Jump to content

Commons:Requests for checkuser

From Wikimedia Commons, the free media repository

Shortcuts: COM:CHECK • COM:RFCU • COM:SOCK

This is the place to request investigations of abuse of multiple accounts or of other circumstances that require use of checkuser privileges.

Requesting a check

These indicators are used by CheckUsers to allow easier at-a-glance reading of their notes, actions and comments.
Request completed
Confirmed  Technically indistinguishable
Likely  Possilikely
Possible Unlikely
Inconclusive Unrelated
 No action Stale
Request declined
Declined Checkuser is not for fishing
Checkuser is not magic pixie dust. 8ball The CheckUser Magic 8-Ball says
 It looks like a duck to me Checkuser is not a crystal ball.
Information
Additional information needed Deferred to
 Doing…  Info

Please do not ask us to run checks without good reason; be aware of the following before requesting a check:

  1. Checkuser is a last resort for difficult cases; pursue other options first, such as posting on the administrator's noticeboard. (This is not a venue for requesting administrative action such as blocks or file clean-up.)
  2. Running a check will only be done to combat disruption on Commons, or as required to assist checkuser investigations on other Wikimedia wikis.
    • Valid reasons for running a check include, for example: vandalism where a block of the underlying IP or IP range is needed and suspected block evasion, vote-stacking, or other disruption where technical evidence would prevent or reduce further disruption.
    • Requests to check accounts already confirmed on other projects may be declined as redundant.
    • Requests to run a check on yourself will be declined.
  3. Evidence is required. When you request a check, you must include a rationale that demonstrates (e.g., by including diffs) what the disruption to the project is, and why you believe the accounts are related.
    • Requests to run a check without evidence or with ambiguous reasoning will result in delays or the request not being investigated.
  4. The privacy policy does not allow us to make a check that has the effect of revealing IP addresses.

Outcome

Responses will be brief in order to comply with Wikimedia privacy policy. Due to technical limitations, results are not always clear. Closed requests are archived after seven days.

Privacy concerns

If you feel that a checkuser request has led to a violation of the Wikimedia Foundation privacy policy regarding yourself, please refer the case to the Ombuds commission.

If this page is displaying outdated contents even after you refresh the page in your browser, please purge this page's cache.

To request a check:

Cases are created on subpages of Commons:Requests for checkuser/Case.

Creating a request
  • Insert the name of the suspected sockpuppeteer (the main account or puppetmaster, not the sockpuppet!) in the box below, leaving out the "User:" prefix. Do not remove the text in the box, add to the end only.
  • Please explain/justify the request by saying what it is you suspect and why it is important that the check be carried out. Indicate the usernames you suspect, using {{checkuser}}. Please do not use this template in the section header, as that makes it difficult to read the account names. Include the diffs or links required to support the request and reason for it.
  • There are people to assist you and help with maintenance of the page. Just ask for help on the admin noticeboard if you really are stuck, or take your best shot and note that you weren't completely sure of what to say.
  • If a case subpage already exists, edit the existing page instead, either adding to the currently open section (if the case is not yet archived) or adding a new section to the top using {{subst:Commons:Requests for checkuser/Inputbox/Sample}} (if the case has been archived). When editing an existing case, be sure to list/transclude the subpage here.
Example
If you want to request a checkuser on User:John Doe, enter the text Commons:Requests for checkuser/Case/John Doe then click "Request a checkuser". You will be taken to a page where you can fill out the request. Please make your request there brief and concise.


Then transclude your subpage on the top of the list at Commons:Requests for checkuser and remove {{Checkuser requests to be listed}} from the top of the case subpage.

Checkuser requests to be listed (empty)
nothing found

Requests

[edit]

Owerlord1100

[edit]

Status: resolved • view • edit • history • watch
Filed: 02:26, 11 October 2025 (UTC)

[edit]

Rationale, discussion and results

[edit]

Reason: Re-uploading the same (or similar) files uploaded by the master and deleted as copyvios. Based on the usernames, this is either socking or a misuse of multiple accounts to avoid a potential block. — Preceding unsigned comment added by Johnj1995 (talk • contribs)

 It looks like a duck to me Blocked, files wiped. The Squirrel Conspiracy (talk) 05:24, 11 October 2025 (UTC)[reply]

Oscar Antonio

[edit]

Status: resolved • view • edit • history • watch
Filed: 07:28, 8 October 2025 (UTC)

[edit]

Rationale, discussion and results

[edit]

Reason: The first suspicious account is relieving the upload of disks, same pattern as the blocked account. Also, the suspicious accounts uploaded this and this image and it was used by the blocked account in another project. Taichi (talk) 07:28, 8 October 2025 (UTC)[reply]

Results: Based on technical data, combined with data from Wikidata:
Confirmed:
Possible to these: Vane Ruth79 (talk • contribs • Luxo • SUL • deleted contribs • logs • block user • block log)
Stale: DaciosIsma (talk • contribs • Luxo • SUL • deleted contribs • logs • block user • block log)
Behavioural evidence crosswiki however is sufficient to link all these accounts to the master. Blocked and tagged. --Lymantria (talk) 10:08, 8 October 2025 (UTC)[reply]

Theintrepidvincent

[edit]

Status: resolved • view • edit • history • watch
Filed: 09:56, 7 October 2025 (UTC)

[edit]

Rationale, discussion and results

[edit]

Reason: Theintrepidvincent and FocaArpa uploaded files intended to be used in attack pages. JohnPedroso and Johnpedroso2 removed CSD templates from files upload by Theintrepidvincent. Theintrepidvincent has been confirmed via LWCU; the same case also confirmed that IndianSkullMiner abused multiple accounts. OgunSkullMiner and JoshuaLeivaFan uploaded similar files; the former is obviously a duck. Please check the last four for sleepers and delete the files in question. NguoiDungKhongDinhDanh 09:56, 7 October 2025 (UTC)[reply]

Working This is a mess. The Squirrel Conspiracy (talk) 05:03, 8 October 2025 (UTC)[reply]

Confirmed set 1

Confirmed set 2

Confirmed set 3

and with that in mind:

Likely

 Possilikely

Inconclusive

  • Set 3
  • any of the above

Meta is treating the master as IndianSkullMiner, but that account isn't locally registered. I'll leave it under the current name for now. The Squirrel Conspiracy (talk) 05:18, 8 October 2025 (UTC)[reply]

Behavioral evidence is enough for set 3. I've blocked and tagged every account except for Dokyundokyundokyun. I'd like a second opinion from another CU on them. @Krd, Lymantria, and Jameslwoodward: The Squirrel Conspiracy (talk) 05:31, 8 October 2025 (UTC)[reply]
I see Dokyundokyundokyun as likely to confirmed to set 1.
Confirmed also as new sock Johnnysnack (talk • contribs • Luxo • SUL • deleted contribs • logs • block user • block log) to set 1.
Blocked and tagged. --Lymantria (talk) 06:54, 8 October 2025 (UTC)[reply]
Agreed. .     Jim . . . (Jameslwoodward) (talk to me) 13:12, 8 October 2025 (UTC)[reply]
Thanks both! The Squirrel Conspiracy (talk) 13:32, 8 October 2025 (UTC)[reply]

دامر العمري

[edit]

Status: resolved • view • edit • history • watch
Filed: 15:19, 6 October 2025 (UTC)

[edit]

Rationale, discussion and results

[edit]

Reason: These two users are re-uploading the deleted files previously uploaded by socks listed at Category:Sockpuppets of دامر العمري. They have been reported to Commons:Administrators' noticeboard/Blocks and protections where a checkuser request was suggested. Marbletan (talk) 15:19, 6 October 2025 (UTC)[reply]

Confirmed to each other and to earlier (suspected) socks:
Based on behavioural evidence it is clear that this is indeed the master. Blocked and tagged. --Lymantria (talk) 05:56, 7 October 2025 (UTC)[reply]

@Lymantria: Another user doing the same appeared today. Can you have a look? Thanks. Marbletan (talk) 15:23, 9 October 2025 (UTC)[reply]

Confirmed to earler socks
Blocked and tagged. --Lymantria (talk) 15:46, 9 October 2025 (UTC)[reply]

Osroene25

[edit]

Status: resolved • view • edit • history • watch
Filed: 13:14, 5 October 2025 (UTC)

[edit]

Rationale, discussion and results

[edit]

Reason: I believe the accounts may have been created solely to make it appear as though they share my interests and to portray me as a sockpuppet or as engaging in off-wiki canvassing.

On September 30th, I replied to a filemover request against Surayeproject3 on Commons. Just one day later, AramaicFuse appeared with no prior edits on Commons and happened to find the filemover request section and that specific request, writing: "You don't deserve rights because you do vandalism on our Syriac-Aramaean pages and upload many of our pictures."

Today, Surayeproject3 filed a report against me for sockpuppetry with AramaicFuse. Only 43 minutes after I responded, Osroene25 showed up and wrote: "Just because we edit the same topic doesn’t mean we are sockpuppets. Actually, filing this report against us means we are doing good."

I genuinely feel that this is an attempt to have me removed from all projects. Surayeproject3 even followed my edits to the Turkish Wikipedia and attempted to have me blocked there as well, but fortunately did not succeed. This now feels like another attempt to make me look guilty.. Wlaak (talk) 13:14, 5 October 2025 (UTC)[reply]

Inconclusive: I found nothing convincing to connect Osroene25 and AramaicFuse, both have hardly made any edits here at commons.
Unrelated: Surayeproject3 is different from the other two.
--Lymantria (talk) 16:37, 7 October 2025 (UTC)[reply]

Yauza2004

[edit]

Status: resolved • view • edit • history • watch
Filed: 17:14, 5 October 2025 (UTC)

[edit]

Rationale, discussion and results

[edit]

Reason: Within a few hours, I blocked 4 socks and the main account who uploaded again and again the same selfie, a poor quality snapshot of his cat, and an out of scope picture of a crying baby. Please block the range and all dormant accounts. Yann (talk) 17:14, 5 October 2025 (UTC)[reply]

Confirmed
The Squirrel Conspiracy (talk) 18:53, 5 October 2025 (UTC)[reply]
Moved to Commons:Requests for checkuser/Case/Alexey Guryev as that's the oldest account. The Squirrel Conspiracy (talk) 18:57, 5 October 2025 (UTC)[reply]

Ranlion

[edit]

Status: resolved • view • edit • history • watch
Filed: 10:06, 4 October 2025 (UTC)

[edit]

Rationale, discussion and results

[edit]

Reason: Abuse of multiple accounts, seemingly to upload copyvio. Throwaway, randomly generated user names, all involved in uploading a bunch of pictures of Sarah Toscano per account. All files lack EXIF data and most appear poorly cropped or edited to avoid reverse image searches (1, 2, 3). Pictures are then added on Wikidata and other projects while being logged out.

Please see history of File:Sarah Toscano (June 2025).jpg and its deletion request: the picture, uploaded by Ranlion, is taken from this tweet with the microphone edited out; File:Sarah Toscano (June 2025) (2).jpg, uploaded by Gatreor, was also taken from the very same tweet with the microphone edited out. Lplh was also involved in the deletion request and was blocked back in July for abusing multiple accounts.

Ranlion is most likely not the real sockmaster, just the oldest account I could find editing in this area. It may also be stale for just one day. Some slipped logged out edits remind me of an itwiki LTA that was blocked here on Commons too, please contact me privately if CU data is needed. Titore (talk) 10:06, 4 October 2025 (UTC)[reply]

Results: Confirmed to each other:

Ranlion is stale, but based on behavioural evidence I am convinced that I can consider them as master. Blocked and tagged. --Lymantria (talk) 12:52, 4 October 2025 (UTC)[reply]

チ一牛フジタ拓也

[edit]

Status: resolved • view • edit • history • watch
Filed: 05:20, 30 September 2025 (UTC)

[edit]

Rationale, discussion and results

[edit]

Reason: In the last several hours, two reports on COM:ANV came in. They have the subject of a cross-wiki harassing originating from JA-WP and directed against an admin there, see Special:PermaLink/1093059458#フズィータ・弱男・チ一午拓也. It's likely that a CU may unearth or safeguard technical evidence to fight that kind of abuse. Grand-Duc (talk) 05:20, 30 September 2025 (UTC)[reply]

Confirmed. Moved to master, which is ネメンデス. Full list of socks at Category:Sockpuppets of ネメンデス. The Squirrel Conspiracy (talk) 17:32, 30 September 2025 (UTC)[reply]

SudoX7

[edit]

Status: resolved • view • edit • history • watch
Filed: 06:24, 29 September 2025 (UTC)

[edit]

Rationale, discussion and results

[edit]

Reason: Mono-thematic uploads from both accounts related to en:Bunny Colby imagery. All images are probable copyvios. The possible sockmaster was created on 2025-09-21 and uploaded 3 images on the same day. These images got a DR with the rationale "Professional shots + film screenshot(?), no EXIF data, unlikely to be own works."
Then, today, the alleged sock uploaded a PNG also depicting the actress. This may be a try at circumventing scrutiny, by choosing an inherently EXIF-less format. If the CU is performed and results in demonstrating an affiliation of these two accounts, this technical evidence is helpful in demonstrating a disregard to our project rules and a readiness to engage in several misconducts at once: copyvio uploads + socking. Grand-Duc (talk) 06:24, 29 September 2025 (UTC)[reply]

Noting that Nosghxbrd17—one of the accounts listed under Sockpuppets of SudoX7—also created Category:Bunny Colby, which aligns with the mono-thematic uploads observed from AgathaVegaX and the other suspected accounts. This adds further weight to the pattern of coordinated uploads and possible sockpuppetry. Saroj (talk) 07:10, 29 September 2025 (UTC)[reply]
Thanks for the info. I just saw an account named AgathaVega in the sock category, also some accounts with the "Error##" naming schema. The check has been run by Lymantria after the messages in Commons:Administrators' noticeboard/User problems/Archive 125#Removal of speedy tag and sockpuppetry. Would this warrant a move of this investigation page towards th actual sockmaster name, SudoX7? Regards, Grand-Duc (talk) 07:20, 29 September 2025 (UTC)[reply]
Confirmed (almost duck) to SudoX7. Moved case to SudoX7. Blocked and tagged. --Lymantria (talk) 07:57, 29 September 2025 (UTC)[reply]
Most likely a newly created sock, their contributions are solely uploading photos of Bunny Colby as well. Thanks. Tvpuppy (talk) 20:33, 29 September 2025 (UTC)[reply]
Confirmed The Squirrel Conspiracy (talk) 02:22, 30 September 2025 (UTC)[reply]
Uploaded a Bunny Colby image and showed similar behavior to other SudoX7-related socks. Likely another sock account. --Saroj (talk) 09:58, 2 October 2025 (UTC)[reply]
 It looks like a duck to me Blocked and tagged. --Lymantria (talk) 11:55, 8 October 2025 (UTC)[reply]

ChanComThemPho

[edit]

Status: resolved • view • edit • history • watch
Filed: 20:43, 20 September 2025 (UTC)

[edit]

and probable more...

Rationale, discussion and results

[edit]

Reason: Could you please block the range? Or create a filter? Well anything to block them preventively. Yann (talk) 20:43, 20 September 2025 (UTC)[reply]

There are 213 confirmed socks, and the sockmaster is highly resistant to rangeblocks. I'll reach out to someone about seeing if filters are an option. The Squirrel Conspiracy (talk) 02:24, 21 September 2025 (UTC)[reply]
@Yann: As far as I know, this LTA use many proxies to evade lock/ban, so I think range blocking might be less effective. Filter is a more robust option. See also this disscussion in viwiki (in Vietnamese). Nvdtn19 (talk) 08:45, 24 September 2025 (UTC)[reply]
About the filter, @Plantaest: maybe you can help them create a filter here to block this LTA? This would be useful and they can update the filter whenever they want, without having to rely on the global filter, which currently seems to be weaker. Nvdtn19 (talk) 05:17, 25 September 2025 (UTC)[reply]
Maybe these accounts are not related to ChanComThemPho. The first account is User:Yummie1207 vi:Wikipedia:Tin nhắn cho bảo quản viên/Cấm chỉ vô hạn Yummie1207 tại Wikipedia tiếng Việt. Can we move the case and edit the tags? Henrydat (talk) 04:39, 8 October 2025 (UTC)[reply]
We will keep it as it is, there is sufficient reason to do so. --Lymantria (talk) 12:01, 8 October 2025 (UTC)[reply]
For older requests, please see Commons:Requests for checkuser/Archives
Retrieved from "https://commons.wikimedia.org/w/index.php?title=Commons:Requests_for_checkuser&oldid=1097889899"