Wikipedia:Requests for checkuser/Case/Malber

[edit] Malber

• Malber (talk • contribs • logs • block user • block log • checkuser)
• Hindlich (talk • contribs • logs • block user • block log • checkuser)

• Code letter: F (block log)

Hindlich (talk · contribs) vandalised a number of mainspace pages with Image:Giveitup.jpg, a spoof banner that reads "give us you fucking money" which was uploaded to Commons by Malber (talk · contribs). Given Malber's previous history of vandalism to meta content of pages, the use of the banner fits his MO. I blocked his account on Commons but he maintains that the vandalism is unconnected - if Hindlich is his, a Community ban is probably in order so it seems worth confirming the abuse of multiple accounts for cross-project vandalism before requesting a ban. Malber's account on en.wiki is no doubt stale, but his Commons account (Checkuser) should provide the necessary IP data. I ask that this request be deferred to Lar, as someone with checkuser access on both projects and will notify him of it. WjBscribe 22:04, 12 November 2007 (UTC)

Likely Malber (talk · contribs) = KurdzenWeys (talk · contribs). Likely also for Hindlich (talk · contribs), but less likely than KurdzenWeys, so would still prefer Lar to consult on this. --Deskana (talk) 22:25, 12 November 2007 (UTC)

Also adding Diet Coke Drinker (talk • contribs • logs • block user • block log • checkuser) who appeared on Hindlich's talk page, promising more socks. Mr.Z-man 22:44, 12 November 2007 (UTC)

Likely Diet Coke Drinker = Hindlich. Again, would still prefer Lar's input. --Deskana (talk) 22:53, 12 November 2007 (UTC)

Happy to help, can you send me your nonpublic data, findings and analysis so far so I can avoid repeating checks that aren't needed... ++Lar: t/c 23:40, 12 November 2007 (UTC)

Actually never mind. The evidence is solid, I'd use confirmed myself, but I won't go beyond what Deskana does

• Very Likely that Commons:Malber == en:wp:Diet Coke Drinker == en:wp:Hindlich == KurdzenWeys

There are a bunch more en:wp socks on the IP that Hindlich and DCD are on, not all are blocked. The IP itself is blocked on en:wp and Commons... Do you need a list of the additional socks? Hope that helps. ++Lar: t/c 00:47, 13 November 2007 (UTC)

A sock list would be useful. Are they also likely/confirmed Malber or should they be checked for similar behaviour? Is the IP at all shared with good users, or should we consider hardblocking it? WjBscribe 01:26, 13 November 2007 (UTC)

None on commons, they're all here so easily checkable by you. I haven't checked in detail whether the contribs are all bad but spot checking showed a fair number of obvious attack userids etc. Deskana can give you the list if you would undertake to check them for me, or I can. There may be a good one in there somewhere. ++Lar: t/c 03:14, 13 November 2007 (UTC)

I sent WJBScribe a list of likelies privately. I can send it to other trusted admins on request. I did not post it here because I think some might be innocent. I'm asking WJBScribe to investigate and block and tag only those that show the behaviour pattern. ++Lar: t/c 12:14, 13 November 2007 (UTC)

From my investigations I am confident that the following are also Malber:

• Jeffrey O. Assmunch (talk · contribs)
• FisterQueen (talk · contribs)
• FisherQueer (talk · contribs)
• Anonymous1139 (talk · contribs)
• Pduffy52 (talk · contribs)
• KurdenWeys (talk · contribs)
• AccioBroom (talk · contribs)
• Xsiverider (talk · contribs)

I have tagged them accordingly and blocked those not previously blocked. WjBscribe 17:15, 13 November 2007 (UTC)

[edit] Malber

• Malber (talk • contribs • logs • block user • block log • checkuser)
• Vodak (talk • contribs • logs • block user • block log • checkuser)
• 4chanpwr (talk • contribs • logs • block user • block log • checkuser)

• Code letter: F (block log)

Malber (talk · contribs) is presently blocked for two months for vandalism (adding Harry Potter spoilers to RfAs) using the sockpuppet 4chanpwr (talk · contribs) and attacks made when his sockpuppetry was discovered. Vodak (talk · contribs)'s activity has mainly been in two periods when Malber has been blocked: April 2007 and late July 2007 onwards. There is behavioural evidence connecting the two acounts as well: (1) Vodak has recently been asking all RfA candidates to provide a copy of their CV, Malber made a similar point previously asking all RfA condidates to reveal their ages and qualifications and (2) there is a similarity in the style of their posts. WjBscribe 15:20, 8 August 2007 (UTC)

I endorse this request, as the original blocking admin of Malber. There is evidence tying the two accounts together, but not enough that we can be certain on the evidence's merits alone. A checkuser would greatly help us determine who is who. --Deskana (banana) 15:31, 8 August 2007 (UTC)

Confirmed; they all seem to be the same person. --jpgordon^∇∆∇∆ 16:35, 8 August 2007 (UTC)