Wikipedia:Requests for checkuser/IP check

From Wikipedia, the free encyclopedia

[edit] Requests for IP check

This page lists requests to identify and block the IP addresses behind attack and vandal accounts that were previously listed at Requests for checkuser. After the account has been reported as blocked or declined by the checkusers, the report is moved here for seven days (most recent sections at the bottom), after which it is deleted. Because there is no attempt to establish a relationship with a puppetmaster account, no separate archive is kept, other than the page history.

Contents



[edit] Ossyrais

Claims in {{unblock}}[1] to be editing through a proxy (and will do so again using socks). Could you please identify the alleged proxy this user was editing through, and if it *is* an open proxy, block it? Cheers, Daniel.Bryant T · C ] 07:11, 8 December 2006 (UTC)

  • At the moment an effective block would take out a city-state. Sorry. Keep us posted. Mackensen (talk) 13:19, 8 December 2006 (UTC)

[edit] Bobabobabo

Based off of her use of contribs, it has been proven that this user is a sockpuppet of a banned user, but we may need the IP to check if she is once, again, using an open proxy to edit (and if there are other accounts on the OP).—Řÿūłóñģ (竜龍) 03:28, 8 December 2006 (UTC)

Confirmed Check these IPs for proxies (one is the same as a previous check).

Let us know if more turn up. Essjay (Talk) 03:50, 8 December 2006 (UTC)

[edit] Another Michael a/k/a Mike Garcia a/k/a Johnny the Vandal sock parade

It looks like our old friend Michael (talkcontribslogsblock userblock log) a/k/a Mike Garcia (talkcontribslogsblock userblock log) a/k/a Johnny the Vandal is back again with yet another sock parade. He has made a ton of "John * Robinson" usernames, targeting the talk pages of Arwel Parry (talk contribs), Curps (talk contribs), and Kungfuadam (talk contribs) by inserting profanity and pornographic pictures, and when blocked, he uses the {{unblock}} tag by claiming to be Hephaestos (talk contribs) and losing his password. Can the source of this latest sock parade be identified? Scobell302 23:14, 7 December 2006 (UTC)

  • Just to clarify, checkuser evidence indicates that this is Mike Garcia evading blocks/bans through sockpuppets? Daniel.Bryant T · C ] 23:39, 7 December 2006 (UTC)
  • Checkuser indicates a disruptive mess that seems an awful lot like Mike Garcia. Mackensen (talk) 13:21, 8 December 2006 (UTC)

Update: It looks like we're not done yet:

All of these accounts were created at least 18 hours after the initial report/check.

[edit] Cleanup and WP:PNT vandal

Wikipedia:Pages needing translation into English has recently been disrupted by an editor creating lots of throwaway accounts used to change {{notenglish}} to {{db-notenglish}}, even if the page does not meet WP:CSD#A2. Unfortunately many of these pages get deleted by admins. This seriously disrupts WP:PNT, which needs time to assess the articles (we usually give them two weeks before deletion). Throwaway accounts doing this include:

Possibly related vandals disrupting a cleanup effort include

It would be nice if this user could be forced to use only one account; this account-hopping gives him almost perfect anonymity. If we can't find a way to stop disruption by this user or force him to use an identifiable account or IP, we'll have to give up WP:PNT. Kusma (討論) 11:54, 5 December 2006 (UTC)

  • One IP blocked. Keep us posted. Mackensen (talk) 12:14, 5 December 2006 (UTC)

Here's some more:

If you can't checkuser deleted edits, I can restore the relevant articles if necessary. Kusma (討論) 17:17, 6 December 2006 (UTC)

  • That would be helpful for the first two. Mackensen (talk) 18:17, 6 December 2006 (UTC)

More:

I'll keep you posted if I find more. Much of the speedy tagging is borderline or correct, but the account-hopping needs to stop. Kusma (討論) 19:45, 6 December 2006 (UTC)

  • Another IP identified and blocked. Mackensen (talk) 20:00, 6 December 2006 (UTC)

Even more, now with a new pattern:

Please do not remove this section yet, or move it somewhere else if it doesn't belong here, this is still an ongoing problem. Kusma (討論) 08:29, 7 December 2006 (UTC)

It goes on and on:

I'd really like to know what the point is. Kusma (討論) 21:03, 7 December 2006 (UTC)

  • Ours is not to reason why, Kusma. I've got this guy pinned though. If he pops up again, feel free to warn him that we're *this* close to contacting his university, so please cease the disruption. Mackensen (talk) 21:24, 7 December 2006 (UTC)

For completeness, here's another one from November (I haven't seen any new ones yet):

I hope that's all. Kusma (討論) 07:31, 9 December 2006 (UTC)

[edit] Jinxtengu

I, for one, am quite sick of watching this user stalk Persian Poet Gal (talk contribs) every time her page is unprotected. It's been going on for nearly a month. It would be nice if we could get an underlying IP address, and hopefully block the thing for a good long while if it's static. I'm not an admin, so I can't apply the block, but if anyone could, please note that the stalking has been out of control. BTW, sockpuppetry is obvious and not in question. Patstuart(talk)(contribs) 09:18, 27 November 2006 (UTC)

  • Are there any active within the last couple weeks? Mackensen (talk) 21:28, 7 December 2006 (UTC)
    • There were on November 27. The most recent I can find is User:JEENSK. Anyway, he's had an RCU on him before, and an IP blocked. And I guarantee he's not going to go away. -Patstuarttalk|edits 15:13, 8 December 2006 (UTC)
      • I've figured out a possible range block (203.37.0.0/16); we'll see how it goes. Mackensen (talk) 15:52, 8 December 2006 (UTC)
        • Thanks. I hope there's not too much collerateral damage, for sure. -Patstuarttalk|edits 17:44, 8 December 2006 (UTC)


[edit] Shinuta, template vandal

  • Code letter: C

Consider the subtle vandalism done by these accounts: [2] [3] [4] [5] [6] [7] [8] [9] - deceptive edit summaries are being used as a cover to insert shock images to high use templates. These accounts are clearly related. This is apparently a continuation of similar activity from a week ago. Please check if underlying IPs need to be blocked. Many thanks, --HappyCamper 03:13, 12 December 2006 (UTC)

Clerk note: moved from main RFCU section to here. Daniel.Bryant T · C ] 03:25, 12 December 2006 (UTC)
I blocked the IP 202.166.122.138 which was used for all the recent account creations, while the main IP he uses, 165.21.155.0/24, is still anon-only block. Hopefully that means he will be unable to edit through it any more. Any socks tagged or blocked by Luna and Daniel are ones based on this check. Dmcdevit·t 04:20, 12 December 2006 (UTC)


[edit] More template vandalism

He's back... MER-C 12:45, 12 December 2006 (UTC)

Added a second account in. Both at about the same time, targeting Talk:Main Page. Luna Santin 13:06, 12 December 2006 (UTC)
  • I've made a 48-hour range block. Mackensen (talk) 13:15, 12 December 2006 (UTC)


[edit] "The Template Vandal"

  • Code letter: C

More accounts I tracked down from macedonia (terminology) and previous main page FAs that apparently haven't been yet investigated. I don,t whether they have been block, but if that helps tracking more ips used by this user... All have engaged in the same sort of sneaky vandalism. Circeus 19:13, 12 December 2006 (UTC)

Clerk note: Moved from Wikipedia:Requests for checkuser/Case/daily featured article penis vandal since this is not a sockpuppet check on an established user but a request for an IP block (please read the directions). Also, see Wikipedia:Requests for checkuser/IP check for recent checks on the same user. Two of these IPs are probably open proxies, the rest are Singapore, which is where this fellow seems to be coming from lately. Thatcher131 19:41, 12 December 2006 (UTC)

Note: Are any of these less than 24 hours old? Mackensen (talk) 02:58, 13 December 2006 (UTC)

None. I just went through the list to check. --HappyCamper 03:05, 13 December 2006 (UTC)
Sounds like the rane block is holding (165.21.155.0/24). Mackensen (talk) 03:11, 13 December 2006 (UTC)

[edit] User:Primetime

Declined I proxychecked it when I checkusered it; it's not a proxy that I can tell. Essjay (Talk) 05:42, 13 December 2006 (UTC)

I wasn't sure so I asked here. Thanx for both. 68.39.174.238 05:49, 13 December 2006 (UTC)
No problem. Essjay (Talk) 05:58, 13 December 2006 (UTC)