Commons:Requests for checkuser/Case/Ferrol

From Wikimedia Commons, the free media repository
Jump to navigation Jump to search
If you are creating a new request about this user, please add it to the top of the page, above this notice. Don't forget to add
{{Commons:Requests for checkuser/Case/Ferrol}}
to the checkuser page here. Previous requests (shown below), and this box, will be automatically hidden on Requests for checkuser (but will still appear here).
The following discussion is preserved as an archive of a Request for checkuser. Please do not modify it.

Ferrol

[edit]

Status: open • view • edit • history • watch
Filed: 12:49, 29 June 2007 (UTC)

[edit]

For a full list, see User:Prevert/users.


Rationale

[edit]

Results

[edit]
Likely. However I think this may well need quite a bit more watching. I have blocked 3 IPs that I consider have been used inappropriately and/or have vandalism accounts on them.
Confirmed - user:Phil MacKracking - user:You are a f***ing pussy
user:Ferrol diario - user:E. Barros - user:Peter Skegg
user:Estevo Barros - user:Salvador Valerio
Then it gets more complicated!
Likely - user:Ferrol26 - user:Cofradías de Ferrol - user:Lavozdegalicia - user:Chevron Texaco - user:Barcelo Libunca - user:AUDASA - user:Turgalicia
However with this and the following one some edits are very close together so some caution may be worthwhile
amazingly there is also a connection between the following
user:Eye7 - user:Druida Artabro - user:Javy Rodeiro - user:The WiZaRD - user:J. Luis Suarez - user:Ferroliño - user:MGPita - user:Emilio A. Pacios - user:Margari - user:Miguel de - user:FerrolterraBtt - user:Flpazos - user:Rafael Permuy - user:Arturo Novo - user:Flv25 - user:Juan J. Couce - user:Jose Manuel Docal F.dez - user:Luis menéndez pan - user:Francisco Redondo - user:FIMO - user:Reyes Rodeiro Tuimil - user:Ramón Salgado-Araujo - user:Xaime Blanco - user:Delmi Álvarez
I find it hard to believe that they are all puppets, equally it seems unlikely that all those were editing from the same IP otherwise. I guess it could be a genuinely shared IP but the whole thing makes it seem very suspicious.
I am not blocking the users myself but will leave that to others to decide. I feel it is likely that this one will need reviewing. For further info feel free to contact me, cheers --Herby talk thyme 16:11, 29 June 2007 (UTC)[reply]
Can you confirm whether those IPs are an open proxy? And if they are not, can you reveal the Internet Provider? -- Bryan (talk to me) 11:07, 30 June 2007 (UTC)[reply]
See also Commons:Administrators'_noticeboard/Archive_5#Suspicious_Ferrol_activity. --EugeneZelenko 14:19, 3 July 2007 (UTC)[reply]

Results part 2

[edit]

Likely - User:Barcelo Libunca, User:Druida Artabro, User:Visuga, User:Ferrol26

Likely - User:M. Alvariño, User:ACM Langtry, User:La Galeria, User:Adelina Taylor

Likely - User:Rafael Estévez, User:C. Carballeira

Likely - User:Daniel Santos, User:Jimbo Lockyer

Likely - User:Viqueira, User:Gladys Daddow, User:Maria carmen anca, User:Pablo Cinza, User:Miguel de, User:Xaime López, User:Xaime Blanco, User:Seymour Marvels, User:Angel l. filgueiras, User:GSuS, User:Ferroliño, User:GIGA

Likely - User:Cofradías de Ferrol, User:Delmi Álvarez, User:FIMO, User:Viqueira, User:Emilio A. Pacios

Likely - User:Berti, User:José Ardá, User:Churriña, User:Luis menéndez pan

Likely - user:Ferrol Sams, User:E. Barros

(Amazing really!). Some of these may be duplicated above but they are linkages I've found on a second run of checks on additional IPs.

Some IPs used are proxies, some are not however all IPs discovered so far are (according to dns information) UK based.

In the end I feel - while there might be one or two legitimate users in amongst the ones above - this is too disruptive to be allowed to continue. I know other active admins will be watching this page. My view would be towards blocking all users I feel and if a couple of other admins feel the same then I think we should do that.

I would appreciate views on dealing with the IPs involved. I don't recall any edits that are not Ferrol related but there could be collateral damage. Three IPs I would only be prepared to block for a shortish period as they appear to be likely to be genuinely shared (I will provide some info if required but off wiki).--Herby talk thyme 11:34, 3 July 2007 (UTC)[reply]

 Support 6 month block for all IPs and accounts involved, removal of all uploaded material, unless we have serious doubt on the invalidity of the material of a specific user. Unblock only for named accounts based on email verification, logged in OTRS. Siebrand 11:44, 3 July 2007 (UTC)[reply]
I'd probably go for a bigger block on the users (indef?) but maybe a month as a starter on the IPs because of collateral damage? --Herby talk thyme 12:57, 3 July 2007 (UTC)[reply]
I'll leave specifics to you. I think you can make the block for the IP equal to that for the user account, or at least longer than one month, unless you expect A LOT of colateral damage. In my experience we have very few useful contributions from IP addresses. Cheers! Siebrand 13:04, 3 July 2007 (UTC)[reply]
[edit]

Confirmed user:Marek Kosinski, User:Emilio A. Palacios, User:Arturo Novo, User:Paula Iglesias

Annoyed! Blocking all these and IP now --Herby talk thyme 13:43, 3 July 2007 (UTC)[reply]

Also I think we are being played with, anyone wants to go blocking it is fine with me. I tempered my irritation and blocked the users for a year and the IP for a month. We can always find it again! --Herby talk thyme 13:46, 3 July 2007 (UTC)[reply]

I have blocked all users in the table on User:Prevert/users and mentioned on this page for 6 months, unless they were already blocked. I have also deleted all contributions. Of User:Arsaeh I only nominated contributions for deletion and I did not block. I found it unlikely that this user was related, but I'm of course open to be persuaded otherwise. In Jimbo's words: "Interesting!". Siebrand 14:36, 3 July 2007 (UTC)[reply]

That user is "out of time" for CU logs. Thanks a lot for the help, regards --Herby talk thyme 14:42, 3 July 2007 (UTC)[reply]
Unrelated I think. I did "find" the name yesterday but it isn't really in the right range. That said and without getting paranoid anything Ferrol would be worth looking over I guess - I have doubts it is over quite --Herby talk thyme 10:33, 4 July 2007 (UTC)[reply]

What to do?

[edit]

I would say indef all the accounts and block the ips for at least a month. Whole range if possible. -- Bryan (talk to me) 19:39, 3 July 2007 (UTC)[reply]

Users all blocked 6 months plus (I'm not sure indef would be appropriate yet). The IPs have been blocked for 1 month (however see your mail). As my skills improve (:-)) I find easier ways of doing Cu things so catching up with the situation now would not be that difficult and I will certainly check these from time to time. In practice I think Greg must have had most of the info a while back but maybe had other things to do - we will stay on top of it now. Looking at anything Ferrol related with care would not hurt - cheers --Herby talk thyme 07:23, 4 July 2007 (UTC)[reply]
The above discussion is preserved as an archive of the Request for checkuser. Please do not modify it.
Subsequent requests related to this user should be made above, in a new section.


Retrieved from "https://commons.wikimedia.org/w/index.php?title=Commons:Requests_for_checkuser/Case/Ferrol&oldid=27455840"