Commons:Requests for checkuser

From Wikimedia Commons, the free media repository
Jump to navigation Jump to search

Shortcuts: COM:CHECK • COM:RFCU • COM:SOCK

This is the place to request investigations of abuse of multiple accounts or of other circumstances that require use of checkuser privileges.

Requesting a check

These indicators are used by CheckUsers to allow easier at-a-glance reading of their notes, actions and comments.
Request completed
Confirmed  Technically indistinguishable
Likely  Possilikely
Possible Unlikely
Inconclusive Unrelated
 No action Stale
Request declined
Declined Checkuser is not for fishing
Checkuser is not magic pixie dust. 8ball The CheckUser Magic 8-Ball says
 It looks like a duck to me Checkuser is not a crystal ball.
Information
Additional information needed Deferred to
 Doing…
 Info

Please do not ask us to run checks without good reason; be aware of the following before requesting a check:

  1. Checkuser is a last resort for difficult cases; pursue other options first, such as posting on the administrator's noticeboard.
  2. Running a check will only be done to combat disruption on Commons, or as required to assist checkuser investigations on other Wikimedia wikis.
    • Valid reasons for running a check include, for example: vandalism where a block of the underlying IP or IP range is needed and suspected block evasion, vote-stacking, or other disruption where technical evidence would prevent or reduce further disruption.
  3. Evidence is required. When you request a check, you must include a rationale that demonstrates (e.g., by including diffs) what the disruption to the project is, and why you believe the accounts are related.
    • Requests to run a check without evidence or with ambiguous reasoning will result in delays or the request not being investigated.
  4. The privacy policy does not allow us to make a check that has the effect of revealing IP addresses.
  5. Requests to run a check on yourself will be declined.

Outcome

Responses will be brief in order to comply with Wikimedia privacy policy. Due to technical limitations, results are not always clear. Closed requests are archived after seven days.

Privacy concerns

If you feel that a checkuser request has led to a violation of the Wikimedia Foundation privacy policy regarding yourself, please refer the case to the Ombuds commission.

If this page is displaying outdated contents even after you refresh the page in your browser, please purge this page's cache.

To request a check:

Cases are created on subpages of Commons:Requests for checkuser/Case.

Creating a request
  • Insert the name of the suspected sockpuppeteer (the main account or puppetmaster, not the sockpuppet!) in the box below, leaving out the "User:" prefix. Do not remove the text in the box, add to the end only.
  • Please explain/justify the request by saying what it is you suspect and why it is important that the check be carried out. Indicate the usernames you suspect, using {{checkuser}}. Please do not use this template in the section header, as that makes it difficult to read the account names. Include the diffs or links required to support the request and reason for it.
  • There are people to assist you and help with maintenance of the page. Just ask for help on the admin noticeboard if you really are stuck, or take your best shot and note that you weren't completely sure of what to say.
  • If a case subpage already exists, edit the existing page instead, either adding to the currently open section (if the case is not yet archived) or adding a new section to the top using {{subst:Commons:Requests for checkuser/Inputbox/Sample}} (if the case has been archived). When editing an existing case, be sure to list/transclude the subpage here.
Example
If you want to request a checkuser on User:John Doe, enter the text Commons:Requests for checkuser/Case/John Doe then click "Request a checkuser". You will be taken to a page where you can fill out the request. Please make your request there brief and concise.


Then transclude your subpage on the top of the list at Commons:Requests for checkuser and remove {{Checkuser requests to be listed}} from the top of the case subpage.

Checkuser requests to be listed‎ (empty)
nothing found

Requests[edit]

Elshad Iman (Elşad İman)[edit]

Status: open • view • edit • history • watch
Filed: 08:54, 18 July 2023 (UTC)

Suspected related users[edit]

Rationale, discussion and results[edit]

Reason: Something seems fishy here. Elshad Iman made a big fuss about Commons:Deletion requests/File:Rza Talıbov (şəxsi foto).jpg and [1]. Then Wikicosu and Gohsgun claim to be the same person (see respectively [2] and [3]). Then Elshad Iman denied Wikicosu and Gohsgun being him. Yann (talk) 08:54, 18 July 2023 (UTC)Reply[reply]

I also add Meta checkuser request thanks! Elshad Imanverified Verified 09:20, 18 July 2023 (UTC)Reply[reply]
I suggest to decline this. It appears likely that the two redlink accounts are related, but that's perhaps irrelevant. From the mentioned DR, "the person in the picture himself asked me to delete this picture" suggests that the subject makes some effort to get it deleted, but don't think these accounts are related to the uploader. Krd 09:46, 18 July 2023 (UTC)Reply[reply]
What about meatpuppetry? Yann (talk) 09:48, 18 July 2023 (UTC)Reply[reply]
See also [4]. Yann (talk) 09:57, 18 July 2023 (UTC)Reply[reply]

Cahue Mesquita Pereira[edit]

Status: open • view • edit • history • watch
Filed: 23:41, 15 July 2023 (UTC)

Suspected related users[edit]

Rationale, discussion and results[edit]

Reason: The old account, Cahue Mesquita Pereira (talk · contributions · Statistics · Recent activity · block log · User rights log · uploads · Global account information) was blocked for one week for keep uploading images that are copyright violations despite multiple warnings. Now, this new account, Pabx7890 (talk · contributions · Statistics · Recent activity · block log · User rights log · uploads · Global account information), uploaded the same image of the same person that Cahue Mesquita Pereira uploaded before. Note that Cahue Mesquita Pereira is likely a paid account hired to create an article for pt:Cassiano Araújo. They never edited anything else in the WP. DANYARTEEVINHO (talk · contributions · Statistics · Recent activity · block log · User rights log · uploads · Global account information) seem to be also involved. Kacamata! Dimmi!!! 23:41, 15 July 2023 (UTC)Reply[reply]

  • Stale - Pabx7890 has not edited since 2018; DANYARTEEVINHO has not edited since 2020. There would nothing to which to compare Cahue Mesquita Pereira. Эlcobbola talk 17:44, 16 July 2023 (UTC)Reply[reply]

Hankdong123[edit]

Status: resolved • view • edit • history • watch
Filed: 10:17, 14 July 2023 (UTC)

Suspected related users[edit]

Rationale, discussion and results[edit]

Reason: Confirmed at enwiki by me to each other at w:en:Wikipedia:Sockpuppet investigations/Hankdong123. Uploading deep fakes/harassment images of w:en:Stephan Trojansky to be used on said English Wikipedia article, for example:

Requesting investigation here to find any other accounts that may only exist on commons (e.g. opposite of Phucas420 (talk • contribs • Luxo's • SUL • deleted contribs • logs • block user • block log ) who exists only on enwiki). Dreamy Jazz talk to me | enwiki 10:17, 14 July 2023 (UTC)Reply[reply]

Srinesh.saravanan[edit]

Status: resolved • view • edit • history • watch
Filed: 17:35, 13 July 2023 (UTC)

Suspected related users[edit]

Rationale, discussion and results[edit]

Reason: After user Yashooda blocked user Royal Family Meghan stated to upload same type of images and user Muralikrishna m too engged in same edits and uploads. There user interests are same category - uploading indian celebrities images and not bother about copyvios. ~AntanO4task (talk) 17:35, 13 July 2023 (UTC)Reply[reply]

ADOAAODA[edit]

Status: resolved • view • edit • history • watch
Filed: 15:14, 11 July 2023 (UTC)

Suspected related users[edit]

Rationale, discussion and results[edit]

Reason: Apparent block evasion. Both users upload a number of similar images that depict the comedian Benjamín Rausseo and are copyright violations. See File:Er Conde Benjamín Rausseo.jpg (edit · last · history · watch · unwatch · global usage · logs · purge · w · search · links · DR · del · undel · Delinker log) (uploaded by ADOAAODA) and File:Benjamín Rausseo Conde.jpg (edit · last · history · watch · unwatch · global usage · logs · purge · w · search · links · DR · del · undel · Delinker log) (uploaded by Angel DO Aray). nicolas talkpage★★★ 15:14, 11 July 2023 (UTC)Reply[reply]

SahafatKaLover95[edit]

Status: resolved • view • edit • history • watch
Filed: 06:55, 11 July 2023 (UTC)

Suspected related users[edit]

Rationale, discussion and results[edit]

Reason: 95 uploaded photos which 18 is defending in a DR. SahafatKaLover18 has also uploaded similar image with a dubious claim of own work. Normally I would just block the one but referring here due to being involved in the DR Gbawden (talk) 06:55, 11 July 2023 (UTC)Reply[reply]

I've blocked the master for just over one month for abusing multiple accounts; it looks like Yann and I both tried to indefinitely block the sock at the same time. Will tag. — Red-tailed hawk (nest) 20:00, 11 July 2023 (UTC)Reply[reply]

Genairotheis09[edit]

Status: resolved • view • edit • history • watch
Filed: 08:22, 11 July 2023 (UTC)

Suspected related users[edit]

Rationale, discussion and results[edit]

Reason: All three accounts have been uploading barcodes for joining loyalty programs for Dutch supermarkets chains, and adding these to the article about the loyalty program and the supermarket (1, 2). Dutch news reported on a scam with this exact method last year (Sept 2022)- offering 'your' barcode to others so they can get a discount, while in fact people will pay 5%-10% more on their groceries (and that 5%-10% goes into a personal fund you can have paid out to you later).

Dutch community would like to know if Commons CU's 1) can identify sockpuppetry for these 3 accounts, and 2) if there are more accounts connected (and maybe more screenshots that need to be deleted).
Because of these suspected fraudulent activities I have for now blocked all three accounts on Commons and speedy-deleted the screenshot uploads of these users. Fyi: there is a CU request open on nlwp but because these accounts cannot do their work without uploading content to Commons, I think it would be justified to have the CU done on Commons, and maybe find more dormant accounts. Ciell (talk) 08:22, 11 July 2023 (UTC)Reply[reply]

  • Confirmed that Escobarontop = Genairotheis09; Stale is Bbqproducten. Эlcobbola talk 15:38, 11 July 2023 (UTC)Reply[reply]

ANUP SINGH 1952[edit]

Status: resolved • view • edit • history • watch
Filed: 03:41, 11 July 2023 (UTC)

Suspected related users[edit]

Rationale, discussion and results[edit]

Reason: The master is an account that has received warnings for not adhering to Commons' scope and for uploading personal files. The master account uploaded six such files to Commons while editing w:en:Draft:Thakur Anup Singh, which was later deleted as being overtly promotional. The files were deleted in May, but the sockpuppet account (which was registered on July 10) has re-uploaded several of the deleted files, as well as three such files that matched the exact name of those uploaded by the master (File:Thakur Anup Singh.jpg, File:Hasi Inaugration.jpg, and File:Early and personal life.jpg). A fourth file was re-uploaded by the new account under a different name (see: File:Thakur Anup Singh teamed.jpg and File:Management Photo.jpg). As such, the two accounts appear to be behaviorally connected in some way. If the two accounts are indeed the same person, then this would be evasion of scrutiny on Commons in light of the prior warnings they have received. I am requesting a checkuser examine this to evaluate the extent of technical connection between these two accounts. — Red-tailed hawk (nest) 03:41, 11 July 2023 (UTC)Reply[reply]

EroFlix[edit]

Status: resolved • view • edit • history • watch
Filed: 03:44, 10 July 2023 (UTC)

Suspected related users[edit]

Rationale, discussion and results[edit]

Reason: EroFlix is presently blocked for abusing multiple accounts after uploading unfree files following warnings. I recently encountered the sockpuppet above, who appears to be uploading photographs and listing the author as "EroFlix". I find this to be extremely odd if this were a coincidence, though I can't per se rule out impersonation. If these are the same person, this would be block evasion, and I am requesting CU to evaluate the extent of technical connection between these two accounts. — Red-tailed hawk (nest) 03:44, 10 July 2023 (UTC)Reply[reply]

  • Shorbenjo is a 9-year-old account that has primarily (exclusively?) uploaded spam images, generally with Bengali titles. That Shorbenjo suddenly paused using that account; created EroFlix and Artnilxen exclusively to upload porn with English titles, descriptions, and categories; and then resumed spamming (e.g., File:Raknil Avro.jpg was for vanity article w:Raknil Avro) with the Shorbenjo once caught seems like a stretch. Given that Raknil Avro is an actor involved in sex-themed films and that EroFlix is a sex-themed app, I think a better explanation is that "EroFlix" is a coincidence related to the sourcing/promoting the app rather than a reference to the account. Absent better evidence of a connection (e.g., Shorbenjo edits related to sex, or other subject matter overlap), I would be inclined to decline this. I will leave it for other CUs to opine. Эlcobbola talk 16:00, 11 July 2023 (UTC)Reply[reply]
    I think there are a lot of open questions. Why is Shorbenjo not blocked for behaviour? Why is EroFlix blocked for invalid reason, or why is the suspect related account Artnilxen not listed here? Krd 16:25, 11 July 2023 (UTC)Reply[reply]
    I'm not sure I follow the invalid reason. EroFlix's block rationale ("Abusing multiple accounts: Uploading unfree files after warnings") implies the block was for both reasons, and I don't disagree with either. Per the suggestion, I have now blocked Shorbenjo for the recent copyvios and long history of spam. Эlcobbola talk 18:05, 11 July 2023 (UTC)Reply[reply]
    My comment was based on that the first warning and the final block of EroFlix happend nearly at the same time, with no user action in between. Anyway, I think the case can be closed as there is nothing more to get. Krd 18:19, 11 July 2023 (UTC)Reply[reply]
    Fair enough. — Red-tailed hawk (nest) 18:41, 11 July 2023 (UTC)Reply[reply]

Khonarh[edit]

Status: resolved • view • edit • history • watch
Filed: 02:31, 10 July 2023 (UTC)

Suspected related users[edit]

Rationale, discussion and results[edit]

Reason: The sockmaster and the sockpuppet appear to have been dedicated largely to uploading non-free pictures of Keyshia Cole. The sockmaster was blocked for this activity on 5 July, and many images that they had uploaded were deleted. One such image was File:KeyshiaCole2021.jpg. The sockpuppet was created on 7 July and immediately re-uploaded the same image (albeit under a different name, File:Kcoleuncensored.jpg).The timing of the account creation, coupled with the re-upload of the same exact file, makes me suspect that the two accounts are run by the same individual. Because this would be block evasion, and the re-upload of files deleted for copyright-related reasons can be disruptive, I am requesting a checkuser take a look at this to examine the extent of technical connection between these two accounts. — Red-tailed hawk (nest) 02:31, 10 July 2023 (UTC)Reply[reply]

AzeriCux[edit]

Status: resolved • view • edit • history • watch
Filed: 08:08, 9 July 2023 (UTC)

Suspected related users[edit]

Rationale, discussion and results[edit]

Reason: AzeriCux, Joecivilie and 3Farabui3 uploaded Flickr-washed images (Flickr account Amir Dibok, see this DR) of assumed Iranian prostitutes which were deleted, re-uploaded, deleted again, and re-uploaded under different file names:

AzeriCux is possibly dormant now but has already been checkuser-blocked at en:wp by User:L235 and apparently also at fa:wp. --AFBorchert (talk) 08:08, 9 July 2023 (UTC)Reply[reply]

Since I was pinged, I'll provide what I have from enwiki for Commons CUs here: [5]. I doubt this will be too helpful though, although it includes some additional accounts. Best, Kevin (aka L235 · t · enwiki) 08:48, 9 July 2023 (UTC)Reply[reply]
Note all have some combination of interest in football, boot fetishism, fashion/cosplay and certain have similar Flickrwashing history. Эlcobbola talk 10:56, 9 July 2023 (UTC)Reply[reply]
Thanks! I've blocked all named accounts and opened Commons:Deletion requests/Files uploaded by Texasi9PCI with more cases of apparent Flickr-washing. --AFBorchert (talk) 12:04, 9 July 2023 (UTC)Reply[reply]
I blocked AzeriCux as well. Yann (talk) 08:23, 11 July 2023 (UTC)Reply[reply]

Kejiprro[edit]

Status: resolved • view • edit • history • watch
Filed: 01:57, 9 July 2023 (UTC)

Suspected related users[edit]

Rationale, discussion and results[edit]

Reason: Both users posting similar spam. Trade (talk) 01:57, 9 July 2023 (UTC)Reply[reply]

Inconclusive --Krd 16:11, 11 July 2023 (UTC)Reply[reply]

Hariramaswami[edit]

Status: resolved • view • edit • history • watch
Filed: 19:17, 5 July 2023 (UTC)

Suspected related users[edit]

Rationale, discussion and results[edit]

Reason: The sockmaster initially uploaded File:Dr. Aripirala Yogananda Sastry.jpg on 26 June, and the file was thereafter subject to a deletion request and deleted on 3 July. The first sockpuppet re-uploaded the same photograph to File:Aripirala Yogananda Sastry.jpg on 4 July. The second sockpuppet was used on multiple Wikis (such as the Russian Wikipedia, Italian Wikipedia, and Portuguese Wikipedia) to create articles about "Aripirala Yogananda Sastry", who appears to be the subject of these images. The account (much like the master), seems to be solely dedicated to this individual, and was created one day after the master was created.

If these accounts are run by the same individual, the use of multiple accounts would constitute evasion of scrutiny on Commons because:

  1. The account holder re-uploaded an image deleted at a prior deletion discussion from a second account, avoiding copyright scrutiny;
  2. Multiple accounts have received multiple warnings for the uploads of copyright violations; and
  3. The use of multiple accounts appears to be an attempt to conceal the use of Commons (and sister projects) as a tool for advertising/self=promotion.

I am requesting checkuser to evaluate the extent of technical connections between these three accounts that have been active on Commons. As a heads-up to the CU who decides to take a look at this, there is evidence on Simple Wiki of the use of colocation web hosts for spam related to this individual (see: these logs and these logs), so this may take a bit of time. — Red-tailed hawk (nest) 19:17, 5 July 2023 (UTC)Reply[reply]

Thank you for running the checks. Based off of these results, in conjunction with the behavioral evidence, I am going to indef everyone you've listed in the findings. I'm going to tag A and B as if they're the same farm; the technical being likely to each other + the behavioral evidence leaves me to conclude this is probably the best way to do it. I'm going to tag group C as suspected to each other, with a link to this page in the sockpuppet category. — Red-tailed hawk (nest) 03:48, 7 July 2023 (UTC)Reply[reply]
Also, as a note, I've tagged the master of A and B as "Amsterdam warner" due to the account having the oldest age. — Red-tailed hawk (nest) 20:30, 8 July 2023 (UTC)Reply[reply]
For older requests, please see Commons:Requests for checkuser/Archives
Retrieved from "https://commons.wikimedia.org/w/index.php?title=Commons:Requests_for_checkuser&oldid=784349972"