Steward requests/Checkuser/2022-07

Doing... --Sotiale (talk) 13:21, 2 July 2022 (UTC)

• Confirmed StireaBombaAMomentului, MosiaCinevaUnAn, MosiaCinevaOfficial10

I would like to explain to you only that the current measures, which I had previously emailed you, are sufficient to prevent the current turmoil. They are only playing inside your wiki. --Sotiale (talk) 13:27, 2 July 2022 (UTC)

Doing... --Sotiale (talk) 10:20, 3 July 2022 (UTC)

• Unrelated Unrelated Mengyin Lee and 蔡茵佩

From a technical point of view. --Sotiale (talk) 10:27, 3 July 2022 (UTC)

I'm not sure what this request is for. From what I read, it looks like you want IP rangeblock. If this user appears to you as an IP, ask the admin to block those ranges. I looked through your talkpage history and only one IP could be found. However, this IP is still not blocked, and it is difficult to find evidence that another IP appeared after the block. A simple action is to hardblock the IP. I can't find a good reason to process this request, so I mark it as not done. --Sotiale (talk) 12:57, 2 July 2022 (UTC)

• Confirmed Hmht45tgree3d, Wifik3r8bLk2Zr

From a technical point of view. --Sotiale (talk) 13:11, 8 July 2022 (UTC)

• Confirmed HSNUYang, Banban1322
• Unrelated Unrelated other accounts

All but confirmed users are considered different users. --Sotiale (talk) 13:19, 8 July 2022 (UTC)

Please explain in detail which activities are similar. Your explanation is too abstract and too broad to be a basis for investigation; this is not my personal request, it is required in order for the investigation to proceed. Thanks --Sotiale (talk) 12:44, 8 July 2022 (UTC)

@Sotiale hi, I thought that the views of administrators and especially bureaucrats were not questioned here. In fact, this has never happened in any of my inquiries so far. I might be wrong, sorry. So:

1. A user edits another's page : [1] [2].

2. The user request to us for granting the user right to another.

3. One of the first to support the user is Qraf061 (Dancewithdevil's adminstrator request).

4. They support each other in discussions (Dancewithdevil's former name is Lavici): [3] [4]

5. Also, "Dancewithdevil" was banned on Trwiki for sockpuppet accounts. Turkmen ^talk 21:23, 10 July 2022 (UTC)

Turkmen, Qraf061 and Gladiator000 are Confirmed. Dancewithdevil is Unrelated Unrelated to the other two accounts from a technical standpoint. Vermont 🐿️ (talk) 23:15, 10 July 2022 (UTC)

Thanks for the proper explanation. Thanks to your explanation, the investigation went on. --Sotiale (talk) 23:30, 10 July 2022 (UTC)

Since they have contribs on enwiki besides rowiki, it is more appropriate to ask enwiki checkuser team to get the result you want as it is a case managed by enwiki. We may not have detailed information about Iaaasi. I recommend that you ask the enwiki checkuser because they can ask us for rowiki data. --Sotiale (talk) 12:47, 8 July 2022 (UTC)

Thank you!--Kun Kipcsak (talk) 18:13, 8 July 2022 (UTC)

Thank you. Then I mark as withdrawn. --Sotiale (talk) 23:31, 10 July 2022 (UTC)

Doing... --Sotiale (talk) 10:41, 11 July 2022 (UTC)

• Confirmed Group 1: MODEFAST, UJL0718, DipAir
• Confirmed Group 2: Johnny0976, Chou john
• Possible Possible Accle and Group 1

---

• Unlikely Unlikely Group 1 and 2

From a technical point of view. --Sotiale (talk) 10:57, 11 July 2022 (UTC)

• Confirmed 霸社, ASCTT, POIUAB, Poiuaaaa, CLNJ, Wmll, 潘佳據12, 9m81, 城之內悠二, 芢苒, 烏鴉坐飛雞, 黃凱杰飛天豬, Nykd5432, Stalin kzj, E4tfgrgerge, Rgdrg, Kathleen 0113, 口卡口卡獸愛張旭數學老師, 彩猴, 力量人, NTHUEE, 田勝傑出校友, 口交肛交乳交, 鼻地大師, 超級無敵宇宙食材, 木子小姐, 徐英年, Bighorned0we, RWR03, 堂可可
• Unrelated Unrelated Poiuaa

---

• They use the IPs of public facilities.
• There may be additional accounts.

From a technical point of view. --Sotiale (talk) 11:41, 11 July 2022 (UTC)

Doing... --Sotiale (talk) 10:59, 11 July 2022 (UTC)

• Confirmed Hellopotter52 and Jolee920

---

• They used VPN.

From a technical point of view. --Sotiale (talk) 11:04, 11 July 2022 (UTC)

• Confirmed 金大 and Wiki3927

---

• They used VPN.

From a technical point of view. --Sotiale (talk) 11:18, 11 July 2022 (UTC)

• Confirmed Fariuonne, 吳傲雪, 顏竹君, 梁涼傢佳珈瑋, 出生日期不詳, 月猜月快, 嫩江褐鼠與熱帶鳥屬, 無調味堅果, Mazurkitajwańscy, PodilskyiMist, 棋手萱卿, 章彩珍

---

• Confirmed Xingengjiwu
• They used VPN.

From a technical point of view. --Sotiale (talk) 11:54, 12 July 2022 (UTC)

Doing... --Sotiale (talk) 10:31, 13 July 2022 (UTC)

• Confirmed W10032758W and Chinawu1949

From a technical point of view. --Sotiale (talk) 10:34, 13 July 2022 (UTC)

Yes.. I guess you were tired like me :p --Sotiale (talk) 10:36, 13 July 2022 (UTC)

@Xiplus: Hello. Could you explain to me what it means to not be able to go through an alternate process? Feel free to send me an email if necessary. Thank you. --Sotiale (talk) 13:04, 15 July 2022 (UTC)

@Sotiale: We usually ask users to send their IP address to admin mailing list in lieu of checkuser (zh:WP:IPBEMAIL). The user said they don't have any email accounts. Xiplus (talk) 13:09, 15 July 2022 (UTC)

@Xiplus: It should be noted that this does not mean that stewards are obligated to handle any IPBE requests. Anyway, it's true that this user is not using a normal residential IP, but I couldn't find any evidence that it is currently blocked globally or blocked on zhwiki local. It looks like the requestor can use the account, it would be faster for the requestor to state the blocked IPs himself. --Sotiale (talk) 14:09, 15 July 2022 (UTC)

Thanks! Xiplus (talk) 14:15, 15 July 2022 (UTC)

• Confirmed Umarxon III, UmirovaDilshoda and Uzbekistan PFL

@Elcobbola: From a technical point of view. Since there is supposed to be the local community there, I think that communicating information to the community is a way to make decisions locally. --Sotiale (talk) 22:40, 15 July 2022 (UTC)

@Gikü: If they are ducks, this investigation is not necessary. Do you think they additionally hid the account? I would appreciate it if you could explain why this investigation is necessary. --Sotiale (talk) 12:49, 8 July 2022 (UTC)

Please request again if necessary. Thank you. --Sotiale (talk) 22:45, 15 July 2022 (UTC)

Doing... --Sotiale (talk) 09:20, 17 July 2022 (UTC)

• Confirmed Group 1: 仁和二极管, 沙漠知乎, Yunshuiyilong, 钱塘卜算子
• Confirmed Group 2: MARKtygolf, Sswongtomsy

---

• Possible Possible Group 1 and 2

From a technical point of view. --Sotiale (talk) 09:26, 17 July 2022 (UTC)

• Confirmed 633rdfy6re2dhiihr335, 8445554KMMFM, 955544FFGGAG, 997657ggfdkkgh, HK7218311001, Jason4521160, Jimmy Chu 19960330, Jinny Kwan, Johnson Yam911208, Xgddghvzsady653367, Ying ying chan20040431, Ythjhmkkkdd, 勾洋振華, 勾洋震華, 勾洋鎮華, 勾洋波比, 願榮光歸烏克蘭, 願榮光歸香港5201314, HHHJKMMZSG, GYNNDDJJ36374, JJHHJGHHJ, 勾洋辱華, 勾洋俊革, Lau Lung Ma, 台灣加油, YJHNNN8221, Fran·1001·hk Is 3JOH22A, 勾洋鎮華2.0, Hgjnngbnggjjmmhye, BZHHJMM, 戀殖世代18410126, Ffgdfcsrghhrthj

Many VPN ranges are being abused and there may be accounts that are still hidden somewhere. --Sotiale (talk) 09:57, 17 July 2022 (UTC)

Please explain the evidence for suspecting that Dancewithdevil uses sockspuppets. In what ways do you think that user is similar to the 2 accounts you presented? And I want to point out that this user has already been checked twice(2022-05, 2022-07). This does not impede the progress of this investigation, but at least requires that you explain on your suspicions in detail. --Sotiale (talk) 11:32, 12 July 2022 (UTC)

Dear Sotiale this is what I've found after research. All of dancewithdevil-related suspected puppets have few things in common

• 1) They are all against my Wikipedia activity despite I'm here for 7 years
• 2) They tend to edit similar articles like on Azerbaijani military related stuff
• 3) Accounts that's been not active for few months tend to suddenly appear on discussion pages and defend the main sockmaster
• 4) They tend to respond for each other
• 5) They tend to edit at very similar time pattern, sometime only 1 minute after each other

Here's the evidence

• Evidence #1 user named Qraf061 appears out of nowhere and suddenly defends Dancewithdevil, despite not been part of this conversation
• Evidence #2 Xeyal appears out of nowhere and suddenly defends Atakhanli. Please check out the edit time 16-14 and 16-34
• Evidence #3 Dancewithdevil edits Gladiator000's profile and writes even some message for him
• All socks tend to edit same article at the same time: Evidence #4 - Just look at time between the edits - Gladiator000 appears on 23-03 followed by minute later by Qraf061, who appears on 23-04. In other case Gladiator000 appears on 22:58, Dancewithdevil appears on 23:00
• Evidence #5 Similar time patterns and edits can be seen here. Gladiator000 often argues that he's not related Qraf061 but both users share same IP and what's even ridicilous, they edit same articles if you look at the evidence
• Evidence #6 In here Dancewithdevil responds for Xayal
• Evidence #7 In here Dancewithdevil again wriets for Qraf061
• Evidence #8 and Evidence #9 Dancewithdevil quickly and frantically tries to remove any info related to his sockpuppetry. I mean why he panics? Because there's something suspicious.
• Requests for comment/Do something about azwiki. There's a lot of cronysm and some users are funded by Azerbaijan National Academy of Sciences as there's an article about nearly every staff member in this organisation, which is actually related to Azerbaijani state-related organisation seen here

  As a result, I would like ask you to research all of these users' patterns as well as open a separate thread on Azerbaijani Wikipedia since there's a lot of admins but vandalism is out everywhere, there's a lot of propaganda based articles as well advertisements. And admins are not doing anything since Azerbaijani Wikipedia is run like a closed shop.

  Kind regards

  --Azerifactory (talk) 13:12, 15 July 2022 (UTC)

  • Confirmed Group 1: Elonizm, Viki0Pediya, Shakirgv, Gunelmdv, Davudmdv
  • Unrelated Unrelated Mammadly, Dancewithdevil

  Well, maybe that's not what you're claiming is possible because of the limitations of checkuser. This is technically a tool to check the relationship between accounts, and you can only find that the same person uses multiple accounts. Practically it is beyond the capabilities of this tool for anyone else to do the same behavior. --Sotiale (talk) 10:34, 17 July 2022 (UTC)

  打手唔該同我行開@zh-yue.wikipedia

  Status: Done

  List of users

  Hkman931 (contr · deleted · block · log · block log · guc · checkuser · lwcheckuser )

  Catmanchung (contr · deleted · block · log · block log · guc · checkuser · lwcheckuser )

  打手唔該同我行開 (contr · deleted · block · log · block log · guc · checkuser · lwcheckuser )

  糾錯專家 (contr · deleted · block · log · block log · guc · checkuser · lwcheckuser )

  • CU log
  • Discussion: yue:User talk:打手唔該同我行開

  Reason(s): Single-purpose accounts edit-warring to remove unfavourable content and insert favourable content about 鍾詠淵. Catmanchung and Hkman931 were previously confirmed as connected in Steward_requests/Checkuser/2022-04. The two new accounts are likely positives per the duck test but User:打手唔該同我行開 challenged the blocking admin to check their IP, hence this CheckUser request. Der yck C. 17:23, 18 July 2022 (UTC)

  Notifying yue.wp admins User:Z423x5c6 and User:H78c67c who participated in the local discussion. Der yck C. 17:25, 18 July 2022 (UTC)

  打手唔該同我行開 is Possible Possible at best to the former socks. 糾錯專家 is Unrelated Unrelated. -- Amanda (she/her) 05:16, 19 July 2022 (UTC)

  Lizlinintw@zh.wikipedia

  Status: Done

  List of users

  Leping0514 (contr · deleted · block · log · block log · guc · checkuser · lwcheckuser )

  Lizlinintw (contr · deleted · block · log · block log · guc · checkuser · lwcheckuser )

  • CU log
  • Discussion: w:zh:Wikipedia:傀儡調查/案件/Lizlinintw

  Reason(s): Lizlinintw has disclosed themselves as a PAID editor for a company. The other account Leping0514 has been posting advertising content of the company on enwiki and also locally gamed the system by making non-constructive edits in a short time to reach autoconfirmed status for uploading the same company's logo, which Lizlinintw then (in breach of local PAID policy) added into the company's article. We would like to request a check to see if the two accounts are controlled by the same person. Thank you! --Luciferian Thomas 08:52, 19 July 2022 (UTC)

  • Confirmed Leping0514 and Lizlinintw

  --Sotiale (talk) 09:20, 19 July 2022 (UTC)

  Tommy860119@zh.wikipedia

  Status: Done

  List of users

  Fggyhdsgh 754679 (contr · deleted · block · log · block log · guc · checkuser · lwcheckuser )

  Fhdsvhut75478 (contr · deleted · block · log · block log · guc · checkuser · lwcheckuser )

  Ffgffhhgff (contr · deleted · block · log · block log · guc · checkuser · lwcheckuser )

  Hgdhhjh14941634 (contr · deleted · block · log · block log · guc · checkuser · lwcheckuser )

  HHJJGDHGHHKSJ (contr · deleted · block · log · block log · guc · checkuser · lwcheckuser )

  Gghhvgbjkjhs (contr · deleted · block · log · block log · guc · checkuser · lwcheckuser )

  • CU log
  • Discussion: w:zh:Wikipedia:傀儡調查/案件/Tommy860119

  Reason(s): Cont. recent check (#Tommy860119@zh.wikipedia if it is not yet archived when this is processed), providing more accounts that have not been previously checked and not listed in previous check, seems like out of range of previous check, so providing for further sleeper checking. --Luciferian Thomas 14:54, 17 July 2022 (UTC)

  Well.. I'll review this tomorrow. --Sotiale (talk) 11:35, 18 July 2022 (UTC)

  • Confirmed 宇良一郎 19940718

  There doesn't seem to be any other unblocked accounts. --Sotiale (talk) 12:01, 19 July 2022 (UTC)

  A1111223@zh.wikipedia

  Status: Done

  List of users

  A1111223swzwesers (contr · deleted · block · log · block log · guc · checkuser · lwcheckuser )

  A1122e3r242222 (contr · deleted · block · log · block log · guc · checkuser · lwcheckuser )

  222221111ssss (contr · deleted · block · log · block log · guc · checkuser · lwcheckuser )

  • CU log
  • Discussion: w:zh:Wikipedia:傀儡調查/案件/A1111223

  Reason(s): Accounts 1 and 2 are duck-able, while account 1 shares the same name with the A1111223 account group (account 3 is one previously checked non-stale sock). We cannot duck between the new accounts and the A1111223 account group, so a check is requested. --Luciferian Thomas 08:59, 19 July 2022 (UTC)

  • Possible Possible Data shows that if their behavior patterns are similar to those of previous accounts, they are more likely to be the same users.

  From a technical point of view. --Sotiale (talk) 11:41, 19 July 2022 (UTC)

  Seikan Tunnel@zh.wikipedia

  Status: Done

  List of users

  Seikan Tunnel (contr · deleted · block · log · block log · guc · checkuser · lwcheckuser )

  Super railway (contr · deleted · block · log · block log · guc · checkuser · lwcheckuser )

  • CU log
  • Discussion: w:zh:Wikipedia:傀儡調查/案件/Seikan_Tunnel

  Reason(s): After Seikan Tunnel (previously known Choi Chin Long) is permablocked for block evasion, Super railway was recently created, showing unexpectedly familiarity with the local village pump and intricate modules like w:zh:Module:Adjacent stations. They also recently edited w:zh:Draft:青函隧道 which was created by the former account (also noting that the article/draft is exactly the former account's name in Chinese). I do find the accounts surprisingly similar, so a check is requested to see if they are related or not. Thank you! --Luciferian Thomas 03:38, 20 July 2022 (UTC)

  • Confirmed Super railway, Seikan Tunnel, 𨳒, Hrkbkbmjf, Helloyouu, Lolololololololololololololololololololololololololol, Hihellolololol

  ---

  • In some cases, TOR was used, but this is irrelevant to the findings of the investigation.

  From a technical point of view. --Sotiale (talk) 10:25, 20 July 2022 (UTC)

  Arrisontan@zh.wikipedia

  Status: Done

  List of users

  Arrisontan (contr · deleted · block · log · block log · guc · checkuser · lwcheckuser )

  Silva Andre Koimes (contr · deleted · block · log · block log · guc · checkuser · lwcheckuser )

  • CU log
  • Discussion: w:zh:Wikipedia:傀儡調查/案件/Arrisontan

  Reason(s): Similar edits at zh:居鑾 and cross-wiki advertising of zh:廖城蘭 vs en:Jacky Liew. As both accounts have a certain editing history, a check is requested to reveal or confirm their relationship. --Luciferian Thomas 15:19, 26 July 2022 (UTC)

  Confirmed plus Liuujaa. -- Amanda (she/her) 20:41, 26 July 2022 (UTC)

  Q28@zh.wikipedia

  Status: Done

  List of users

  Q28 (contr · deleted · block · log · block log · guc · checkuser · lwcheckuser )

  角色扮演对话 (contr · deleted · block · log · block log · guc · checkuser · lwcheckuser )

  218-109-193-6a (contr · deleted · block · log · block log · guc · checkuser · lwcheckuser )

  • CU log
  • Discussion: w:zh:Wikipedia:傀儡調查/案件/Q28

  Reason(s): Local sysop noticed a disruptive IP user earlier today with highly similar editing patterns of the recently (temp)blocked user Q28, including system-gaming activities and disruptive editing in the Wikipedia and template namespaces. The IP's first edit is made when requests to ban the user at the local ANI is highest (on Jul 18, right before he was blocked), and the next edit is made three days later on Jul 21, showing possibilities of being blocked by autoblock which iirc lasts for 24 hours after the last block. While we understand it is not allowed to directly reveal the relationship between users and IPs, we would still like to ask for a check to see if Q28 has been editing logged-off in evasion of his block. Thank you. --Luciferian Thomas 06:46, 24 July 2022 (UTC)

  I am not User:Q28 's Sockpuppetry. My timetable is not the same as User:Q28. I often edit Wikimedia projects in the midnight and wee hours (UTC+8) ,i.e. 16:00~21:00 (UTC), But User:Q28 is lessly edit at the same time. --218.109.193.6 19:29, 25 July 2022 (UTC)

  I created a doppelgänger account on English Wikipedia. You can check the user with User:Q28. --218.109.193.6 22:53, 25 July 2022 (UTC)

  A simple question, even though I didn't deny the possibility of IP User knowing professional words of Wikipedia, but it's really impossible to happen in a new IP User did you know? And whatever we are not to check the relations between Q28 to you because that will make troubles in privacy question and the CheckUser Policy prohibit Stewards or CUer to check the relations between a user to an IP Addresss. (In fact, this is equivalent to leaking the privacy of Q28). BureibuNeko (talk) 13:39, 26 July 2022 (UTC)

  It means that Stewards will be check Q28 and maybe confirm the question of you in tech, but they will never tell us the relations between Q28 to you for safety. They will check the sleepers of Q28 if they think this user needs a check. And please remember, tech info will never become a decisive factor in judging whether a user is a puppet. The judging need to be combined with many factors. BureibuNeko (talk) 13:49, 26 July 2022 (UTC)

  I can barely understand your English, but I'll try to respond. It is not a first-time for checking if a user has abused IP socks during their block - it even is listed in w:zh:WP:CUP#1 as 檢查已封鎖的帳號所使用的IP,便於延長自動封鎖 (in English, checking a blocked user's IP to extend autoblock). CheckUsers obviously routinely checks underlying IPs to find sockpuppets, it is the direct revealing of a user's relationship with an IP that is prohibited. As Steward Sotiale previously states in response to zhwiki SPI clerk questions, [...] that revealing an account and IP (or range) relationship publicly and IP socking investigation are clearly different. General evidence in identifying matching abusive behavior is clearly investigated and provided, and thus a request on IP socking investigation is filed, and there are no problems with that. Stewards will have their way to respond to such IP socking investigations while also trying their best to fulfill requirements of the policies on privacy. Luciferian Thomas 15:33, 26 July 2022 (UTC)

  I mean that too. BureibuNeko (talk) 06:42, 27 July 2022 (UTC)

  I'm putting it on hold for some review. --Sotiale (talk) 13:45, 26 July 2022 (UTC)

  I am User:角色扮演对话's alternative accounts. --218.109.193.6 15:07, 26 July 2022 (UTC)

  With high doubts of the IP's reply and the mismatch of contribution patterns of the respective users, the two suspected accounts are added to the request.--Luciferian Thomas 15:43, 26 July 2022 (UTC)

  It's my alternative accounts. I want to Clean start under a new name. I'm sorry for any inconvenience this may cause. Thank you. --角色扮演对话 (talk) 16:10, 26 July 2022 (UTC)

  In view of the direct link between the discussion for this opinion and the outcome, i.e. the suspicion of indirect disclosure of other people's Ip addresses, I will seek the advice of the Ombuds commission.---WMLO (talk) 00:33, 27 July 2022 (UTC)

  Not done See the statement above. There appears to be no need for investigation. --Sotiale (talk) 00:39, 27 July 2022 (UTC)

  @Sotiale: Reopening request as per local sysop's request via off-wiki conversations, behavioral analysis finds the abusive behavior of suspected IPs being nothing like the claimed main account (角色扮演对话) but instead matches way closer to Q28's general behavior and activity. If a check is not available to clarify if Q28 has indeed abused IP sockpuppets, a check is requested between the newly listed accounts to check for their relationship. In regards to WMLO's question, OS can be requested on the SPI page after the case has closed, redacting the involved IP, yet either of them has created an account with the address in it, and therefore I don't know if that counts as self-revealed or not. --Luciferian Thomas 02:14, 27 July 2022 (UTC)

  218.109.193.6's contributions in Chinese Wikibooks and a template in the talk page with the page. --角色扮演对话 (talk) 04:39, 27 July 2022 (UTC)

  Support Support to checkuser of me and Q28 if this can prove that I am not a sockpuppetry of Q28. --角色扮演对话 (talk) 04:50, 27 July 2022 (UTC)

  • There is no technical evidence that Q28 did IP socking.

  From a technical point of view. --Sotiale (talk) 08:41, 27 July 2022 (UTC)

• Talk archives
• Steward requests archive/Checkuser

• Noindexed pages