Commons:Requests for checkuser

Shortcuts: COM:CHECK • COM:RFCU • COM:SOCK

This is the place to request investigations of abuse of multiple accounts or of other circumstances that require use of checkuser privileges.

Requesting a check

These indicators are used by CheckUsers to allow easier at-a-glance reading of their notes, actions and comments.
Request completed
Confirmed Technically indistinguishable
Likely Possilikely
Possible Unlikely
Inconclusive Unrelated
 No action Stale
Request declined
Declined Checkuser is not for fishing
Checkuser is not magic pixie dust.8ball The CheckUser Magic 8-Ball says
 It looks like a duck to me Checkuser is not a crystal ball.
Information
Additional information needed Deferred to
 Doing… Info

Please do not ask us to run checks without good reason; be aware of the following before requesting a check:

  1. Checkuser is a last resort for difficult cases; pursue other options first, such as posting on the administrator's noticeboard. (This is not a venue for requesting administrative action such as blocks or file clean-up.)
  2. Running a check will only be done to combat disruption on Commons, or as required to assist checkuser investigations on other Wikimedia wikis.
    • Valid reasons for running a check include, for example: vandalism where a block of the underlying IP or IP range is needed and suspected block evasion, vote-stacking, or other disruption where technical evidence would prevent or reduce further disruption.
    • Requests to check accounts already confirmed on other projects may be declined as redundant.
    • Requests to run a check on yourself will be declined.
  3. Evidence is required. When you request a check, you must include a rationale that demonstrates (e.g., by including diffs) what the disruption to the project is, and why you believe the accounts are related.
    • Requests to run a check without evidence or with ambiguous reasoning will result in delays or the request not being investigated.
  4. The privacy policy does not allow us to make a check that has the effect of revealing IP addresses.

Outcome

Responses will be brief in order to comply with Wikimedia privacy policy. Due to technical limitations, results are not always clear. Closed requests are archived after seven days.

Privacy concerns

If you feel that a checkuser request has led to a violation of the Wikimedia Foundation privacy policy regarding yourself, please refer the case to the Ombuds commission.

Category:Sockpuppet investigations#Requests%20for%20checkuser

If this page is displaying outdated contents even after you refresh the page in your browser, please purge this page's cache.

To request a check:

Cases are created on subpages of Commons:Requests for checkuser/Case.

Creating a request
  • Insert the name of the suspected sockpuppeteer (the main account or puppetmaster, not the sockpuppet!) in the box below, leaving out the "User:" prefix. Do not remove the text in the box, add to the end only.
  • Please explain/justify the request by saying what it is you suspect and why it is important that the check be carried out. Indicate the usernames you suspect, using {{checkuser}}. Please do not use this template in the section header, as that makes it difficult to read the account names. Include the diffs or links required to support the request and reason for it.
  • There are people to assist you and help with maintenance of the page. Just ask for help on the admin noticeboard if you really are stuck, or take your best shot and note that you weren't completely sure of what to say.
  • If a case subpage already exists, edit the existing page instead, either adding to the currently open section (if the case is not yet archived) or adding a new section to the top using {{subst:Commons:Requests for checkuser/Inputbox/Sample}} (if the case has been archived). When editing an existing case, be sure to list/transclude the subpage here.
Transcluding the request
Example
If you want to request a checkuser on User:John Doe, enter the text Commons:Requests for checkuser/Case/John Doe then click "Request a checkuser". You will be taken to a page where you can fill out the request. Please make your request there brief and concise.

Checkuser requests to be listed (empty)
nothing found

Requests

Ana Ramirez Gz

Status: open • view • edit • history • watch
Filed: 13:47, 14 August 2026 (UTC)

Rationale, discussion and results

Reason: Ana Ramirez Gz uploaded File:Ernesto Casas.jpg (now deleted).

Ernesto Príncipe de Gales uploaded File:Ernesto Casas.jpg (now deleted, after the first deletion).

ERNESTO CASAS RAMÍREZ 79 uploaded File:Ernesto Casas.jpg (now deleted, after the second deletion).

Prinz Ernst August von Hannover started Commons:Deletion requests/File:Ernesto Casas.jpg and notified Ernesto Príncipe de Gales about that DR. They then uploaded File:Prinz Ernst August von Hannover.jpg and File:Prince Ernst August of Hannover.jpg. Ernesto Casas 4979 tried badly to have File:Prince Ernst August of Hannover.jpg deleted in Special:Diff/1258604436, and to have File:Prinz Ernst August von Hannover.jpg deleted in Special:Diff/1258603892.

Príncipe Ernesto de Liechtenstein vandalized Commons:Deletion requests/File:Prince Ernst August of Hannover.jpg in Special:Diff/1260748431.

All files appear to be glorifying the same person.   — 🇺🇦Jeff G. ツ please ping or talk to me🇺🇦 13:56, 14 August 2026 (UTC)

Milan Szymon Szulc

Status: resolved • view • edit • history • watch
Filed: 02:24, 8 August 2026 (UTC)

Rationale, discussion and results

Reason: Same behavior of Milan Szymon Szulc. I think he likes KenigMoji much, so he creates a new username called Kenigtlym2, but with the suffix “-tlym2”. Check my talk page, where he forces me to upload Seal characters from GlyphWiki. Milan Szymon Szulc is currently working on the same user. Also, his current account (Kenigtlym2) and his previous blocked account (Milan Szymon Szulc) forces everyone to do more requests for no reason at all. Hillsilo (talk) 02:24, 8 August 2026 (UTC)

No don't block Kenigtlym2 (talk) 12:32, 8 August 2026 (UTC)
@Kenigtlym2 Why are you even replying on this page?! Hillsilo (talk) 12:51, 8 August 2026 (UTC)
See also the behavioral evidence at COM:ANB#Block request for Kenigtlym2.   — 🇺🇦Jeff G. ツ please ping or talk to me🇺🇦 12:52, 8 August 2026 (UTC)
Declined Milan Szymon Szulc is stale, so you'll need to resolve this by behavioral evidence. The Squirrel Conspiracy (talk) 16:35, 8 August 2026 (UTC)
@The Squirrel Conspiracy Fine, I’ll give you the reason:
On April 2026, Jmabel blocked the original account, Milan Szymon Szulc, so he then logs out and created his new sock account: Kenigtlm, but his account was blocked, so he switched and logs in again to Kenigtlym2. Hillsilo (talk) 16:50, 12 August 2026 (UTC)
Jmabel already blocked them on August 8th... The Squirrel Conspiracy (talk) 04:02, 13 August 2026 (UTC)

TimeoRN24

Status: open • view • edit • history • watch
Filed: 10:26, 7 August 2026 (UTC)

Rationale, discussion and results

Reason: Duck test. Same disruptives crosswiki edits as other sockpuppets. Gyrostat (talk) 10:26, 7 August 2026 (UTC)

Seda276

Status: open • view • edit • history • watch
Filed: 02:42, 6 August 2026 (UTC)

Rationale, discussion and results

Reason: A few hours ago I noticed two accounts with very similar numbers uploading copyvios, but I've also observed more accounts starting with the sequence "Seda2XXX," with similar numbers. Furthermore, some accounts with the same username pattern are globally blocked, leading me to suspect an LTA has been creating sock accounts all this time. Taichi (talk) 02:42, 6 August 2026 (UTC)

Confirmed There's a bunch, now at Category:Sockpuppets of Seda276.
Stale but  Duck for Seda2849.
@Elcobbola: might know who the master is, but I don't, so I left it as Seda276.
Blocked and tagged. Going to SRG now. The Squirrel Conspiracy (talk) 04:27, 6 August 2026 (UTC)
@The Squirrel Conspiracy: Is it possible that there is a connection with SedaDudurkaeva14 (talk • contribs • Luxo • SUL • deleted contribs • logs • block user • block log) related to the usurped name of someone linked to terrorism, and a sock of СедаДудуркаева (talk • contribs • Luxo • SUL • deleted contribs • logs • block user • block log). Taichi (talk) 14:33, 6 August 2026 (UTC)

ZertifizierterService

Status: open • view • edit • history • watch
Filed: 20:10, 2 August 2026 (UTC)

Rationale, discussion and results

Reason: Suspected spam bot or SEO service. German language text & usernames refer to electrical service in Hamburg. Please check for others I don't see. --Achim55 (talk) 20:10, 2 August 2026 (UTC)

Mostly Confirmed, nothing found that isn't already blocked. Krd 05:57, 7 August 2026 (UTC)

Just for the record:

--Achim55 (talk) 15:03, 8 August 2026 (UTC)

SamsungBerdaiOthmane

Status: open • view • edit • history • watch
Filed: 15:00, 26 July 2026 (UTC)

Rationale, discussion and results

Reason: We have a large group of socks. This user creates a new account each time and uploads only a few files. These are usually downgraded versions of existing files. The new file names and / or Username often contain variations of the spammer's name, "Berdai Othmane", "BerdaiOthmane", "Berdai-Othmane" etc. Besides self-promotion, there are also ads for online marketplaces and microfinance organizations. I don't know which account is the primary one. I've only listed a partial list of accounts. There are most likely many more. IP address blocking is necessary if confirmed. Self-portrait of this spammer
George Chernilevsky talk 15:00, 26 July 2026 (UTC)

 Comment He also uploaded images from the Internet (see here or here). These are mostly logos and/or graphics associated with specific companies. I believe blocking the IP address is a very sensible measure to prevent unnecessary “out-of-scope” material in the future. DimiDimi (talk) 18:37, 26 July 2026 (UTC)
Already on behaviour this is clearly a sock farm of burner accounts, many of them Stale, Udona.ma does not exist. I will block and tag the lot on behavior. There is no reasonable IP or IP range to be blocked. I identified two sleeper accounts, Tmobilemosqueezoubir1 and PorscheBlue that will be blocked as well. --Lymantria (talk) 07:54, 27 July 2026 (UTC)
 Info I meant Uduno.ma (talk • contribs • Luxo • SUL • deleted contribs • logs • block user • block log). And actually there are more accounts. DimiDimi (talk) 15:53, 27 July 2026 (UTC)
Dealt with on behavioral grounds. --Lymantria (talk) 06:36, 28 July 2026 (UTC)
He continues (created today):
And here another older account:
DimiDimi (talk) 19:47, 30 July 2026 (UTC)
For older requests, please see Commons:Requests for checkuser/Archives
Category:Sockpuppet investigations