| abstract
| - RandomWikiaUser1680 (talk · contribs · editcount · block · modify rights · logs · block log) claims to be KnucklesTheSim (talk · contribs · editcount · block · modify rights · logs · block log) under a new name. However, KnucklesTheSim is not blocked, was never blocked, and on one occasion ( ) actually removed profanity from an article. IMO, this is notable because RandomWikiaUser1680 is currently blocked for vandalism and profanity. I am not 100% certain that the two users are in fact the same person. Anybody else have any ideas? Dharden (talk) 13:50, December 31, 2011 (UTC) I don't doubt that KnucklesTheSim, way back in August changed their name to RandomWikiaUser... but based on KTS' good behavior, I would definitely lean towards thinking that their account was somehow hacked, or perhaps some sibling got a hold of their account. It just doesn't fit their previous behavior at all. -- LostInRiverview talk · blog 13:55, December 31, 2011 (UTC) Good point. Dharden (talk) 14:03, December 31, 2011 (UTC) I'd go with the hacking/sibling hijacking theory, given that Knuckles apparently redirected his userpage to that of RWU1680 back in August. According to Special:Listusers, Knuckles apparently logged in on the 18th of December. A checkuser may or may not be redundant as I know that logs are only kept for 3 months but I'm unsure of whether it logs IP addresses based on login data or edits. I do remember a case in the past where a user from Russia constantly vandalised Knuckles' fanon articles and made poor quality fanon articles with similar names. Here, Knuckles reveals that he lives in the UK. Granted that a CU would be pretty useless if RWU1680 is in the UK too (being a friend or sibling), I'm not sure what to do in this case. Lost Labyrinth Image:Flag united kingdom england.svg • (c) • (b) 20:02, December 31, 2011 (UTC) Something worth mentioning, I think, is that KnucklesTheSim is currently unblocked. It might be possible that whoever is hijacking RWU1680 is unaware of that account, so maybe if RWU is blocked, the legitimate user will go back to using KnucklesTheSim, although that transition would, I suppose, technically be considered ban evasion and a sock puppet account. But if the idea is that RWU has been compromised, the admins could choose to let it happen, assuming the legitimate user was still aware of the old account. -- LostInRiverview talk · blog 21:14, December 31, 2011 (UTC) Looks like this edit was made by someone in relation to RWU1680. whatismyipaddress.com shows it as a "Suspected network sharing device" with the hostname of "hosted-by.ecatel.net". By the looks of things, this could possibly be a proxy server (given what looks to be a vhost) although I could be wrong. Lost Labyrinth Image:Flag united kingdom england.svg • (c) • (b) 00:40, January 1, 2012 (UTC) I have contacted KnucklesTheSim and I'm waiting for a response. For the issue above, I think 93.174.93.145 should be RWU1680 themselves. I have blocked the IP for a week and extended RWUO1680's block as well to the same amount. Perhaps we should request a CU? File:Andronikos sig.png00:45, January 1, 2012 (UTC) Sent in a request. Lost Labyrinth Image:Flag united kingdom england.svg • (c) • (b) 00:57, January 1, 2012 (UTC) According to the checkuser, neither have used 93.174.93.145 yet both accounts are using the same email address. Whether or not the address is being shared by a whole family or something like that is beyond me but I still doubt that Knuckles is actually socking. I guess all we can do now is wait for Knuckles to respond to Andronikos. Lost Labyrinth Image:Flag united kingdom england.svg • (c) • (b) 19:13, January 1, 2012 (UTC) Since both accounts use the same email address, it's at least plausible that Knuckles intended to change usernames and that the RWU1680 account was either hacked or hijacked. Regardeless, it does appear to be compromised, and we may need to consider a long-term, or even permanent, block. It also may be advisable to try to contact Knuckles by email, as they may have forgotten about that account. Dharden (talk) 20:19, January 1, 2012 (UTC) I have emailed KnucklesTheSim per Dharden's suggestion and expecting a reply on either the talk page or my inbox. File:Andronikos sig.png 20:48, January 1, 2012 (UTC) Based on a suggestion LiR made via IRC, I've blocked the two accounts indefinitely (but allowed them to edit their talkpages and email administrators) until this situation can be solved. That way, whoever is compromising the account(s) won't be able to continue. Lost Labyrinth Image:Flag united kingdom england.svg • (c) • (b) 21:13, January 3, 2012 (UTC) I had some problems with the editor and I was unable to keep this up to date. I apologize for that. Anyway, I received reply from KnucklesTheSim and he stated that he indeed was RandomWikiaUser, and then spammed with random keystrokes :(. Anyway, I believe mailing wasn't a good idea as an option, as it was confirmed they share the same email, so I'm rather unsure of what we should do next. File:Andronikos sig.png15:42, January 12, 2012 (UTC) I think its better to wait KnucklesTheSim reply on his talkpage to confirm this. because so far he not reply yet on his talk page yet. they share the same email right? so it is possible the email is hijacked too. But if the account is not hijacked and both used by same person (1 for pure editing and 1 for pure vandalizing) like what andronikos receive from KnucklesTheSim email. a sockpuppetry + vandalism will result permanent block for the both account, but based the person still have good contribution I think 1-3 month block + final warning is better for KnucklesTheSim than permanent. but RandomWikiaUser must be blocked permanently. Wiryawan310 01:46, January 13, 2012 (UTC) I feel that we should try and come to a conclusion about this. I'm still under the impression that RWU has hijacked KTS' account, without KTS knowing meaning that RWU could do what he wants with both accounts without the real owner of KTS ever knowing or that RWU and KTS are possible friends/family IRL and KTS may have left his login details somewhere that it can be easily found (like a Word document or something) and RWU has used this and possibly changed some information related to KTS' account (such as the password and email) preventing him from accessing the account. It may also have been possible that RWU used the suspected proxy server to "cover his tracks" and hide the apparent British IP address being used by KTS/RWU or to cover up what could be a legitimate IP address in a different location by using a proxy server that could be utilised by anyone or it could be possible that the proxy is neither user in question (CheckUser only links accounts to IP addresses if an edit has been made while logged into an account while using that IP) and is just a hit-and-run vandal. There may be more situations that could be the case for this but I don't want to put emphasis on this being a bad faith case when we don't know the truth behind this. I'm thinking of leaving the RandomWikiaUser block at permanent (seeing as someone on that email admitted to being him) while I'm currently undecided on what to do about KnucklesTheSim (though I'm leaning towards keeping it at a permanent block just to be safe), though I'm open to suggestions from other administrators. Lost Labyrinth Image:Flag united kingdom england.svg • (c) • (b) 22:58, February 2, 2012 (UTC) I suggest leaving both accounts permanently blocked. We've made an honest attempt to contact the rightful owner of the account (assuming that this really is a hijacking case, which we simply don't know for sure) and we've seen that this user either is really the owner and has just decided to start editing in bad faith, or has been compromised. In either case, we don't want that user having access to the wiki, which means that, failing any evidence that the rightful owner is still around, the best choice is to simply block both indefinitely, perhaps with an apology on the talk page addressed to the 'rightful owner', assuming they ever gain control of the account. The apology could be something explaining the situation, maybe saying 'We have attempted to determine if this account has been compromised, and have tried to act as if the owner of this account is still interested in returning to good standing. However this has not been demonstrated, so unfortunately we have decided to indefinitely block this and its associated account.' -- LostInRiverview talk · blog 23:10, February 2, 2012 (UTC) I agree with LiR. They haven't even argued about their rights to be unblocked, which is kind suspicious. The chance they will be back and notice they can't edit or realize what has happened is small, and we don't want any risk of further action from RWU/KTS. Nikel Talk 08:31, February 3, 2012 (UTC) What everyone else said. ―ฬђ talk 09:20, February 3, 2012 (UTC) I've modified the block accordingly. I guess we can (finally) call this as resolved. Lost Labyrinth Image:Flag united kingdom england.svg • (c) • (b) 20:25, February 5, 2012 (UTC)
|
![[RDF Data]](/fct/images/sw-rdf-blue.png)