Commons:Requests for checkuser

Shortcuts: COM:CHECK • COM:RFCU • COM:SOCK

This is the place to request investigations of abuse of multiple accounts or of other circumstances that require use of checkuser privileges.

Requesting a check

These indicators are used by CheckUsers to allow easier at-a-glance reading of their notes, actions and comments.
Request completed
Confirmed Technically indistinguishable
Likely Possilikely
Possible Unlikely
Inconclusive Unrelated
 No action Stale
Request declined
Declined Checkuser is not for fishing
Checkuser is not magic pixie dust.8ball The CheckUser Magic 8-Ball says
 It looks like a duck to me Checkuser is not a crystal ball.
Information
Additional information needed Deferred to
 Doing… Info

Please do not ask us to run checks without good reason; be aware of the following before requesting a check:

  1. Checkuser is a last resort for difficult cases; pursue other options first, such as posting on the administrator's noticeboard. (This is not a venue for requesting administrative action such as blocks or file clean-up.)
  2. Running a check will only be done to combat disruption on Commons, or as required to assist checkuser investigations on other Wikimedia wikis.
    • Valid reasons for running a check include, for example: vandalism where a block of the underlying IP or IP range is needed and suspected block evasion, vote-stacking, or other disruption where technical evidence would prevent or reduce further disruption.
    • Requests to check accounts already confirmed on other projects may be declined as redundant.
    • Requests to run a check on yourself will be declined.
  3. Evidence is required. When you request a check, you must include a rationale that demonstrates (e.g., by including diffs) what the disruption to the project is, and why you believe the accounts are related.
    • Requests to run a check without evidence or with ambiguous reasoning will result in delays or the request not being investigated.
  4. The privacy policy does not allow us to make a check that has the effect of revealing IP addresses.

Outcome

Responses will be brief in order to comply with Wikimedia privacy policy. Due to technical limitations, results are not always clear. Closed requests are archived after seven days.

Privacy concerns

If you feel that a checkuser request has led to a violation of the Wikimedia Foundation privacy policy regarding yourself, please refer the case to the Ombuds commission.

Category:Sockpuppet investigations#Requests%20for%20checkuser

If this page is displaying outdated contents even after you refresh the page in your browser, please purge this page's cache.

To request a check:

Cases are created on subpages of Commons:Requests for checkuser/Case.

Creating a request
  • Insert the name of the suspected sockpuppeteer (the main account or puppetmaster, not the sockpuppet!) in the box below, leaving out the "User:" prefix. Do not remove the text in the box, add to the end only.
  • Please explain/justify the request by saying what it is you suspect and why it is important that the check be carried out. Indicate the usernames you suspect, using {{checkuser}}. Please do not use this template in the section header, as that makes it difficult to read the account names. Include the diffs or links required to support the request and reason for it.
  • There are people to assist you and help with maintenance of the page. Just ask for help on the admin noticeboard if you really are stuck, or take your best shot and note that you weren't completely sure of what to say.
  • If a case subpage already exists, edit the existing page instead, either adding to the currently open section (if the case is not yet archived) or adding a new section to the top using {{subst:Commons:Requests for checkuser/Inputbox/Sample}} (if the case has been archived). When editing an existing case, be sure to list/transclude the subpage here.
Example
If you want to request a checkuser on User:John Doe, enter the text Commons:Requests for checkuser/Case/John Doe then click "Request a checkuser". You will be taken to a page where you can fill out the request. Please make your request there brief and concise.

Then transclude your subpage on the top of the list at Commons:Requests for checkuser and remove {{Checkuser requests to be listed}} from the top of the case subpage.

Checkuser requests to be listed (empty)
nothing found

Requests

Altair Netraphim

Status: resolved • view • edit • history • watch
Filed: 02:59, 14 May 2025 (UTC)

Rationale, discussion and results

Reason: 0x0a pointed out at COM:AN that both accounts were forging metadata on their uploads of the same topic. I had previously seen these two accounts when deleting some of Nerissa Lyra's files as out of scope, and suspected they might be related, and 0x0a's new evidence was enough for me to run a check. The Squirrel Conspiracy (talk) 02:59, 14 May 2025 (UTC)

 Technically indistinguishable

The Squirrel Conspiracy (talk) 02:59, 14 May 2025 (UTC)

Added Candramawa99 (talk · contribs), there is overlapping edits between Candramawa99 and Altair Netraphim. And Candramawa99 was found recreating master's work. --0x0a (talk) 03:41, 14 May 2025 (UTC)
Unrelated
Also, the two deleted images at File:Yuliana Tasno.jpg are not the same. The Squirrel Conspiracy (talk) 03:47, 14 May 2025 (UTC)
 Comment, I encountered this group of users before when they mass-nominated their images for deletions. I remember I found it weird that some images would be uploaded by one user, credited to another, then another user nominated it for deletion. I thought there was some sort of socking going on, but after I checked their uploads, I found some group pictures of like the ones here Category:Wikimedia Yogyakarta (most were uploaded by the group). So rather than it’s one person behind all these accounts, I think possibly what happening is a very coordinated group editing physically together (not sure if this still counts as socking though). Tvpuppy (talk) 03:52, 14 May 2025 (UTC)
I saw those pictures as well, however there's some CheckUser data that that wouldn't explain. The Squirrel Conspiracy (talk) 05:11, 14 May 2025 (UTC)
The Squirrel Conspiracy: I'd suggest to add PenaTulip (talk • contribs • Luxo's • SUL • deleted contribs • logs • block user • block log ) to the investigation based on these three uploads and their edit histories. --Lymantria (talk) 11:00, 14 May 2025 (UTC)

@Lymantria: I've changed the status from Confirmed to Technically indistinguishable and unblocked all the accounts per an email that I've pasted at https://checkuser.wikimedia.org/wiki/Commons/Altair_Netraphim#Email_response. The Squirrel Conspiracy (talk) 17:09, 14 May 2025 (UTC)

Okay, Thanks for sharing. I understand. --Lymantria (talk) 17:13, 14 May 2025 (UTC)
 Oppose Data don’t lie. Minky Avelin is at least a meat-puppet of Altair Netraphim, who involved in swaying discussions. --0x0a (talk) 20:08, 14 May 2025 (UTC)
Have you actually looked at those discussions? They were Minky Avelin's uploads, which Altair Netraphim nominated for deletion, and Minky Avelin agreed with the nominations. The Squirrel Conspiracy (talk) 23:17, 14 May 2025 (UTC)

Miticr21

Status: resolved • view • edit • history • watch
Filed: 08:45, 12 May 2025 (UTC)

Rationale, discussion and results

Reason: Suspected of using multiple accounts to upload copyvios. Same interest in uploading sports venues pictures, overlapping edits on en.wiki, two with similar usernames. 0x0a (talk) 08:45, 12 May 2025 (UTC)

Likely. --Krd 17:02, 12 May 2025 (UTC)
@Krd: Sorry, I missed Nikoskoukos21 (talk · contribs). This look like a DUCK. --0x0a (talk) 07:16, 13 May 2025 (UTC)
Also Likely. --Krd 03:44, 14 May 2025 (UTC)

Crimea Republic

Status: resolved • view • edit • history • watch
Filed: 14:55, 9 May 2025 (UTC)

Rationale, discussion and results

Reason: Gut feeling after it interacted with another which had similar edits Cyberwolf (talk) 14:55, 9 May 2025 (UTC)

 It looks like a duck to me The evidence provided is insufficient for running a check, however it's clear that this is a sock. No comment on whose sock. The Squirrel Conspiracy (talk) 21:51, 9 May 2025 (UTC)

Heraamall1994

Status: resolved • view • edit • history • watch
Filed: 13:38, 9 May 2025 (UTC)

Rationale, discussion and results

Reason: Recreation of the same deleted files — D Y O L F 77[Talk] 13:38, 9 May 2025 (UTC)

Confirmed that the following are the same user:

Likely that the following is the same user as the above:

Based on upload history, I'm confident in an indef for Parrot175 regardless.

Indiskovar3 is stale, but per the presented behavioral evidence I've marked them as the master and moved the case page accordingly.

@Dyolf77: Thanks. The Squirrel Conspiracy (talk) 22:24, 9 May 2025 (UTC)

@The Squirrel Conspiracy, I am keeping an eye on that! Thanks! -- — D Y O L F 77[Talk] 13:29, 10 May 2025 (UTC)
I hereby add Heraamall10 (talk • contribs • Luxo's • SUL • deleted contribs • logs • block user • block log ) per Special:Diff/1031500802.   — 🇺🇦Jeff G. ツ please ping or talk to me🇺🇦 02:09, 14 May 2025 (UTC)
 It looks like a duck to me Files wiped, blocked, tagged. No check needed. The Squirrel Conspiracy (talk) 02:26, 14 May 2025 (UTC)
@The Squirrel Conspiracy: You may also want to check Heraamall1 (talk • contribs • Luxo's • SUL • deleted contribs • logs • block user • block log ) (similar username, created three minutes before Heraamall10, perhaps as a sleeper).   — 🇺🇦Jeff G. ツ please ping or talk to me🇺🇦 11:57, 14 May 2025 (UTC)
 It looks like a duck to me blocked that one as well. Thank you. The Squirrel Conspiracy (talk) 14:53, 14 May 2025 (UTC)
@The Squirrel Conspiracy: You're welcome.   — 🇺🇦Jeff G. ツ please ping or talk to me🇺🇦 01:09, 15 May 2025 (UTC)
Null comment because the template won't mark this as resolved unless a CU is the last commenter. The Squirrel Conspiracy (talk) 02:23, 15 May 2025 (UTC)

寺人孟子

Status: resolved • view • edit • history • watch
Filed: 13:26, 7 May 2025 (UTC)

Rationale, discussion and results

Reason: I know the last user Count of JK firstly in ANM:Should_we_do_sometthing_about_Count_of_JK, The user was blocked for uploading sexually suggestive images of minors in school uniforms without consent.

Please read my comments in the above link.

Their initial edits focused on multiple pictures in the same topic, that is, the schoolgirl uniform uploaded by 氏子.

Devices:

Former reports of sock puppet:

Former reports of mis-overwriting files (The main account was blocked for this behavior):

CC @そらみみ: , @Kai3952: , @Mafalda4144: , @Yann: , @Pi.1415926535: .

Akishima Yuka (talk) 13:26, 7 May 2025 (UTC)

No idea why the former reports got unnoticed. For their Chinese name cannot be typed out? 寺人孟子 is literally Temple Man Mangzi and 氏子 is Shizi. Akishima Yuka (talk) 13:46, 7 May 2025 (UTC)
I didn't know 寺人's not related to temple but is an eunuch. Antigng: About Your Username. Akishima Yuka (talk) 14:43, 7 May 2025 (UTC)

Spiridon Ion Cepleanu

Status: open • view • edit • history • watch
Filed: 12:05, 18 April 2025 (UTC)

Rationale, discussion and results

Reason: The above accounts were recently blocked on frwiki following a RCU. Since this sockpuppeteer uses different accounts to contribute on different projects, and some sockpuppets could not be proven on the French project, having too old contributions or being just dormant on that project, a local check might identify other accounts used for the same purpose here (maybe Special:Contributions/Qualimac?). In a farewell message from one of the blocked accounts, the user mentions that the IPv6 address used lately was 2A01:CB1C:82C7:7700:0:0:0:0/64, which has numerous contributions on commons too. A partial picture of the interaction between the most active of these accounts can be found here (many other files have been deleted in the meantime). There is already a Category:Sockpuppets of Spiridon Ion Cepleanu, incomplete - could it be merged with Category:Sockpuppets of Spiridon MANOLIU, who is the same person? --Pafsanias (talk) 17:58, 18 April 2025 (UTC)

Hi, I also suspected this a long time ago, this is a massive sockpuppetry over many years with many accounts. Julieta39/Claude Zygiel/Trecătorul răcit are always "worry" about map accuracy, while they all falsify academic maps by Romanian nationalistic purpose: they removed Transylvania from medieval Hungary from more academic maps + they draw by their own fantasy big Romanian areas in medieval maps which are (or based on) Hungarian academic maps. They cannot understand that Wikipedia is based on academic sources and not by personal fantasy: https://en.wikipedia.org/wiki/Wikipedia:Attribution + https://en.wikipedia.org/wiki/Wikipedia:No_original_research
What are the chances that 3 different users communicate on talk pages in the same way while also falsifying academic maps in Photoshop for the same reason, similar medieval maps and same above mentioned result?
Claude Zygiel:
Julieta39:
Trecătorul răcit
They use exactly the same sentences:
Julieta39: https://commons.wikimedia.org/w/index.php?title=File:Kis-vlachföldek.png&diff=prev&oldid=903123938
Trecătorul răcit: https://commons.wikimedia.org/w/index.php?title=Commons:Deletion_requests/File:Magyarország_XII-XIII_század_második_felében.jpg&diff=prev&oldid=903421190 OrionNimrod (talk) 18:29, 23 April 2025 (UTC)
Indeed, POV pushing in the field of historical maps is the favorite joint activity of this group of accounts. A typical example could be the map File:Europe roumanophone en 1896 - The Time Atlas.jpg, where Spiridon Ion Cepleanu, Julieta39 and Gougouche321 exerted collective pressure in the same direction, to alter the original image against consensus. Another, more recent case has grouped Claude Zygiel and Gougouche321 at File:Europe and the Near East at 476 AD.png. After their edits were reverted twice by GPinkerton, the account Qualimac created its own jpg version of the same map (File:Europe and the Near East at 476 AD.jpg, which mentions as file’s author: "Guriezous, improved by Moodylo333"?!) This version was then distributed to Wikipedia articles in multiple languages by 2a01:cb1c:82c7:7700:493e:8cbf:5ee2:56d in order to replace the original file. --Pafsanias (talk) 07:05, 25 April 2025 (UTC)
Same here, even they Claude Zygiel + Julieta39 paint "Wallachia" (preRomania) in map 850, however https://en.wikipedia.org/wiki/Wallachia established in 1330! Time machine? File:Balkans850.png + File talk:Balkans850.png#Changes of 2023, august 5
I saw many similar, just 1 example: Claude Zygiel made a fake map Commons:Deletion requests/File:Europe 1097-corrected.jpg then an another sockpuppet account, Nihil scimus started to speard on many Wikipedia: https://fr.wikipedia.org/w/index.php?title=Moyen_Âge_central&diff=prev&oldid=207817987
OrionNimrod (talk) 09:55, 25 April 2025 (UTC)

May I kindly ask the checkusers after how many days of inactivity does a user account become stale? --Pafsanias (talk) 07:04, 12 May 2025 (UTC)

For older requests, please see Commons:Requests for checkuser/Archives
Category:Commons pages with broken file links Category:Sockpuppet investigations