Commons:Requests for checkuser/Case/Ferrol
Ferrol
[edit]- Ferrol (talk • contribs • Luxo's • SUL • deleted contribs • logs • block user • block log )
Suspected Related Users
[edit]- Phil MacKracking (talk • contribs • Luxo's • SUL • deleted contribs • logs • block user • block log )
- You are a f***ing pussy (talk • contribs • Luxo's • SUL • deleted contribs • logs • block user • block log )
For a full list, see User:Prevert/users.
Rationale
[edit]- Reason: See Commons:Administrators'_noticeboard/Attention#Users_editing_Ferrol.2C_related_pages_and_categories. Same edit pattern, vandalism, fake licenses, copyright violations. -- Bryan (talk to me) 12:49, 29 June 2007 (UTC)
Results
[edit]- Likely. However I think this may well need quite a bit more watching. I have blocked 3 IPs that I consider have been used inappropriately and/or have vandalism accounts on them.
- Confirmed - user:Phil MacKracking - user:You are a f***ing pussy
- user:Ferrol diario - user:E. Barros - user:Peter Skegg
- user:Estevo Barros - user:Salvador Valerio
- Then it gets more complicated!
- Likely - user:Ferrol26 - user:Cofradías de Ferrol - user:Lavozdegalicia - user:Chevron Texaco - user:Barcelo Libunca - user:AUDASA - user:Turgalicia
- However with this and the following one some edits are very close together so some caution may be worthwhile
- amazingly there is also a connection between the following
- user:Eye7 - user:Druida Artabro - user:Javy Rodeiro - user:The WiZaRD - user:J. Luis Suarez - user:Ferroliño - user:MGPita - user:Emilio A. Pacios - user:Margari - user:Miguel de - user:FerrolterraBtt - user:Flpazos - user:Rafael Permuy - user:Arturo Novo - user:Flv25 - user:Juan J. Couce - user:Jose Manuel Docal F.dez - user:Luis menéndez pan - user:Francisco Redondo - user:FIMO - user:Reyes Rodeiro Tuimil - user:Ramón Salgado-Araujo - user:Xaime Blanco - user:Delmi Álvarez
- I find it hard to believe that they are all puppets, equally it seems unlikely that all those were editing from the same IP otherwise. I guess it could be a genuinely shared IP but the whole thing makes it seem very suspicious.
- I am not blocking the users myself but will leave that to others to decide. I feel it is likely that this one will need reviewing. For further info feel free to contact me, cheers --Herby talk thyme 16:11, 29 June 2007 (UTC)
- Can you confirm whether those IPs are an open proxy? And if they are not, can you reveal the Internet Provider? -- Bryan (talk to me) 11:07, 30 June 2007 (UTC)
- See also Commons:Administrators'_noticeboard/Archive_5#Suspicious_Ferrol_activity. --EugeneZelenko 14:19, 3 July 2007 (UTC)
Results part 2
[edit]Likely - User:Barcelo Libunca, User:Druida Artabro, User:Visuga, User:Ferrol26
Likely - User:M. Alvariño, User:ACM Langtry, User:La Galeria, User:Adelina Taylor
Likely - User:Rafael Estévez, User:C. Carballeira
Likely - User:Daniel Santos, User:Jimbo Lockyer
Likely - User:Viqueira, User:Gladys Daddow, User:Maria carmen anca, User:Pablo Cinza, User:Miguel de, User:Xaime López, User:Xaime Blanco, User:Seymour Marvels, User:Angel l. filgueiras, User:GSuS, User:Ferroliño, User:GIGA
Likely - User:Cofradías de Ferrol, User:Delmi Álvarez, User:FIMO, User:Viqueira, User:Emilio A. Pacios
Likely - User:Berti, User:José Ardá, User:Churriña, User:Luis menéndez pan
Likely - user:Ferrol Sams, User:E. Barros
(Amazing really!). Some of these may be duplicated above but they are linkages I've found on a second run of checks on additional IPs.
Some IPs used are proxies, some are not however all IPs discovered so far are (according to dns information) UK based.
In the end I feel - while there might be one or two legitimate users in amongst the ones above - this is too disruptive to be allowed to continue. I know other active admins will be watching this page. My view would be towards blocking all users I feel and if a couple of other admins feel the same then I think we should do that.
I would appreciate views on dealing with the IPs involved. I don't recall any edits that are not Ferrol related but there could be collateral damage. Three IPs I would only be prepared to block for a shortish period as they appear to be likely to be genuinely shared (I will provide some info if required but off wiki).--Herby talk thyme 11:34, 3 July 2007 (UTC)
- Support 6 month block for all IPs and accounts involved, removal of all uploaded material, unless we have serious doubt on the invalidity of the material of a specific user. Unblock only for named accounts based on email verification, logged in OTRS. Siebrand 11:44, 3 July 2007 (UTC)
- I'd probably go for a bigger block on the users (indef?) but maybe a month as a starter on the IPs because of collateral damage? --Herby talk thyme 12:57, 3 July 2007 (UTC)
- I'll leave specifics to you. I think you can make the block for the IP equal to that for the user account, or at least longer than one month, unless you expect A LOT of colateral damage. In my experience we have very few useful contributions from IP addresses. Cheers! Siebrand 13:04, 3 July 2007 (UTC)
- I'd probably go for a bigger block on the users (indef?) but maybe a month as a starter on the IPs because of collateral damage? --Herby talk thyme 12:57, 3 July 2007 (UTC)
New, possibly related users
[edit]- Paula Iglesias (talk · contributions · Move log · block log · uploads · Abuse filter log)
Confirmed user:Marek Kosinski, User:Emilio A. Palacios, User:Arturo Novo, User:Paula Iglesias
Annoyed! Blocking all these and IP now --Herby talk thyme 13:43, 3 July 2007 (UTC)
- Also I think we are being played with, anyone wants to go blocking it is fine with me. I tempered my irritation and blocked the users for a year and the IP for a month. We can always find it again! --Herby talk thyme 13:46, 3 July 2007 (UTC)
I have blocked all users in the table on User:Prevert/users and mentioned on this page for 6 months, unless they were already blocked. I have also deleted all contributions. Of User:Arsaeh I only nominated contributions for deletion and I did not block. I found it unlikely that this user was related, but I'm of course open to be persuaded otherwise. In Jimbo's words: "Interesting!". Siebrand 14:36, 3 July 2007 (UTC)
- That user is "out of time" for CU logs. Thanks a lot for the help, regards --Herby talk thyme 14:42, 3 July 2007 (UTC)
- Could you check if Karl Dönitz (talk · contributions · Move log · block log · uploads · Abuse filter log) is possibly related? Siebrand 08:29, 4 July 2007 (UTC)
- Unrelated I think. I did "find" the name yesterday but it isn't really in the right range. That said and without getting paranoid anything Ferrol would be worth looking over I guess - I have doubts it is over quite --Herby talk thyme 10:33, 4 July 2007 (UTC)
What to do?
[edit]I would say indef all the accounts and block the ips for at least a month. Whole range if possible. -- Bryan (talk to me) 19:39, 3 July 2007 (UTC)
- Users all blocked 6 months plus (I'm not sure indef would be appropriate yet). The IPs have been blocked for 1 month (however see your mail). As my skills improve (:-)) I find easier ways of doing Cu things so catching up with the situation now would not be that difficult and I will certainly check these from time to time. In practice I think Greg must have had most of the info a while back but maybe had other things to do - we will stay on top of it now. Looking at anything Ferrol related with care would not hurt - cheers --Herby talk thyme 07:23, 4 July 2007 (UTC)
Subsequent requests related to this user should be made above, in a new section.