Wiktionary:Requests for checkuser
Not to be confused with WT:CHU.
Request for CheckUser investigation
Information
A CheckUser investigation is a method by which certain Wiktionary users are able to determine IP and device information for logged in users, information which is normally hidden by the MediaWiki software. This ability allows them to determine whether a given set of usernames are or are not connected to a specific IP address, range, ISP or geographical region. Because of the privacy implications, CheckUser requests are only to be used with long-term, persistent suspected sockpuppets and vandals. More information can be found on the Meta policy page. If you feel that your privacy has been violated through the misuse of this tool by a CheckUser enabled person, there is a CheckUser ombudsman service available.
Policy
- CheckUser investigations will only be conducted with the following cause:
- with reasonable suspicion of the misuse of sockpuppets, including block evasion, persistent vandalism and vote fraud (a suspected sockpuppet may be investigated solely as a result of its edit behaviour if this reflects that of a persistent vandal);
- to identify an underlying IP range of a persistent vandal in order to prevent likely repeat vandalism;
- upon the request of a user to be checked themselves for cause.
- CheckUser enabled users are restricted in their use of the tool by the Meta CheckUser policy.
Procedure
- If a CheckUser investigation is in order, request one below including the following information:
- Usernames and IPs suspected of association.
- Concise examples of reasons for suspicion (diffs and deletion logs).
- Other applicable notes and comments.
- Sign your request.
- If the CheckUser investigation is merited, a CheckUser investigation will be made, with the results posted on this page.
- The results of an investigation are posted in a very succinct manner, per Wikimedia's privacy policy requirements. Because of the nature of the tool, often results will be inconclusive and no determination is possible.
| Indicator |
|---|
 Confirmed
|
 Likely
|
 Possible
|
 Inconclusive
|
 Unrelated
|
 Additional information needed.
|
 Note:
|
 Declined
|
 Checkuser is not for fishing.
|
 Rejected
|
Completed requests
All completed investigations are archived yearly at Wiktionary:Requests for checkuser/archive.
New requests
Looks very similar to Enix150 (talk • contribs • global account info • deleted contribs • nuke • abuse filter log • page moves • block • block log • active blocks), although the data may be too old to compare. — SURJECTION / T / C / L / 05:41, 4 January 2023 (UTC)
- @Surjection:
Likely. The IPs geolocate in the same area as one of Enix150's geolocations (there were at least a couple), and the device is consistent with one of Enix150's devices, if you allow for a year or so of software upgrades. The obsession with (mostly lame) portmanteus and blends is pretty distinctive, anyway. There was a case with Enix150 where I saw an IP editing a pretty normal existing entry on a slightly different IP address with a different device configuration, and I thought it must be unrelated- until I noticed that the entry had a blend in its etymology. Chuck Entz (talk) 15:15, 4 January 2023 (UTC)
- Aquatic Stoned Ape is still actively editing. But their last few edits have actually been high-quality (e.g., they've been providing citations). 70.172.194.25 06:57, 12 January 2023 (UTC)
Suspected sockpuppet of User:咽頭べさ. Thadh (talk) 16:29, 29 January 2023 (UTC)
- I'm not him, you can check my Ip. I've never edited Wiktionary pages only Talk User
- Sometimes I ask Octahedron80 something I want to know. Tmaoa492s (talk) 21:10, 29 January 2023 (UTC)
Inconclusive. The IP addresses are on different ISPs, but the geolocation is close enough that I can't rule out one device that has access to two different Internet connections (mostly because geolocation isn't very good at pinning things down to precise physical locations). The device configurations are similar, but not identical- though I don't know enough about those to rule out it just being the same device using different browsers. In other words, it looks different but someone could fake that with the right setup. Chuck Entz (talk) 23:49, 29 January 2023 (UTC)
- I just want justice for User:咽頭べさ block him forever is too much maybe a month or 2 is enough. Tmaoa492s (talk) 01:20, 30 January 2023 (UTC)
And Technicalrestrictions01 (talk • contribs). Same style, appeared from nowhere to second one another in the same RFD discussion. —Al-Muqanna المقنع (talk) 15:48, 28 February 2023 (UTC)
- @Al-Muqanna:
Confirmed, and both are socks of Beaneater00 (talk • contribs • global account info • deleted contribs • nuke • abuse filter log • page moves • block • block log • active blocks), as is the unused account Leroy Patterson IV (talk • contribs • global account info • deleted contribs • nuke • abuse filter log • page moves • block • block log • active blocks). All blocked. Chuck Entz (talk) 05:56, 1 March 2023 (UTC)
I think I know the answer, but this is Kamen Ugalj (talk • contribs) block evading, isn't it? Thadh (talk) 20:48, 3 March 2023 (UTC)
- Special:Contributions/87.116.160.193 another one. Thadh (talk) 17:54, 4 March 2023 (UTC)
@Thadh: that would require disclosing IP addresses used by a logged-in account, which I'm not allowed to do except under very limited circumstances. You might consider whether the recent edits by Special:Contributions/87.116.160.0/24 are bad enough to merit a block on their own. Chuck Entz (talk) 18:47, 4 March 2023 (UTC)
- By themselves they probably don't merit a block since the user was blocked for continuing to add ill-formated entries despite requests to stop and not answering to any communications, and I haven't approached the IPs yet. Thadh (talk) 19:50, 4 March 2023 (UTC)
And 72.138.91.178 (who has been blocked for a week). The account has added the error-ridden entry كيبك (“Quebec”), which is pretty suspicious given that the IP had added أونتاريو (“Ontario”) shortly before being blocked, and also geolocates to Canada. The IP also added a (bunk) Mongolian entry at ї, while this user added a request to Wiktionary:Requested entries (Mongolian). Doesn't feel like a coincidence. Theknightwho (talk) 23:20, 3 March 2023 (UTC)
- @Theknightwho: as above, I can't tie IP addresses to logged-in accounts. Without running a check, though, I can see a similar pattern of adding translations in lots of unrelated languages and getting languages mixed up (Hungarian and Thai as well as Icelandic in Hebrew script at Jack Frost, all in the same edit- really?). It bears all the signs of vacuuming up data from word lists and/or transwiki links and spewing it here without checking. Chuck Entz (talk) 19:08, 4 March 2023 (UTC)
And Getsnoopy. This appears to be clearly related to WT:Beer parlour/2023/March#Getsnoopy and canonical forms. FYI @J3133 @Benwing2. Theknightwho (talk) 16:37, 25 March 2023 (UTC)
Unrelated. Wrong continent. Chuck Entz (talk) 18:35, 25 March 2023 (UTC)
Behaviorally very similar to Shāntián Tàiláng (talk • contribs). — SURJECTION / T / C / L / 22:05, 8 April 2023 (UTC)
- Confirmed and blocked. Two of their IP ranges are already blocked anonymous-only. There are unrelated accounts on one of them, so we can't increase the block to logged-in users. Chuck Entz (talk) 22:59, 8 April 2023 (UTC)
Possible logged-out editing after being blocked. I will not reveal the IP here in case I am wrong again about this user, though. — SURJECTION / T / C / L / 21:57, 27 May 2023 (UTC)
- @Surjection: I checked all of the IP ranges they've used, and none have done any logged-out editing recently, nor during any of their previous blocks. Chuck Entz (talk) 03:47, 28 May 2023 (UTC)
Looks a lot like Paragraphseven (talk • contribs). — SURJECTION / T / C / L / 08:49, 16 September 2023 (UTC)
- @Surjection: It's borderline: the device details are identical, if somewhat generic. They managed to find a new IP range, but the geography matches precisely. The behavior, though, was what convinced me: first, they created an account with the main IP range, Formerlybanned (talk • contribs • global account info • deleted contribs • nuke • abuse filter log • page moves • block • block log • active blocks), that they never used. Then they created this account using a foreign proxy before starting to edit normally with the main IP range. The latter is something this person has done before: originally it was necessary to get around IP-range user-creation blocks, but not this time. Combined with the editing patterns, it looks solid enough to me. Chuck Entz (talk) 12:55, 16 September 2023 (UTC)
- Recycled1 (talk • contribs • global account info • deleted contribs • nuke • abuse filter log • page moves • block • block log • active blocks) — SURJECTION / T / C / L / 07:51, 18 September 2023 (UTC)
- Soulfulmoves (talk • contribs • global account info • deleted contribs • nuke • abuse filter log • page moves • block • block log • active blocks), Contactpage1 (talk • contribs • global account info • deleted contribs • nuke • abuse filter log • page moves • block • block log • active blocks), Goodcriteria (talk • contribs • global account info • deleted contribs • nuke • abuse filter log • page moves • block • block log • active blocks), Sundaydriver1 (talk • contribs • global account info • deleted contribs • nuke • abuse filter log • page moves • block • block log • active blocks), Oliver201013 (talk • contribs • global account info • deleted contribs • nuke • abuse filter log • page moves • block • block log • active blocks) are all obviously them, but there are probably more accounts (e.g. sleepers or ones that I'm forgetting). — SURJECTION / T / C / L / 07:19, 1 December 2023 (UTC)
- @Surjection: The first three are Confirmed, but Oliver201013 seems unrelated, while Sundaydriver1 consistently uses a different browser and a different IP range (proxies geolocating to another continent), so Inconclusive at best. The problem is that the tendency to do masses of mediocre entries based on content scraped from Wikipedia and similar sources seems to have been picked up by several editors: StuckinLag Toad and VGPaleontologist come immediately to mind. My gut tells me that Sundaydriver1 is somebody we've dealt with before, but the checkuser tool doesn't find anything actionable. Chuck Entz (talk) 18:34, 1 December 2023 (UTC)
- One obvious sock was Russianmenaresosexy (talk • contribs • global account info • deleted contribs • nuke • abuse filter log • page moves • block • block log • active blocks). Breeca (talk • contribs • global account info • deleted contribs • nuke • abuse filter log • page moves • block • block log • active blocks) is almost certainly related. — SURJECTION / T / C / L / 07:18, 7 December 2023 (UTC)
- @Surjection Confirmed. Really boring: all the same IP ranges, so it looked exactly like last week's with a couple of new accounts and their edits added. Chuck Entz (talk) 14:52, 7 December 2023 (UTC)
- @Chuck Entz Another one: Mynewfiles (talk • contribs • global account info • deleted contribs • nuke • abuse filter log • page moves • block • block log • active blocks) has similar editing patterns to Goodcriteria above, including quirks like always changing ‘person’ to ‘individual’ in definition lines when adding wikilinks. — Vorziblix (talk · contribs) 13:11, 17 April 2024 (UTC)
- @Surjection
- One obvious sock was Russianmenaresosexy (talk • contribs • global account info • deleted contribs • nuke • abuse filter log • page moves • block • block log • active blocks). Breeca (talk • contribs • global account info • deleted contribs • nuke • abuse filter log • page moves • block • block log • active blocks) is almost certainly related. — SURJECTION / T / C / L / 07:18, 7 December 2023 (UTC)
- @Surjection: The first three are
- Soulfulmoves (talk • contribs • global account info • deleted contribs • nuke • abuse filter log • page moves • block • block log • active blocks), Contactpage1 (talk • contribs • global account info • deleted contribs • nuke • abuse filter log • page moves • block • block log • active blocks), Goodcriteria (talk • contribs • global account info • deleted contribs • nuke • abuse filter log • page moves • block • block log • active blocks), Sundaydriver1 (talk • contribs • global account info • deleted contribs • nuke • abuse filter log • page moves • block • block log • active blocks), Oliver201013 (talk • contribs • global account info • deleted contribs • nuke • abuse filter log • page moves • block • block log • active blocks) are all obviously them, but there are probably more accounts (e.g. sleepers or ones that I'm forgetting). — SURJECTION / T / C / L / 07:19, 1 December 2023 (UTC)
- Recycled1 (talk • contribs • global account info • deleted contribs • nuke • abuse filter log • page moves • block • block log • active blocks) — SURJECTION / T / C / L / 07:51, 18 September 2023 (UTC)
Borderline incomprehensible rambleposting on WT:ES with very little matter-of-fact contribution? Sure sounds familiar. — SURJECTION / T / C / L / 13:35, 28 October 2023 (UTC)
- See also User talk:Chuck Entz § A sense of déjà vu.... PUC – 16:54, 28 October 2023 (UTC)
- As I said on my talk page, they were making decent contributions at the time, so I didn't feel comfortable running checkuser on them. I did say that the person in question can't keep it up for long, so if it was them that would change. Sure enough, they've unambiguously gone off the deep end. I ran a check on them, with predictable results. They're now blocked and their ramblings on the current ES page have been reverted. Chuck Entz (talk) 17:58, 28 October 2023 (UTC)
- @Chuck Entz UpperPolices (talk • contribs • global account info • deleted contribs • nuke • abuse filter log • page moves • block • block log • active blocks) — SURJECTION / T / C / L / 18:19, 20 January 2024 (UTC)
- Yep. Chuck Entz (talk) 18:31, 20 January 2024 (UTC)
- IncrediblyBendy (talk • contribs • global account info • deleted contribs • nuke • abuse filter log • page moves • block • block log • active blocks) — SURJECTION / T / C / L / 15:28, 7 April 2024 (UTC)
- Sorry I didn't have time to deal with it at the time- Confirmed and blocked. Chuck Entz (talk) 21:39, 7 April 2024 (UTC)
- Sorry I didn't have time to deal with it at the time-
- IncrediblyBendy (talk • contribs • global account info • deleted contribs • nuke • abuse filter log • page moves • block • block log • active blocks) — SURJECTION / T / C / L / 15:28, 7 April 2024 (UTC)
- Yep. Chuck Entz (talk) 18:31, 20 January 2024 (UTC)
- @Chuck Entz UpperPolices (talk • contribs • global account info • deleted contribs • nuke • abuse filter log • page moves • block • block log • active blocks) — SURJECTION / T / C / L / 18:19, 20 January 2024 (UTC)
- As I said on my talk page, they were making decent contributions at the time, so I didn't feel comfortable running checkuser on them. I did say that the person in question can't keep it up for long, so if it was them that would change. Sure enough, they've unambiguously gone off the deep end. I ran a check on them, with predictable results. They're now blocked and their ramblings on the current ES page have been reverted. Chuck Entz (talk) 17:58, 28 October 2023 (UTC)
Created the same day S ḳʷnṭHls (talk • contribs • global account info • deleted contribs • nuke • abuse filter log • page moves • block • block log • active blocks) was blocked. Exact same interests: PIE (particularly 'modernizing' transcriptions) and Kartvelian, and other behavioral similarities. — SURJECTION / T / C / L / 07:07, 1 November 2023 (UTC)
@Surjection Confirmed. Also Professor Pedantic (talk • contribs • global account info • deleted contribs • nuke • abuse filter log • page moves • block • block log • active blocks), which seems to be the original account Chuck Entz (talk) 08:11, 1 November 2023 (UTC)
Probably Yuzerneim (talk • contribs • global account info • deleted contribs • nuke • abuse filter log • page moves • block • block log • active blocks) - same interests. — SURJECTION / T / C / L / 09:30, 25 November 2023 (UTC)
Account spam
Whatever is going on with accounts like this and this, which are all obviously linked. — SURJECTION / T / C / L / 00:09, 25 December 2023 (UTC)
- @Surjection, Theknightwho: It's exactly what it looks like: they're all the same device on the same IP range. I blocked a few that you missed, but that's about it. Someone is obviously tinkering with the idea of setting up a bank of sleeper accounts that they can draw on after the checkuser data goes stale. The flaw in that approach is that such an unusual and unnatural pattern is enough to show that there's an overall plan behind the creations, and therefore reason to block them all. I don't think they're dumb enough to try that specific approach again, but I'm sure they'll be back. Chuck Entz (talk) 03:01, 25 December 2023 (UTC)
SamuelBilu (talk • contribs • global account info • deleted contribs • nuke • abuse filter log • page moves • block • block log • active blocks) removed an RFV tag (and the discussion from the RFV page!) out of process for luftgeschaeft, for which I blocked them. Now RandalKeithNorton (talk • contribs • global account info • deleted contribs • nuke • abuse filter log • page moves • block • block log • active blocks) has tried removing the tag as well - I suspect these are all accounts of the same person who insists we document this word. — SURJECTION / T / C / L / 09:30, 17 March 2024 (UTC)
- Homiebro (talk • contribs • global account info • deleted contribs • nuke • abuse filter log • page moves • block • block log • active blocks) as well — SURJECTION / T / C / L / 11:24, 17 March 2024 (UTC)
- @Surjection: This is a bit messy. These are all the same country, with the non-cellphone IPs in the same location and the cellphone IPs consistent with that location, if broader in area. RandallKeithNorton and SamuelBilu are probably the same person: the first logged out, then the second was created and edited using the same IP. They used different browsers and the IP was a proxy, so it's not 100%. It's also possible they were two people sharing the same internet connection. Homiebro seems to be a different person, but geographically in the same area. I do think they knew each other. My best guess is that Homiebro came up with the idea of removing the tags, then RandallKeithNorton eventually followed suite, first as SamuelBilu, then with their own account when SamuelBilu was blocked. Chuck Entz (talk) 15:56, 17 March 2024 (UTC)
SeaGrassSea
SeaGrassSea (talk • contribs • global account info • deleted contribs • nuke • abuse filter log • page moves • block • block log • active blocks); potentially block evasion of SnivyPokemon (talk • contribs • global account info • deleted contribs • nuke • abuse filter log • page moves • block • block log • active blocks). — SURJECTION / T / C / L / 07:27, 8 April 2024 (UTC)
2001:4C4D:204B:2100:417A:6C61:3374:CC55, 2001:4C4D:204B:2100:F478:564:65B4:70C, 2001:4C4D:204B:2100:7C68:2CEE:F26F:5BB6, 2001:4C4D:204B:2100:782B:A9FE:106C:FE0D, 2001:4C4D:204B:2100:D85B:394:C796:FE9C, 2001:4c4d:204b:2100:2534:93d3:bdd8:96a1, 2001:4c4d:204b:2100:a9fb:f1d8:f009:e5f7, 2001:4c4d:204b:2100:4d91:e10c:d8c1:58af
A Hungarian IP, creating a lot of stubs for minor languages. I suspect this is User:Rajkiandris evading the block. Vahag (talk) 18:15, 16 April 2024 (UTC)
- @Vahagn Petrosyan: Plausible, but the data the checkuser tool looks at only goes back 90 days and it's been a year and a half since they were blocked. I make a point of keeping data from most of my checks for future reference, but I never had reason to run a check on that account before it went stale. Chuck Entz (talk) 04:32, 17 April 2024 (UTC)
Equinox (oversight request)
I recommend oversight/suppression of this edit. Generally, sharing user-generated files like this isn't allowed. Also, this file possibly contains personal attacks or outing of other editors. We don't have oversight as a user right and this seemed the closest place Purplebackpack89 01:28, 30 May 2024 (UTC)
- I looked through it- pretty harmless. There's one zip file that might contain questionable content, but it's password-protected. Equinox has gone off the rails more than once, but always in an impulsive, uncontrolled manner. He just doesn't do devious, scheming things like that. Chuck Entz (talk) 06:25, 30 May 2024 (UTC)
- @Chuck Entz "Equinox has gone off the rails more than once, but always in an impulsive, uncontrolled manner" isn't exactly a ringing endorsement, particularly since hate slurs were part of his impulses. People have been indeffed for less. Sometimes it feels like there's one set of rules for people like Equinox and one set for the rest of us. Purplebackpack89 14:57, 30 May 2024 (UTC)
- There are all kinds of bad things people do here, but oversighting is only for ones that involve violations of privacy or very serious legal transgressions that need to be hidden even from admins. Your reasoning seems to be that there might be something bad in the file because Equinox might be trying to sneak in something improper. My point was that Equinox has never been known to try to sneak anything in, so that's just not plausible. Chuck Entz (talk) 15:19, 30 May 2024 (UTC)
- @Chuck Entz "Equinox has gone off the rails more than once, but always in an impulsive, uncontrolled manner" isn't exactly a ringing endorsement, particularly since hate slurs were part of his impulses. People have been indeffed for less. Sometimes it feels like there's one set of rules for people like Equinox and one set for the rest of us. Purplebackpack89 14:57, 30 May 2024 (UTC)
- @Purplebackpack89: "Generally, sharing user-generated files like this isn't allowed." According to? Ioaxxere (talk) 15:56, 30 May 2024 (UTC)
Wiktior
Wiktior (talk • contribs • global account info • deleted contribs • nuke • abuse filter log • page moves • block • block log • active blocks), probably Word0151 (talk • contribs • global account info • deleted contribs • nuke • abuse filter log • page moves • block • block log • active blocks). — SURJECTION / T / C / L / 11:34, 13 September 2024 (UTC)
- Likewise सम्पादकजी (talk • contribs • global account info • deleted contribs • nuke • abuse filter log • page moves • block • block log • active blocks). — SURJECTION / T / C / L / 11:14, 14 September 2024 (UTC)
- @Surjection Although all three geolocate to the same general region, सम्पादकजी is on a different ISP and geolocates to a specific city that neither of the other two have geolocated near. There's no conclusive evidence on the back end linking Wiktior, but at least they have used a couple of the same IP ranges, albeit months apart, and the device information is close enough that they could be the same- allowing for OS changes in between. In general, browser and OS/network software have been finding ways to progressively eliminate some of the most useful identifying information in web interactions, so it's not as easy to be sure of anything anymore. So Wiktior is a judgment call, but सम्पादकजी is not all that likely. I can't rule out that the latter might be the same person consistently using a different device that geolocates differently because it's using a different ISP, but that's nothing the checkuser tool can say much about. Chuck Entz (talk) 22:35, 14 September 2024 (UTC)
Kulinkuu
Kulinkuu (talk • contribs • global account info • deleted contribs • nuke • abuse filter log • page moves • block • block log • active blocks). Probably same as:
- Kamen Ugalj (talk • contribs • global account info • deleted contribs • nuke • abuse filter log • page moves • block • block log • active blocks)
- Zhunov316 (talk • contribs • global account info • deleted contribs • nuke • abuse filter log • page moves • block • block log • active blocks)
- Peuro (talk • contribs • global account info • deleted contribs • nuke • abuse filter log • page moves • block • block log • active blocks)
- and many others, including IP editing
— SURJECTION / T / C / L / 19:34, 13 November 2024 (UTC)
- @Surjection: Kamen Ugalj (talk • contribs • global account info • deleted contribs • nuke • abuse filter log • page moves • block • block log • active blocks) and Peuro (talk • contribs • global account info • deleted contribs • nuke • abuse filter log • page moves • block • block log • active blocks) are stale, so your guess is as good as mine. I can confirm that Zhunov316 (talk • contribs • global account info • deleted contribs • nuke • abuse filter log • page moves • block • block log • active blocks), Ekoprav (talk • contribs • global account info • deleted contribs • nuke • abuse filter log • page moves • block • block log • active blocks) and Dunav1918 (talk • contribs • global account info • deleted contribs • nuke • abuse filter log • page moves • block • block log • active blocks) are all the same, but their IPs geolocate literally a thousand miles away from Kulinkuu (talk • contribs • global account info • deleted contribs • nuke • abuse filter log • page moves • block • block log • active blocks)'s. The latter doesn't seem to overlap with anyone. Chuck Entz (talk) 04:48, 14 November 2024 (UTC)