Jump to content

Commons:Requests for checkuser

From Wikimedia Commons, the free media repository

Shortcuts: COM:CHECK • COM:RFCU • COM:SOCK

This is the place to request investigations of abuse of multiple accounts or of other circumstances that require use of checkuser privileges.

Requesting a check

These indicators are used by CheckUsers to allow easier at-a-glance reading of their notes, actions and comments.
Request completed
Confirmed  Technically indistinguishable
Likely  Possilikely
Possible Unlikely
Inconclusive Unrelated
 No action Stale
Request declined
Declined Checkuser is not for fishing
Checkuser is not magic pixie dust. 8ball The CheckUser Magic 8-Ball says
 It looks like a duck to me Checkuser is not a crystal ball.
Information
Additional information needed Deferred to
 Doing…  Info

Please do not ask us to run checks without good reason; be aware of the following before requesting a check:

  1. Checkuser is a last resort for difficult cases; pursue other options first, such as posting on the administrator's noticeboard. (This is not a venue for requesting administrative action such as blocks or file clean-up.)
  2. Running a check will only be done to combat disruption on Commons, or as required to assist checkuser investigations on other Wikimedia wikis.
    • Valid reasons for running a check include, for example: vandalism where a block of the underlying IP or IP range is needed and suspected block evasion, vote-stacking, or other disruption where technical evidence would prevent or reduce further disruption.
    • Requests to check accounts already confirmed on other projects may be declined as redundant.
    • Requests to run a check on yourself will be declined.
  3. Evidence is required. When you request a check, you must include a rationale that demonstrates (e.g., by including diffs) what the disruption to the project is, and why you believe the accounts are related.
    • Requests to run a check without evidence or with ambiguous reasoning will result in delays or the request not being investigated.
  4. The privacy policy does not allow us to make a check that has the effect of revealing IP addresses.

Outcome

Responses will be brief in order to comply with Wikimedia privacy policy. Due to technical limitations, results are not always clear. Closed requests are archived after seven days.

Privacy concerns

If you feel that a checkuser request has led to a violation of the Wikimedia Foundation privacy policy regarding yourself, please refer the case to the Ombuds commission.

If this page is displaying outdated contents even after you refresh the page in your browser, please purge this page's cache.

To request a check:

Cases are created on subpages of Commons:Requests for checkuser/Case.

Creating a request
  • Insert the name of the suspected sockpuppeteer (the main account or puppetmaster, not the sockpuppet!) in the box below, leaving out the "User:" prefix. Do not remove the text in the box, add to the end only.
  • Please explain/justify the request by saying what it is you suspect and why it is important that the check be carried out. Indicate the usernames you suspect, using {{checkuser}}. Please do not use this template in the section header, as that makes it difficult to read the account names. Include the diffs or links required to support the request and reason for it.
  • There are people to assist you and help with maintenance of the page. Just ask for help on the admin noticeboard if you really are stuck, or take your best shot and note that you weren't completely sure of what to say.
  • If a case subpage already exists, edit the existing page instead, either adding to the currently open section (if the case is not yet archived) or adding a new section to the top using {{subst:Commons:Requests for checkuser/Inputbox/Sample}} (if the case has been archived). When editing an existing case, be sure to list/transclude the subpage here.
Example
If you want to request a checkuser on User:John Doe, enter the text Commons:Requests for checkuser/Case/John Doe then click "Request a checkuser". You will be taken to a page where you can fill out the request. Please make your request there brief and concise.


Then transclude your subpage on the top of the list at Commons:Requests for checkuser and remove {{Checkuser requests to be listed}} from the top of the case subpage.

Checkuser requests to be listed (empty)
nothing found

Requests

[edit]

Kitangaza.1953

[edit]

Status: open • view • edit • history • watch
Filed: 19:25, 4 January 2026 (UTC)

[edit]

Rationale, discussion and results

[edit]

Reason: I strongly suspect Kitangaza.1953 to be a sockpuppet of EdwinAlden.1995, who was blocked indefinitely in January 2024 after multiple copyvios and creating 3 sockpuppets to continue doing so (see Category:Sockpuppets of EdwinAlden.1995).

Kitangaza.1953 uploaded in November 2025 several copyvio pictures (thanks to EugeneZelenko for adding the {{No permission}} template on those files). Without even mentioning Kitangaza.1953 and EdwinAlden.1995 common interest for pictures of celebrities from DRC, the most damning evidence is that those pictures were all added on English Wikipedia by EdwinAlden.1995 (Kitangaza.1953 never contributed elsewhere beside Commons).

For instance that picture (and several of the same artist) was added on this article by EdwinAlden.1995 just a few hours after Kitangaza.1953 uploaded it on Commons. Same for this image added here or that one here.

Thank you --Titlutin (talk) 19:25, 4 January 2026 (UTC)[reply]

I'm adding MarianneMokosso1955 which I just discovered. Same type of account: only contributed on Commons (and nowhere else) for a short time (May 2025) and got its copyvio uploads added on English Wikipedia by EdwinAlden.1995 (see this file, this file and this one added on this article by EdwinAlden.1995 shortly after MarianneMokosso1955 uploaded them). Maybe there are other accounts? --Titlutin (talk) 20:22, 4 January 2026 (UTC)[reply]

Baginda 480

[edit]

Status: resolved • view • edit • history • watch
Filed: 08:34, 4 January 2026 (UTC)

[edit]

Rationale, discussion and results

[edit]

Reason: Same edit pattern: Upload images and texts that are related to former Malaysian prime minister Mahathir Mohamad. Created just a few days after the previous sock was blocked. A1Cafel (talk) 08:34, 4 January 2026 (UTC)[reply]

Confirmed Blocked & tagged. The Squirrel Conspiracy (talk) 10:35, 4 January 2026 (UTC)[reply]

Baginda 480

[edit]

Status: resolved • view • edit • history • watch
Filed: 16:04, 27 December 2025 (UTC)

[edit]

Rationale, discussion and results

[edit]

Reason: Similar (almost same) edit pattern: Upload images that are related to former Malaysian prime minister Mahathir Mohamad, whom the user very admired with. A1Cafel (talk) 16:04, 27 December 2025 (UTC)[reply]

Confirmed Blocked and tagged. --Lymantria (talk) 19:16, 27 December 2025 (UTC)[reply]

Pion smmln

[edit]

Status: resolved • view • edit • history • watch
Filed: 22:46, 2 January 2026 (UTC)

[edit]

Rationale, discussion and results

[edit]

Reason: Master is likely stale. Mehedihasan2026 was blocked as a sock of the master on this case on en: en:Wikipedia:Sockpuppet investigations/Pion smmln/Archive. Alfinjaman2026 just reuploaded all of Mehedihasan2026's deleted content. Eg., File:Crew Of Team Taran Chowdhury.png vs. File:Crew team taran.png.

Although I've blocked per DUCK, I'm requesting a CU sleeper check. Magog the Ogre (talk) (contribs) 22:46, 2 January 2026 (UTC)[reply]

Nathannah

[edit]

Status: open • view • edit • history • watch
Filed: 12:47, 2 January 2026 (UTC)

[edit]

Rationale, discussion and results

[edit]

Reason: See discussion at User talk:Mvcg66b3r. The above users are found very Likely to Confirmed by me. Creating this case for transparency reasons. Lymantria (talk) 12:47, 2 January 2026 (UTC)[reply]

I absolutely disgree with this case; I do not coordinate any edits with others, I do not use proxy IPs and every edit I make is usually connected with a number of static Spectrum IPs over time, and it's very clear my edits and images are much different than those Mvcg and OWaunTon make, on a much slower scale than them since I'm more about text than images. Also behaviorally, 404 and Zenzi (who I've never heard of) uploaded much different images than I have. Nathannah • 📮 13:29, 2 January 2026 (UTC)[reply]
Also how would I be related to 404 when I asked for an image of theirs to be removed? Nathannah • 📮 15:03, 2 January 2026 (UTC)[reply]
Hello, I don't really know them that much, but I can say this that, I don't agree that they ALL are sockpuppets. I don't even know, what and why this is happening at all. I'm mer764 and I'm in Wiki Commons / (Heyo, talk!) 16:22, 2 January 2026 (UTC)[reply]
Absolutely false. Nathannah Schimpf and mvcg are 100 percent different people. This is also incredibly discriminatory as mvcg is neurodivergent and has communication issues, so he needed assistance in defending himself. Nathan Obral (talk) 17:11, 2 January 2026 (UTC)[reply]
I also don't appreciate Jameslwoodward giving me absolutely no notice at all on en.wiki as to this and my having to wake up for work and face this three days after cold with no way to figure out what on earth was going on. I can only think of two things, including that this may be a report designed to chill me for actions I took on en.wiki against someone trying to uploaded uncredited images and text (Zenzi and 404 did some uploading, but in completely unrelated fields), along with getting attention from a certain Kiwi site in October for a GOP cause célèbre I argued against in AfD not knowing how the issue had been mainpulated and some attempted doxxing (where I had to literally remove my online presence and hide it; Charlie Kirk's death quickly redirected attention away from that issue but KW definitely doesn't just close dox threads because 'the vibes changed'). Without James giving me or anyone here any reason for the account connections they allege that do not exist, I can't be sure of what does back this report, or why anyone would go after editors with 10-20 years of history on en.wiki. Nathannah • 📮 17:19, 2 January 2026 (UTC)[reply]
Also note that all of my accounts are protected by 2FA, which even few administrators overall on WMF have as part of their account protection. Why in any scenario would I ever give out something or coordinate with someone using something that most people can't be arsed to bother with? Nathannah • 📮 18:49, 2 January 2026 (UTC)[reply]
I'd like to say that I am startled and incredibly disappointed by the way in which this has been handled. While I appreciate that CUs cannot divulge information as part of their remit, I have been left incredibly perplexed by the accusations being made and wonder if a configuration issue by an ISP, fixed or mobile, is at play. I will tell you what I know about two of the users and can figure out about the other three.
I know two of these users offwiki: Nathannah lives in Wisconsin, and mvcg66b3r lives in Tennessee. They are very different people. Nathannah can sustain a conversation on- and off-wiki, while Mvcg in my experience has absolutely terrible communication skills (and has a short-term block to his name related to this) but has been an effective antivandal fighter. OWaunTon is a more recent editor, also in my topic area (American broadcasting). I had not heard of 404x404 or ZenziSaga until today. In fact, only one of them edits mostly in my topic area—ZenziSaga, and primarily about Illinois. I cannot recall an instance on enwiki or anywhere else I've been where so many innocent, unrelated users have been lumped together in a CU block.
It is startling to see two CUs, of five total on Commons, make the same mistake about users whose edits overlap. What is it that we are missing? Sammi Brie (she/her • t • c) 17:41, 2 January 2026 (UTC)[reply]
The lack of willingness to release the evidence makes me believe that there is no evidence and that the CUs are engaging in slanderous, malicious and outright discriminatory behavior. I do not believe this evidence exists and this is all fabricated to punish multiple editors for no real reason. Targeted and honestly inexcusable. Nathan Obral (talk) 17:55, 2 January 2026 (UTC)[reply]
For the record, yes I know what a CU is and why in practice the information they have and acquire is supposed to be confidental. That is why I strongly assert that this framing of multiple tenured editors for no reason but vague, condescending and flippant remarks like "we have the data and the data doesn't lie" makes it plain as day that multiple CUs are blatantly abusing the privileges given to them and that they are lying through their teeth in the process. I do not believe for one iota of a second these CUs that are trying to tell me that up is down, down is up, and that Nathannah Schimpf, OWaunTon and mvcg are the same people. Nathan Obral (talk) 18:45, 2 January 2026 (UTC)[reply]
Also to note I'm white while Mvcg is one of the few Black contributors in our field of interest. Targeting a neurodivergent person who is also Black, I absolutely cannot abide by that. Nathannah • 📮 18:47, 2 January 2026 (UTC)[reply]
Yeah, about that. Why would you confuse a white transgender woman in Wisconsin with a Black male in Tennessee? Did you know that mvcg was Black to begin with when you accused him of being her? Nathan Obral (talk) 18:57, 2 January 2026 (UTC)[reply]
@Sammi Brie, the thing you're missing is the technical data, which CUs cannot disclose or even really hint at. Thank you for providing additional information. @Nathan Obral, @Nathannah, please stop alleging that the CUs involved in this case are targetting individual contributors for being neurodivergent, Black, or anything else. That's a very obvious personal attack against any editor, but especially so against checkusers, since doing so would be a breach of CU policy in addition to the UCoC. If you think CU has been used inappropriately, the avenue of appeal is 1) other CUs on the project (done), 2) local arbcom, if extant, and finally 3) the ombuds. -- asilvering (talk) 20:34, 2 January 2026 (UTC)[reply]
@Nathannah has just cause to be angry as she was never notified of these actions for several days until OWaunTon brought them up on her talk page. I personally object to having being dismissed by a CU in the matter I was on mvcg's talk page, especially when the accusations levied against him completely defy reality on multiple levels. How else am I supposed to react? Nathan Obral (talk) 21:03, 2 January 2026 (UTC)[reply]
Exactly this. I have no issue with the process itself, but the way I was not notified with even a ping, nor were any of the three given any proper notice, along with having no idea exactly what was done except 'they're related and are socking' when there are global accounts to examine overall editor behavior off-Commons and that I was last here in October was not even considered. I want full transparency, to know why we're even here and who reported the conduct in the first place, but Jim has refused to speak to any of us outside of having to navigate a process that I'm wholly unfamiliar with because my only purpose here is to upload images and occasionally vote on images and have inappropriate images removed. To escalate it just to us being lumped in as socks without any transparency and no understanding is beyond frustrating when I've had nothing but positive experiences on WP:ANI and WP:SPI and been able to explain in plain English with admins who can see my work. Nathannah • 📮 21:19, 2 January 2026 (UTC)[reply]
What do you mean "technical data"? They didn't do anything wrong. I don't even have a single clue on what is happening or is going on before all of this starting occuring? Like, I don't understand. mer764KC / Cospaw on Wikipedia Commons / (Talk?) 21:23, 2 January 2026 (UTC)[reply]
@Mer764Wiki, by technical data, I mean the data that checkusers have access to through the use of the checkuser tool. As signatories to the ANPDP we can't comment on what that technical data entails except in the vaguest of terms. I do understand this is very frustrating (it often is for us too). I think we'll be able to resolve this, and again I would urge everyone to be as patient as possible while people with CU access try to figure this one out. -- asilvering (talk) 21:40, 2 January 2026 (UTC)[reply]
To clarify my statement above: appealing the block does not go ultimately to the ombuds. That would be the U4C, I expect, though I'm not familiar with how Commons works. The allegations about CUs targetting people is what goes ultimately to the ombuds if not resolved here. -- asilvering (talk) 21:47, 2 January 2026 (UTC)[reply]
@Asilvering and @Lymantria: I wish to apologize to the both of you for expressing frustration like I did on here and making the accusations I did.
I do maintain that communication needs to dramatically improve. It should not be incumbent on one of the affected users finding out days after the block was made because she was never notified on enwiki. Plus I am still quite disappointed in how this was "guilty until proven innocent" for multiple tenured editors that were caught in an accidental false positive. Again, I am sorry and am grateful that a further examination found out this was indeed the case. Hopefully this project and others in Wikimedia can use this as a teachable moment. Nathan Obral (talk) 20:58, 3 January 2026 (UTC)[reply]
@Nathan Obral, I don't see why there would be any expectation that an editor be notified on en-wiki that there is an issue with their editing on a completely different project. I would honestly be inclined to consider that harassment if I saw it happening on en-wiki. No comment regarding whether or not this was handled correctly on Commons, since I don't know the norms here. -- asilvering (talk) 21:30, 3 January 2026 (UTC)[reply]
@Asilvering, understood. Again, I'm sorry and please understand that I'm still upset in a way (I would be lying if I said I wasn't), but am very, very grateful this has been resolved. For the record, I do retract the prior accusations fully, if but to have that in writing. Nathan Obral (talk) 21:48, 3 January 2026 (UTC)[reply]
I'm not doubting the CU evidence and I understand that it cannot be shared, but sockblocks serve to prevent abuse, like votestacking or evading scrutiny. Simply editing with two accounts without disclosure is not abuse. Looking at their interactions [1], it looks like the only deletion discussions where Mcvg and Nathannah interacted were these two, where Nathannah disagreed with Mvcg's nominations and got them kept. Adding OWaunTon [2], I only see more disagreements (example) or otherwise benign interactions (example). I admit I haven't looked through everything and may have missed stuff, so: assuming these are the same person, what abuse justifies the block of Mcvg?
Also, why was email revoked from Mcvg (and the others)? And why are none of the other accounts listed here blocked is Nathannah not blocked? Toadspike [Talk] 20:43, 2 January 2026 (UTC)[reply]
This too; if it was so important to block Mvcg after the evidence was found and then Mvcg was told 'you're a sock of Nathannah', why not block me at that point and wait until this evening to tag that on my userpage? Most patrollers would tag in bulk instead of this three-day stretch out which is punitive to Mvcg, but then we wait to block OWaunTon and I'm in limbo, and seems to only connect because we all did something on File:Dyson Daniels (2025).jpg, which mind you still remains sourceless even as I asked for it to be removed because of exactly that (and that 'uploader claims authorship on their talk page' was a proper keep reason when the file was never updated with a source, that talk page edit doesn't exist, nor would we let a file remain unsourced on the description page)? Nathannah • 📮 21:45, 2 January 2026 (UTC)[reply]
This is an oddcase but I'm 100% sure Nathannah, Mvcg66b3r and OWaunTon are not socks of each other, i just don't see the connection, the other 2 very well might be socks...There are 2 possibilities here, one, the link to them being socks is possibly the same ISP (Spectrum) whose IP's are definitely dynamic for most users, the only link the main 3 have are uploading logos of local TV stations...if the Link to 3 is one specific IP but at different time within a span of 3 months then maybe its best to check that IP to see who it specifically belonged to then and in which city/state, could very well be an open wifi they all may have used within that time frame...one likely link for Nathannah and Mvcg66b3r is very likely that image linked above, which they both edited, looks like both Nathahhah and Mvcg66b3r imported the file, looks like the File Importer extension must have had an issue on November 1st and December 14th so now the CU data assumes 404x404 is a sock of Nathannah and Mvcg66b3r because they both imported that image from enwiki to commons and thus now their ip information is associated with the image as well...well there is one mystery solved, i haven't used the CU tool in like 15 years so not sure what data they show nowadays but if the link to the two is via that bug caused by File Importer of that specific image then you can write these two out as socks, and now the other link, Mvcg66b3r's link to OWaunTon is this image, as you can see, it looks like another file importer related bug so if your CU data has these two linked due to that specific day the image was imported, then we can call this all a False Positive and move on, maybe also notify the creator of that extension that his extension may have caused CU data false positives.... The other two are not long term accounts so i value the CU's own discretion on how to deal with them..--Stemoc 01:14, 3 January 2026 (UTC)[reply]
I obviously can't pass judgment on the data, but this is the first time things start to make sense. File:MeTV FM new logo.png must be how ZenziSaga got bound to Mvcg; it's their only overlap in a very small set of contribs. Thank you, Stemoc, for shedding some light on this situation. Sammi Brie (she/her • t • c) 01:28, 3 January 2026 (UTC)[reply]
This feels like it could be a cause; I can also note that IPv6 was turned on in my Spectrum service area in that period of time and I enabled it on my router. I still have my same static IPv4 address that I've had over the last few months, but since I'm still trying to get used to IPv6, that may have caused complications that tangled us all when the CU was done and it thought somehow 404, OwaunTon and Zenzi were related and on an higher octet that we share, but not the lower portions of the address or geography (still have no idea how Mvcg on Xfinity got tangled in by IP though outside the file history explanation). Thank you for getting into the nitty-gritty I can't understand, Stemoc. Nathannah • 📮 01:48, 3 January 2026 (UTC)[reply]
I checked with some data provided by Asilvering (enwiki CU). Let me say that one of the reasons to be convinced of sockpuppetry is the use by the exact same IPv6 address on the same file by different users (and some additional reasons). Just as Stemoc I noticed that in most of these cases, use of filemover was involved. How this works doesn't in all cases make perfectly sense to me, but it is sufficient to explain this case to be a false positive. My sincere apologies (and I do think I speak for Jameslwoodward as well) for the trouble this has caused. I will unblock. --Lymantria (talk) 08:55, 3 January 2026 (UTC)[reply]
I appreciate your examining this, Lymantria, thank you, and your apology is appreciated. However, your colleague seems to still disagree (posting this after the above here and on my en.wiki talk), which is concerning. Nathannah • 📮 18:36, 3 January 2026 (UTC)[reply]
Update: So, I took a nap today... did this get resolved? mer764KC / Cospaw on Wikipedia Commons / (Talk?) 22:29, 3 January 2026 (UTC)[reply]

Fresh set of eyes

[edit]

I'm going to give as much information as possible, without breaking the ANPDP.

Nathannah
  • All but one of their edits are from the same static IP address, which is from a major telcom (Telcom A).
  • On October 11, this edit was made from a different IP address, which is owned by a different major telcom (Telcom B).
  • All of their edits except the October 11 edit are from the same device(s) from Operating System Family A, and when a browser signature is present, are using the same browser.
  • The October 11 edit is from Operating System Family B, and has no browser signature.
Mvcg66b3r
  • Excluding when they used CropTool, all of their edits are from the same /64. They've had over 30 different IPs across that /64.
  • On October 11, they made three edits, of which this was the earliest, from the same IP address that Nathannah used, to the same file that Nathannah edited an hour before.
  • The IP address in question is within the /64 that all their other IPs have come from.
  • All of their edits are from the same device(s) from Operating System Family B, and when a browser signature is present, using the same browser.
  • The October 11 edit has no browser signature.
Comparison of Nathannah and Mvcg66b3r
  • If we exclude the October 11 edits, I would conclude these two accounts are unrelated. They're on devices with different operating systems, with different ISPs and different browser signatures.
  • Looking only at the October 11 edits, I would conclude these two accounts are confirmed. The accounts are using the same IP, with the same user agent, editing the same file, within an hour of one another.
  • But, we do have the October 11 edits to consider. Looking at the whole picture, I can see why my colleagues say Confirmed (it's about as strong a match as we ever get) and why the English Wikipedia CU is confused (the October 11 IP isn't in the EnWiki CU data, so they're seeing two obviously unrelated users.)
OWaunTon
  • Other than that OWaunTon edited the same file as the two accounts above, on the same date, there is no evidence that they're related to either account.
  • The overwhelming majority of OWaunTon's edits are from a single IP, belonging to Telcom C, but they do have edits from IPs from Telcom A and Telcom B as well. However, that alone isn't really suspicious, as it's easy to accumulate lots of weird IPs and different telcos if you edit from a phone/tablet/laptop and use guest wifi.
ZenziSaga and 404x404
  • I don't see any reason to run a CU on these users, and thus haven't done so.

That's everything I've got. I'm not going to take any action myself on any of these findings, and I'll be away for the rest of today and most of tomorrow, but the data is available to any CU on any project to take a look at. The Squirrel Conspiracy (talk) 02:08, 4 January 2026 (UTC)[reply]

Could you clarify whether you mean that Nathannah's October 11 edit was made from a Manufacturer B device, or are you leaving that intentionally unspecified? jlwoodwa (talk) 02:50, 4 January 2026 (UTC)[reply]
Sorry, manufacturer is the wrong word. Operating system family would be more accurate (Microsoft, Mac, or Linux). I've corrected that above. Yes, Nathannah's October 11 edit is on Operating System Family B, while all their other edits are on Operating System Family A. This data point on its own doesn't really tell us much - almost everyone has either Windows or Mac, and the information that we get about hardware is pretty minimal. What's notable here is that Nathannah has one edit on a completely different device from anything they've used before. The Squirrel Conspiracy (talk) 03:08, 4 January 2026 (UTC)[reply]
so that's literally the image that connects all 3 and as predicted, definitely a bug related to file importer, OWaunTon imported it to commons, I noticed all 3 touched that image on the same day, Nathannah uploaded a new version (using fileimporter) and then Mvcg66b3r an hour later also imported some data to the image. One assumes if that Telecom B mentioned above is the same one used by wikimedia, maybe lookup its IP to see if it links back to a wikimedia foundation owned IP or related to one of its affiliates like wmflabs/toolforge...I do hope its a rare bug that has been fixed since then without it being brought up in the bug/phab and lets hope no one else got caught up in that bug then and blocked Stemoc 04:28, 4 January 2026 (UTC)[reply]
It's easy for CUs to tell when an edit uses CropTool because 1) it uses a the 172.16 private IP range and 2) it says CropTool in the user agent string. I'm not sure if other WMF-hosted tools do the same. Wikimedia Services IP addresses have "Wikimedia Foundation Inc." as the ISP, and the ranges are available on the Wikidata block screen (91.198.174.0/24, 208.80.152.0/22, 185.15.56.0/22, 2620:0:860::/46, and 2a02:ec80::/32). The IP address at the center of this mess isn't in that range. The Squirrel Conspiracy (talk) 06:25, 4 January 2026 (UTC)[reply]
To clear this up, I usually edit on my personal M1 Mac Mini with Microsoft Edge on the beta channel or on an iPad through Safari. I occasionally do edit on my phone or iPad on mobile (Spectrum Mobile, thus Verizon, and why I asked for IP-exempt on en-wiki a decade back to avoid any issues editing between networks). Nathannah • 📮 18:51, 4 January 2026 (UTC)[reply]
Thank you for putting this together, @The Squirrel Conspiracy. Sammi Brie (she/her • t • c) 03:30, 4 January 2026 (UTC)[reply]
Okay, thank you for clearing this all up, @The Squirrel Conspiracy. OWaunTon (talk) 04:06, 4 January 2026 (UTC)[reply]
A tiny addition to the clear explanation by The Squirrel Conspiracy: A similar situation as the 11 October one took place between OWaunTon and Mvcg66b3r on 2 December. --Lymantria (talk) 08:16, 4 January 2026 (UTC)[reply]
Thank you for the detailed explanation. I may try testing the suspected FileImporter bug later using this account and my alt account (User:Toad's Pike).
The Oct 11 edit by Nathannah [3] was made to enwiki, not Commons, and then imported by Mvcg, so I'm not even sure it's relevant to Commons CUs. If we say it is, that opens a new avenue for abuse of the CU system. Say two accounts are confirmed by CU as socks on enwiki. I could then import some of their files to Commons or translate their articles to dewiki (which results in importing the entire edit history), then report for socking there, and a CU will again confirm and block as socks. Do this across a few wikis, and I can request global locks for accounts that have never edited more than one wiki. Is this really what we want?
I must also point out that still nobody has addressed my question of abuse – until someone can explain where potential abuse occurred, the original blocks and even the original checks were not justified, regardless of whether FileImporter is bugged or not. Toadspike [Talk] 09:20, 4 January 2026 (UTC)[reply]
The Oct 11 edit by Nathannah was made to enwiki, not Commons
There's no way to see that from the CU interface; the CU would have to go through the logs edit by edit. As far as I know, nothing like this has happened before. It wouldn't occur to us that edits from another project would show up in Commons CheckUser results — that's not supposed to happen — so it wouldn't occur to us to check the logs.
I must also point out that still nobody has addressed my question of abuse
I have to leave that to the blocking admin to explain. I don't know how or why this started, and haven't followed the discussion as its moved through three different noticeboards across two projects.
The Squirrel Conspiracy (talk) 10:48, 4 January 2026 (UTC)[reply]
This deconstruction makes so much more sense; thank you TSC (if that's fine to call you); somehow in this case my use of Mac rather than Windows made this a little easier to deconstruct because it managed to isolate the issue better than most cases where everyone is on Windows (which if that happens is a very big issue to head off at the pass). I remember uploading the WHOI image to make it transparent and never thought anything about it until now because I uploaded it on en.wiki and then Mvcg uploaded it to Commons as I'm unfamiliar with how to do it so I just leave others more familiar with the process to do it, nor do I know about CropTool since I use Mac Preview and Inkscape to do my SVG/transparency cleanups. I hope this really helps clean up some processes, though I would hope Jim can make some kind of comment here and why he didn't stop and consider 'home project' history for all of us rather than just being binary and looking only at Commons behavior, and I hope an apology is tendered, especially to Mvcg. Nathannah • 📮 19:56, 4 January 2026 (UTC)[reply]

Esoksekolah01

[edit]

Status: resolved • view • edit • history • watch
Filed: 15:33, 1 January 2026 (UTC)

[edit]

Rationale, discussion and results

[edit]

Reason: New user YessMy67 attempted to edit the user pages of User:Esoksekolah01, who had previously engaged in similar behavior and was blocked for vandalism. Similar interest in metro signs. 0x0a (talk) 15:33, 1 January 2026 (UTC)[reply]

Restults: Confirmed

Likely to these:

Blocked (if necessary) and tagged. --Lymantria (talk) 13:24, 2 January 2026 (UTC)[reply]

Bjornkarateboy

[edit]

Status: resolved • view • edit • history • watch
Filed: 21:11, 31 December 2025 (UTC)

[edit]

Rationale, discussion and results

[edit]

Reason: Similar editing pattern, largely focusing on writing about US politics across Icelandic, English and Nordic language Wikipedias, as well as frivolously asking for admin rights as a means of hat collecting. The editor has been globally blocked due to a history of persistent sockpuppetry. TKSnaevarr (talk) 21:11, 31 December 2025 (UTC)[reply]

Declined ObamaForever2008 has no edits on Commons and Wikimadurinn is not registered on Commons. You need to file the CU request on a project where the accounts are actually active. The Squirrel Conspiracy (talk) 22:43, 31 December 2025 (UTC)[reply]

Guaileslomas

[edit]

Status: resolved • view • edit • history • watch
Filed: 17:55, 31 December 2025 (UTC)

[edit]

Rationale, discussion and results

[edit]

Reason: The suspicious account has been uploading photos of locations in Spain, but something that matches to the master is the author's photos by the same subject (the source link appoints to a LinkedIN account), see here and here (made by a puppet). Taichi (talk) 17:55, 31 December 2025 (UTC)[reply]

Josefo Ludovico

[edit]

Status: resolved • view • edit • history • watch
Filed: 03:06, 31 December 2025 (UTC)

[edit]

Rationale, discussion and results

[edit]

Reason: After detecting edits on the Spanish Wikipedia, I have noticed that there are possible evasions of Josefo Ludovico, specifically focused in two issues: forcing the term "Socotora", an island of Yemen (and against the use of "Socotra", via maps uploaded to Commons) and uploading sections of Spanish churches and fortresses. Taichi (talk) 03:06, 31 December 2025 (UTC)[reply]

@Krd, Lymantria, and Jameslwoodward: I could really use a second pair of eyes on this one. Data is a mess and I'm sitting on Possilikely at the moment, but there might be something I'm not seeing. The Squirrel Conspiracy (talk) 20:19, 31 December 2025 (UTC)[reply]
I sadly have no better idea. Krd 10:58, 1 January 2026 (UTC)[reply]
Agreed. Josefo Ludovico is long stale and none of the others above have any multiple IP users except the last one and that's minor.
Would you please take a look at the bottom of User talk:Mvcg66b3r and see if you see anything different from what I see? .     Jim . . . (Jameslwoodward) (talk to me) 14:15, 1 January 2026 (UTC)[reply]
I've taken a look. --Lymantria (talk) 11:54, 2 January 2026 (UTC)[reply]
@Krd, Lymantria, Jameslwoodward, and The Squirrel Conspiracy: , EXIF data (own photos) match. Strakhov (talk) 19:00, 2 January 2026 (UTC)[reply]
 Comment: I'm adding more accounts, including the last one which is indeed a sock (since there were attacks and insults against me and another user on the Spanish Wikipedia). Please excuse me if I'm doing something wrong by adding them in the middle of the analysis. Taichi (talk) 00:24, 3 January 2026 (UTC)[reply]

 Doing… Here are some preliminary results: Confirmed to each other:

Very Likely to these

And Likely to the latter:

I will block them, not yet tag as the relation to the master is unclear to me. I did not yet include the new users you added, Taichi, but one of them showed up by themselves!. --Lymantria (talk) 10:09, 3 January 2026 (UTC)[reply]

Results:
Confirmed or very Likely to each other and Likely to master:
Likely to these:
Possible:
Blocked and tagged all except the two possibles. --Lymantria (talk) 15:47, 3 January 2026 (UTC)[reply]


Worvandae

[edit]

Status: resolved • view • edit • history • watch
Filed: 00:09, 30 December 2025 (UTC)

[edit]

Rationale, discussion and results

[edit]

Reason: The next sock of Worvandae, see their talk pages and [4]. --Henrydat (talk) 00:09, 30 December 2025 (UTC)[reply]

Results: : Likely Blocked and tagged. --Lymantria (talk) 08:42, 30 December 2025 (UTC)[reply]

GMatteotti

[edit]

Status: resolved • view • edit • history • watch
Filed: 19:26, 29 December 2025 (UTC)

GMatteotti (talk • contribs • Luxo • SUL • deleted contribs • logs • block user • block log)

[edit]

Rationale, discussion and results

[edit]

Reason: Disruptive edits, repeated requests to move files even though they have already been rejected by file movers, this include File:Pietro Caloi.jpg, a file that was uploaded by a other sock of GMatteotti. Requests of the deletion of redirects even if they are old files – behavior that fits GMatteotti and their sockpuppets. זיו「Ziv」 • For love letters and other notes 19:26, 29 December 2025 (UTC)[reply]


BNJ Nilam

[edit]

Status: resolved • view • edit • history • watch
Filed: 15:51, 26 December 2025 (UTC)

[edit]

Rationale, discussion and results

[edit]

Reason: Two new photos (1, 2) by IdrT Ana (talk · contribs) were inserted into Wikipedia by 23uranand (talk · contribs) in a few hours. Both photos were found to be taken from Google Maps, similar to 23uranand (talk · contribs)'s recent behavior. 0x0a (talk) 15:51, 26 December 2025 (UTC)[reply]

The amount of data to link IdrT Ana and 23uranand is limited and the results are Inconclusive, the other two accounts are Stale. Blocked the two users confirmed at enwiki --Lymantria (talk) 10:29, 27 December 2025 (UTC)[reply]
@Lymantria Did you forget to block the master? 0x0a (talk) 07:56, 2 January 2026 (UTC)[reply]
I did not forget, but at second glance it is better to block them as well. --Lymantria (talk) 12:55, 2 January 2026 (UTC)[reply]
For older requests, please see Commons:Requests for checkuser/Archives
Retrieved from "https://commons.wikimedia.org/w/index.php?title=Commons:Requests_for_checkuser&oldid=1141890451"