  • Dulovokil146 is   Unrelated to the named above as far as I can see.
—MarcoAurelio 10:16, 26 July 2016 (UTC)
Thank you very much, that was indeed very helpful! — Luchesar • T/C 10:57, 26 July 2016 (UTC)

Strong lookpla@th.wikipedia

Status:    Done
List of users
Strong lookpla (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
A.R.M.Y TH (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Special A.R.M.Y. TH (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Special A.R.M.Y. TH2 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
EXODUS EX'Act (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
OVERDOSE EX'ACT (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Hello I Am EXO-L TH (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): These accounts create nonsense and hoax articles (absence celebrities) --Ken-Z! Talk 09:31, 26 July 2016 (UTC)
@Mopza:
  • Strong lookpla, A.R.M.Y TH, Special A.R.M.Y. TH and Special A.R.M.Y. TH2 are   Stale

.

  • As for the others,   Confirmed OVERDOSE EX'ACT = EXODUS EX'Act = Hello I Am EXO-L TH
—MarcoAurelio 10:39, 26 July 2016 (UTC)

ΣΕ ΘΕΛΩ@el.wikipedia

Status:    Done
List of users
ΣΕ ΘΕΛΩ (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
2021..με τα τσαρούχια! (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Κακός και Κάκιστος (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Βάλε Προφυλακτικό (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Εύχρηστο Σπιρτόκουτο (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): User ΣΕ ΘΕΛΩ, interested in "destroying wikipedia", has clearly created some puppets (either he admited or confirmed by duck test) that have been blocked. User 2021..με τα τσαρούχια! was created and his first edits was one saying that he will be blocked because of his name and the other saying "he is new user". Clearly a puppet, but is it from the previously mentioned user. C messier (talk) 21:36, 26 July 2016 (UTC)
2021..με τα τσαρούχια! is a sock of Κακός και Κάκιστος / Εύχρηστο Σπιρτόκουτο. Ruslik (talk) 12:59, 27 July 2016 (UTC)

Ajutorulprobei@ro.wikipedia

Status:    Done
List of users
Ajutorulprobei (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Probajutor (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
GulubuntzBudulush (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): Users Probajutor and GulubuntzBudulush have been blocked for sockpuppetry and vandalism. User Ajutorulprobei (with a similar name) registered today and seems to follow the same behavioural pattern. It would be extremely helpful for us to have a technical confirmation of our suspicion via CU. Please add any other relevant information needed in order to solve this case (related accounts, including anonymous IPs with disturbing activity). Thank you. --Pafsanias (talk) 12:26, 29 July 2016 (UTC)
  Confirmed Ruslik (talk) 17:49, 29 July 2016 (UTC)
Thank you for your prompt response. --Pafsanias (talk) 18:35, 29 July 2016 (UTC)

Tsukuyo-yomi@ta.wikipedia

Status:    Done
List of users
Tsukuyo-yomi (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Susanoo-no-mikoto (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Vimrahij (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Rivanya_Shithik (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Brindavijay03 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Devmahatma (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Jaswanth11 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
171.76.148.133 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
Reason(s): These users engaged in editing/creating similar articles that not support as EV. Also, they failed to accept the senior/sysop editors guidance that resulted block on the main ID. I would request to check is there any users/IPs links to these accounts. AntanO 11:55, 30 July 2016 (UTC)
Susanoo-no-mikoto, Vimrahij, Brindavijay03, Devmahatma and Jaswanth11 are   Stale. Tsukuyo-yomi and Rivanya_Shithi are   Confirmed to belong to the same user. Ruslik (talk) 17:50, 30 July 2016 (UTC)
Thanks for the quick action. --AntanO 18:39, 30 July 2016 (UTC)
Retrieved from "https://meta.wikimedia.org/w/index.php?title=Steward_requests/Checkuser/2016-07&oldid=24907320"