Steward requests/Checkuser/2022-07

Requests

StireaBombaAMomentului@ro.wikipedia

Status:    Done

List of users

StireaBombaAMomentului (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

MosiaCinevaOfficial6 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

• CU log

Reason(s): See Steward requests/Checkuser/2022-06#MosiaCinevaOfficial6@ro.wikipedia. The last account is StireaBombaAMomentului. According to what does the vandal said on the deleted user page ro:Utilizator:StireaBombaAMomentului, they will create a lot of accounts in order to attack from multiple accounts at once. Maybe some accounts are already created, so this checkuser request should reveal them. Another issue is that there is no guarantee that these accounts are created on ro.wikipedia.org. --NGC 54 (talk｜contribs) 13:19, 2 July 2022 (UTC)

Doing... --Sotiale (talk) 13:21, 2 July 2022 (UTC)

•  Confirmed StireaBombaAMomentului, MosiaCinevaUnAn, MosiaCinevaOfficial10

I would like to explain to you only that the current measures, which I had previously emailed you, are sufficient to prevent the current turmoil. They are only playing inside your wiki. --Sotiale (talk) 13:27, 2 July 2022 (UTC)

蔡茵佩@zh.wikipedia

Status:    Done

List of users

Mengyin Lee (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

蔡茵佩 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

• CU log
• Discussion: w:zh:Wikipedia:傀儡調查/案件/蔡茵佩

Reason(s): Repetitive addition of SOAP content in w:zh:宏正自動科技. I cannot duck these two accounts, but am aware that this could possibly be a PAID editing situation. A check is requested to support further actions against the users. Thank you! --LuciferianThomas 14:12, 2 July 2022 (UTC)

Doing... --Sotiale (talk) 10:20, 3 July 2022 (UTC)

• Unrelated Mengyin Lee and 蔡茵佩

From a technical point of view. --Sotiale (talk) 10:27, 3 July 2022 (UTC)

吕铭乐@zh.wikipedia

Status:    Not done

List of users

吕铭乐 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

Leemengle 0215 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

• CU log
• Discussion: w:zh:Wikipedia:傀儡調查/案件/吕铭乐

Reason(s): Clear evidence of abusing IP socks by blocked user for user talk spam (I have received at least 12 user talk messages from this user in the past hour). Please check per w:zh:WP:CUP#1 for underlying IP(s/ ranges if any) for checkuser blocks. Thank you! --LuciferianThomas 08:35, 2 July 2022 (UTC)

I'm not sure what this request is for. From what I read, it looks like you want IP rangeblock. If this user appears to you as an IP, ask the admin to block those ranges. I looked through your talkpage history and only one IP could be found. However, this IP is still not blocked, and it is difficult to find evidence that another IP appeared after the block. A simple action is to hardblock the IP. I can't find a good reason to process this request, so I mark it as not done. --Sotiale (talk) 12:57, 2 July 2022 (UTC)

Hmht45tgree3d@zh.wikipedia

Status:    Done

List of users

Hmht45tgree3d (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

Wifik3r8bLk2Zr (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

• CU log
• Discussion: Wikipedia:傀儡調查/案件/Hmht45tgree3d

Reason(s): Similar original research edits converting the w:zh:課長 redirect into a disambiguation page. I also see similar editing patterns from their past contributions, and a check would help confirm if they are the same person. --LuciferianThomas 02:49, 8 July 2022 (UTC)

•  Confirmed Hmht45tgree3d, Wifik3r8bLk2Zr

From a technical point of view. --Sotiale (talk) 13:11, 8 July 2022 (UTC)

HSNUYang@zh.wikipedia

Status:    Done

List of users

HSNUYang (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

mukui likes (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

difience (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

jimmy2952 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

frankriu (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

Wenlianq (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

• CU log
• Discussion: Wikipedia:傀儡調查/案件/HSNU99435

Reason(s): Local sysop's request to check whether these SPAs who !voted in the same AFD are socks or meatpuppets. --LuciferianThomas 02:55, 8 July 2022 (UTC)

•  Confirmed HSNUYang, Banban1322
• Unrelated other accounts

All but confirmed users are considered different users. --Sotiale (talk) 13:19, 8 July 2022 (UTC)

Dancewithdevil@az.wikipedia

Status:    Done

List of users

Dancewithdevil (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

Qraf061 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

Gladiator000 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

• CU log
• Discussion: az:Vikipediya:Kuklalar

Reason(s): Hello, the activity of these users is very similar. I am concerned about possible fraud in the administrator request. Thanks!Turkmen ^talk 12:06, 6 July 2022 (UTC)

Please explain in detail which activities are similar. Your explanation is too abstract and too broad to be a basis for investigation; this is not my personal request, it is required in order for the investigation to proceed. Thanks --Sotiale (talk) 12:44, 8 July 2022 (UTC)

@Sotiale hi, I thought that the views of administrators and especially bureaucrats were not questioned here. In fact, this has never happened in any of my inquiries so far. I might be wrong, sorry. So:

1. A user edits another's page : [1] [2].

2. The user request to us for granting the user right to another.

3. One of the first to support the user is Qraf061 (Dancewithdevil's adminstrator request).

4. They support each other in discussions (Dancewithdevil's former name is Lavici): [3] [4]

5. Also, "Dancewithdevil" was banned on Trwiki for sockpuppet accounts. Turkmen ^talk 21:23, 10 July 2022 (UTC)

Turkmen, Qraf061 and Gladiator000 are  Confirmed. Dancewithdevil is Unrelated to the other two accounts from a technical standpoint. Vermont 🐿️ (talk) 23:15, 10 July 2022 (UTC)

Thanks for the proper explanation. Thanks to your explanation, the investigation went on. --Sotiale (talk) 23:30, 10 July 2022 (UTC)

Mestter@ro.wikipedia

Status:    Withdrawn

List of users

Mestter (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

Iaaasi (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

• CU log
• Discussion: ro:Wikipedia:Checkuser

Reason(s): There is a strong resemblance in activity between the account Mestter and those of the Iaaasi LTA vandal. There is an investigation page at en.wiki.--Kun Kipcsak (talk) 14:27, 6 July 2022 (UTC)

Since they have contribs on enwiki besides rowiki, it is more appropriate to ask enwiki checkuser team to get the result you want as it is a case managed by enwiki. We may not have detailed information about Iaaasi. I recommend that you ask the enwiki checkuser because they can ask us for rowiki data. --Sotiale (talk) 12:47, 8 July 2022 (UTC)

Thank you!--Kun Kipcsak (talk) 18:13, 8 July 2022 (UTC)

Thank you. Then I mark as withdrawn. --Sotiale (talk) 23:31, 10 July 2022 (UTC)

Ttaajq@zh.wikipedia

Status:    Done

List of users

Ttaajq (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

Johnny0976 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

DipAir (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

Accle (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

MODEFAST (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

• CU log
• Discussion: w:zh:Wikipedia:傀儡調查/案件/Ttaajq

Reason(s): Accounts 2-4 are suspected sockpuppets of blocked user Ttaajq, all with common edits in two separate topics (unrelated TV shows) and similar editing patterns, adding FANPOV content to the articles. Account 5 admitted to be Ttaajq's sock account. It is hard to duck on these accounts, so a check is requested to clarify the relationships of the accounts. --LuciferianThomas 01:21, 9 July 2022 (UTC)

Doing... --Sotiale (talk) 10:41, 11 July 2022 (UTC)

•  Confirmed Group 1: MODEFAST, UJL0718, DipAir
•  Confirmed Group 2: Johnny0976, Chou john
• Possible Accle and Group 1

---

• Unlikely Group 1 and 2

From a technical point of view. --Sotiale (talk) 10:57, 11 July 2022 (UTC)

Stalin kzj@zh.wikipedia

Status:    Done

List of users

POIUAB (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

ASCTT (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

霸社 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

CLNJ (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

鼻地大師 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

力量人 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

超級無敵宇宙食材 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

Poiuaa (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

潘佳據12 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

Poiuaaaa (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

• CU log
• Discussion: w:zh:Wikipedia:傀儡調查/案件/Stalin_kzj

Reason(s): Mass groups of accounts found to have similar editing patterns with the Stalin kzj sock/meat groups, recreating deleted content regarding Taiwanese educational institutions. As previous checks revealed that this involves more than one account groups, a check is requested to clarify the relationships between such accounts. Thank you! --LuciferianThomas 01:35, 9 July 2022 (UTC)

•  Confirmed 霸社, ASCTT, POIUAB, Poiuaaaa, CLNJ, Wmll, 潘佳據12, 9m81, 城之內悠二, 芢苒, 烏鴉坐飛雞, 黃凱杰飛天豬, Nykd5432, Stalin kzj, E4tfgrgerge, Rgdrg, Kathleen 0113, 口卡口卡獸愛張旭數學老師, 彩猴, 力量人, NTHUEE, 田勝傑出校友, 口交肛交乳交, 鼻地大師, 超級無敵宇宙食材, 木子小姐, 徐英年, Bighorned0we, RWR03, 堂可可
• Unrelated Poiuaa

---

• They use the IPs of public facilities.
• There may be additional accounts.

From a technical point of view. --Sotiale (talk) 11:41, 11 July 2022 (UTC)

Hellopotter52@zh.wikipedia

Status:    Done

List of users

Hellopotter52 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

Jolee920 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

• CU log
• Discussion: w:zh:Wikipedia:傀儡調查/案件/Hellopotter52

Reason(s): Both accounts are registered on the same day and edits on the same page. Both are caught with the same hardblock/IP block with the same block ID provided in their appeals. Please check on their relationship and the underlying block. Thanks! --LuciferianThomas 09:12, 11 July 2022 (UTC)

Doing... --Sotiale (talk) 10:59, 11 July 2022 (UTC)

•  Confirmed Hellopotter52 and Jolee920

---

• They used VPN.

From a technical point of view. --Sotiale (talk) 11:04, 11 July 2022 (UTC)

Wiki3927@zh.wikipedia

Status:    Done

List of users

Wiki3927 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

金大 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

• CU log
• Discussion: w:zh:Wikipedia:傀儡調查/案件/Wiki3927

Reason(s): The latter account tried to edit the former (temp-blocked) account's user page (was prevented by the abuse filter) and shared edits at w:zh:廣東汕頭幼兒師範高等專科學校. As the former account is hard temp-blocked, a check is needed to clarify the relationships of the two users. --LuciferianThomas 09:40, 11 July 2022 (UTC)

•  Confirmed 金大 and Wiki3927

---

• They used VPN.

From a technical point of view. --Sotiale (talk) 11:18, 11 July 2022 (UTC)

Xingengjiwu@zh.wikipedia

Status:    Done

List of users

Fariuonne (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

月猜月快 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

• CU log
• Discussion: w:zh:Wikipedia:傀儡調查/案件/Xingengjiwu

Reason(s): Local sysop Xiplus reported that dewiki has found some accounts that are seemingly  Confirmed with the Xingengjiwu@zh.wikipedia group, and on first glance the two listed users seems to be related. There are a few more accounts that dewiki CU has reported to Xiplus that seems to be confirmed with their data, but zhwiki contribs do not look similar and thus are not listed out. A local check on zhwiki data is requested to looking into their usage on zhwiki. Thank you! --LuciferianThomas 08:51, 12 July 2022 (UTC)

•  Confirmed Fariuonne, 吳傲雪, 顏竹君, 梁涼傢佳珈瑋, 出生日期不詳, 月猜月快, 嫩江褐鼠與熱帶鳥屬, 無調味堅果, Mazurkitajwańscy, PodilskyiMist, 棋手萱卿, 章彩珍

---

•  Confirmed Xingengjiwu
• They used VPN.

From a technical point of view. --Sotiale (talk) 11:54, 12 July 2022 (UTC)

Chinawu1949@zh.wikipedia

Status:    Done

List of users

W10032758W (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

Chinawu1949 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

• CU log
• Discussion: w:zh:Wikipedia:傀儡調查/案件/Chinawu1949

Reason(s): Creation of the same article/draft on a YouTuber with week's difference. Not sure about their relationship (cannot duck) and thus a check is needed. --LuciferianThomas 10:21, 13 July 2022 (UTC)

Doing... --Sotiale (talk) 10:31, 13 July 2022 (UTC)

•  Confirmed W10032758W and Chinawu1949

From a technical point of view. --Sotiale (talk) 10:34, 13 July 2022 (UTC)

Chinawu1949@zh.wikipedia

Status:    Done

List of users

W10032758W (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

Chinawu1949 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

• CU log
• Discussion: w:zh:Wikipedia:傀儡調查/案件/Chinawu1949

Reason(s): Creation of the same draft/article of a YouTuber. I cannot tell if they are the same user simply via the contents that are available, and thus a check is requested to reveal relationships between the two users. --LuciferianThomas 10:24, 13 July 2022 (UTC)

Yes.. I guess you were tired like me :p --Sotiale (talk) 10:36, 13 July 2022 (UTC)

春风起叶@zh.wikipedia

Status:    Done

List of users

春风起叶 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

• CU log
• Discussion: zh:WP:CUP#3 (Checkuser before granting IPBE), zh:Special:PermaLink/72679590#User:春风起叶

Reason(s): The user is requesting for IPBE. According to the local policy, I as a sysop request to check if the user used a blocked proxy. (They can't follow our alternate process so I'm requesting CU here.) Xiplus (talk) 02:00, 15 July 2022 (UTC)

@Xiplus: Hello. Could you explain to me what it means to not be able to go through an alternate process? Feel free to send me an email if necessary. Thank you. --Sotiale (talk) 13:04, 15 July 2022 (UTC)

@Sotiale: We usually ask users to send their IP address to admin mailing list in lieu of checkuser (zh:WP:IPBEMAIL). The user said they don't have any email accounts. Xiplus (talk) 13:09, 15 July 2022 (UTC)

@Xiplus: It should be noted that this does not mean that stewards are obligated to handle any IPBE requests. Anyway, it's true that this user is not using a normal residential IP, but I couldn't find any evidence that it is currently blocked globally or blocked on zhwiki local. It looks like the requestor can use the account, it would be faster for the requestor to state the blocked IPs himself. --Sotiale (talk) 14:09, 15 July 2022 (UTC)

Thanks! Xiplus (talk) 14:15, 15 July 2022 (UTC)

Umarxon III@uz.wikipedia

Status:    Done

List of users

Umarxon III (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

Uzbekistan PFL (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

• CU log
• Discussion: uz:Wikipedia:Checkuser

Reason(s): I am a Commons CU and was checking Umarxon III for local (Commons) concerns. I found that Umarxon III is confirmed to Uzbekistan PFL, but that the latter has not been used abusively on Commons. The related data, which serve as evidence for this request, are here. In researching x-wiki behaviour, however, I've noticed that the accounts have been used abusively on uz.wiki, including to double-vote at uz:Vikipediya:Yaxshi maqola nomzodlari/Tolibon (Umarxon III, Uzbekistan PFL) This seems especially problematic as Umarxon III is an admin at uz.wiki, making this a breach of that trust. CU data are, of course, valid across projects for SUL accounts, but requesting here to establish an appropriate record, including to support/request sanctions as appropriate, and to assess whether this extends further with sleepers. Эlcobbola _talk 22:08, 15 July 2022 (UTC)

•  Confirmed Umarxon III, UmirovaDilshoda and Uzbekistan PFL

@Elcobbola: From a technical point of view. Since there is supposed to be the local community there, I think that communicating information to the community is a way to make decisions locally. --Sotiale (talk) 22:40, 15 July 2022 (UTC)

RAMSES$44932@ro.wikipedia

Status:    Not done

List of users

RAMSES$44932 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

Editor1722 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

• CU log
• Discussion: ro:Wikipedia:Checkuser

Reason(s): RAMSES$44932 is blocked indefinitely, and Editor1722 behaves like a DUCK; RAMSES$44932 has a history of sockpuppeting, wouldn't be a surprise for them to come back again after being recently banned. Gikü (talk) 16:49, 6 July 2022 (UTC)

@Gikü: If they are ducks, this investigation is not necessary. Do you think they additionally hid the account? I would appreciate it if you could explain why this investigation is necessary. --Sotiale (talk) 12:49, 8 July 2022 (UTC)

Please request again if necessary. Thank you. --Sotiale (talk) 22:45, 15 July 2022 (UTC)

沙漠知乎@zh.wikipedia

Status:    Done

List of users

MARKtygolf (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

钱塘卜算子 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

Yunshuiyilong (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

沙漠知乎 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

• CU log
• Discussion: w:zh:Wikipedia:傀儡調查/案件/沙漠知乎

Reason(s): The first listed account is created right before the other three were blocked, and share similar editing patterns. For the registration time along with other reports on local AIV, I would request for a sleeper check on this account group. Thank you! --LuciferianThomas 16:04, 16 July 2022 (UTC)

Doing... --Sotiale (talk) 09:20, 17 July 2022 (UTC)

•  Confirmed Group 1: 仁和二极管, 沙漠知乎, Yunshuiyilong, 钱塘卜算子
•  Confirmed Group 2: MARKtygolf, Sswongtomsy

---

• Possible Group 1 and 2

From a technical point of view. --Sotiale (talk) 09:26, 17 July 2022 (UTC)

Tommy860119@zh.wikipedia

Status:    Done

List of users

Xgddghvzsady653367 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

633rdfy6re2dhiihr335 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

Ying ying chan20040431 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

8445554KMMFM (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

955544FFGGAG (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

JJHHJGHHJ (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

YJHNNN8221 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

GYNNDDJJ36374 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

勾洋鎮華 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

• CU log
• Discussion: w:zh:Wikipedia:傀儡調查/案件/Tommy860119

Reason(s): Mass Tommy860119 sock appearances with overlapping activities, a sleeper check is needed. --LuciferianThomas 16:09, 16 July 2022 (UTC)

•  Confirmed 633rdfy6re2dhiihr335, 8445554KMMFM, 955544FFGGAG, 997657ggfdkkgh, HK7218311001, Jason4521160, Jimmy Chu 19960330, Jinny Kwan, Johnson Yam911208, Xgddghvzsady653367, Ying ying chan20040431, Ythjhmkkkdd, 勾洋振華, 勾洋震華, 勾洋鎮華, 勾洋波比, 願榮光歸烏克蘭, 願榮光歸香港5201314, HHHJKMMZSG, GYNNDDJJ36374, JJHHJGHHJ, 勾洋辱華, 勾洋俊革, Lau Lung Ma, 台灣加油, YJHNNN8221, Fran·1001·hk Is 3JOH22A, 勾洋鎮華2.0, Hgjnngbnggjjmmhye, BZHHJMM, 戀殖世代18410126, Ffgdfcsrghhrthj

Many VPN ranges are being abused and there may be accounts that are still hidden somewhere. --Sotiale (talk) 09:57, 17 July 2022 (UTC)

Dancewithdevil@az.wikipedia

Status:    Done

List of users

dancewithdevil (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

Viki0Pediya (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

Mammadly (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

• CU log
• Discussion: az:Wikipedia:Checkuser

Reason(s): This user actively engaging sockpuppets to back him in order to become admin in Azerbaijani wikipedia. He was previously blocked in Turkish wikipedia for sockpuppetry as well--Azerifactory (talk) 11:18, 12 July 2022 (UTC)

Please explain the evidence for suspecting that Dancewithdevil uses sockspuppets. In what ways do you think that user is similar to the 2 accounts you presented? And I want to point out that this user has already been checked twice(2022-05, 2022-07). This does not impede the progress of this investigation, but at least requires that you explain on your suspicions in detail. --Sotiale (talk) 11:32, 12 July 2022 (UTC)

Dear Sotiale this is what I've found after research. All of dancewithdevil-related suspected puppets have few things in common

• 1) They are all against my Wikipedia activity despite I'm here for 7 years
• 2) They tend to edit similar articles like on Azerbaijani military related stuff
• 3) Accounts that's been not active for few months tend to suddenly appear on discussion pages and defend the main sockmaster
• 4) They tend to respond for each other
• 5) They tend to edit at very similar time pattern, sometime only 1 minute after each other

Here's the evidence

• Evidence #1 user named Qraf061 appears out of nowhere and suddenly defends Dancewithdevil, despite not been part of this conversation
• Evidence #2 Xeyal appears out of nowhere and suddenly defends Atakhanli. Please check out the edit time 16-14 and 16-34
• Evidence #3 Dancewithdevil edits Gladiator000's profile and writes even some message for him
• All socks tend to edit same article at the same time: Evidence #4 - Just look at time between the edits - Gladiator000 appears on 23-03 followed by minute later by Qraf061, who appears on 23-04. In other case Gladiator000 appears on 22:58, Dancewithdevil appears on 23:00
• Evidence #5 Similar time patterns and edits can be seen here. Gladiator000 often argues that he's not related Qraf061 but both users share same IP and what's even ridicilous, they edit same articles if you look at the evidence
• Evidence #6 In here Dancewithdevil responds for Xayal
• Evidence #7 In here Dancewithdevil again wriets for Qraf061
• Evidence #8 and Evidence #9 Dancewithdevil quickly and frantically tries to remove any info related to his sockpuppetry. I mean why he panics? Because there's something suspicious.
• Evidence #10 User named Mammadly which is not active since 28 May, suddenly appears only and instantly appears on Admins page where Dancewithdevil is lodged an application to become an admin

Now, previously in Wikipedia there were a lot of Azerbaijani users banned as part of same group/network as you can see here Requests for comment/Do something about azwiki. There's a lot of cronysm and some users are funded by Azerbaijan National Academy of Sciences as there's an article about nearly every staff member in this organisation, which is actually related to Azerbaijani state-related organisation seen here

As a result, I would like ask you to research all of these users' patterns as well as open a separate thread on Azerbaijani Wikipedia since there's a lot of admins but vandalism is out everywhere, there's a lot of propaganda based articles as well advertisements. And admins are not doing anything since Azerbaijani Wikipedia is run like a closed shop.

Kind regards

--Azerifactory (talk) 13:12, 15 July 2022 (UTC)

•  Confirmed Group 1: Elonizm, Viki0Pediya, Shakirgv, Gunelmdv, Davudmdv
• Unrelated Mammadly, Dancewithdevil

Well, maybe that's not what you're claiming is possible because of the limitations of checkuser. This is technically a tool to check the relationship between accounts, and you can only find that the same person uses multiple accounts. Practically it is beyond the capabilities of this tool for anyone else to do the same behavior. --Sotiale (talk) 10:34, 17 July 2022 (UTC)

打手唔該同我行開@zh-yue.wikipedia

Status:    Done

List of users

Hkman931 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

Catmanchung (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

打手唔該同我行開 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

糾錯專家 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

• CU log
• Discussion: yue:User talk:打手唔該同我行開

Reason(s): Single-purpose accounts edit-warring to remove unfavourable content and insert favourable content about 鍾詠淵. Catmanchung and Hkman931 were previously confirmed as connected in Steward_requests/Checkuser/2022-04. The two new accounts are likely positives per the duck test but User:打手唔該同我行開 challenged the blocking admin to check their IP, hence this CheckUser request. Deryck C. 17:23, 18 July 2022 (UTC)

Notifying yue.wp admins User:Z423x5c6 and User:H78c67c who participated in the local discussion. Deryck C. 17:25, 18 July 2022 (UTC)

打手唔該同我行開 is Possible at best to the former socks. 糾錯專家 is Unrelated. -- Amanda (she/her) 05:16, 19 July 2022 (UTC)

Lizlinintw@zh.wikipedia

Status:    Done

List of users

Leping0514 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

Lizlinintw (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

• CU log
• Discussion: w:zh:Wikipedia:傀儡調查/案件/Lizlinintw

Reason(s): Lizlinintw has disclosed themselves as a PAID editor for a company. The other account Leping0514 has been posting advertising content of the company on enwiki and also locally gamed the system by making non-constructive edits in a short time to reach autoconfirmed status for uploading the same company's logo, which Lizlinintw then (in breach of local PAID policy) added into the company's article. We would like to request a check to see if the two accounts are controlled by the same person. Thank you! --LuciferianThomas 08:52, 19 July 2022 (UTC)

•  Confirmed Leping0514 and Lizlinintw

--Sotiale (talk) 09:20, 19 July 2022 (UTC)

Tommy860119@zh.wikipedia

Status:    Done

List of users

Fggyhdsgh 754679 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

Fhdsvhut75478 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

Ffgffhhgff (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

Hgdhhjh14941634 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

HHJJGDHGHHKSJ (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

Gghhvgbjkjhs (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

• CU log
• Discussion: w:zh:Wikipedia:傀儡調查/案件/Tommy860119

Reason(s): Cont. recent check (#Tommy860119@zh.wikipedia if it is not yet archived when this is processed), providing more accounts that have not been previously checked and not listed in previous check, seems like out of range of previous check, so providing for further sleeper checking. --LuciferianThomas 14:54, 17 July 2022 (UTC)

Well.. I'll review this tomorrow. --Sotiale (talk) 11:35, 18 July 2022 (UTC)

•  Confirmed 宇良一郎 19940718

There doesn't seem to be any other unblocked accounts. --Sotiale (talk) 12:01, 19 July 2022 (UTC)

A1111223@zh.wikipedia

Status:    Done

List of users

A1111223swzwesers (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

A1122e3r242222 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

222221111ssss (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

• CU log
• Discussion: w:zh:Wikipedia:傀儡調查/案件/A1111223

Reason(s): Accounts 1 and 2 are duck-able, while account 1 shares the same name with the A1111223 account group (account 3 is one previously checked non-stale sock). We cannot duck between the new accounts and the A1111223 account group, so a check is requested. --LuciferianThomas 08:59, 19 July 2022 (UTC)

• Possible Data shows that if their behavior patterns are similar to those of previous accounts, they are more likely to be the same users.

From a technical point of view. --Sotiale (talk) 11:41, 19 July 2022 (UTC)

Seikan Tunnel@zh.wikipedia

Status:    Done

List of users

Seikan Tunnel (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

Super railway (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

• CU log
• Discussion: w:zh:Wikipedia:傀儡調查/案件/Seikan_Tunnel

Reason(s): After Seikan Tunnel (previously known Choi Chin Long) is permablocked for block evasion, Super railway was recently created, showing unexpectedly familiarity with the local village pump and intricate modules like w:zh:Module:Adjacent stations. They also recently edited w:zh:Draft:青函隧道 which was created by the former account (also noting that the article/draft is exactly the former account's name in Chinese). I do find the accounts surprisingly similar, so a check is requested to see if they are related or not. Thank you! --LuciferianThomas 03:38, 20 July 2022 (UTC)

•  Confirmed Super railway, Seikan Tunnel, 𨳒, Hrkbkbmjf, Helloyouu, Lolololololololololololololololololololololololololol, Hihellolololol

---

• In some cases, TOR was used, but this is irrelevant to the findings of the investigation.

From a technical point of view. --Sotiale (talk) 10:25, 20 July 2022 (UTC)

Arrisontan@zh.wikipedia

Status:    Done

List of users

Arrisontan (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

Silva Andre Koimes (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

• CU log
• Discussion: w:zh:Wikipedia:傀儡調查/案件/Arrisontan

Reason(s): Similar edits at zh:居鑾 and cross-wiki advertising of zh:廖城蘭 vs en:Jacky Liew. As both accounts have a certain editing history, a check is requested to reveal or confirm their relationship. --LuciferianThomas 15:19, 26 July 2022 (UTC)

 Confirmed plus Liuujaa. -- Amanda (she/her) 20:41, 26 July 2022 (UTC)

Q28@zh.wikipedia

Status:    Done

List of users

Q28 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

角色扮演对话 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

218-109-193-6a (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

• CU log
• Discussion: w:zh:Wikipedia:傀儡調查/案件/Q28

Reason(s): Local sysop noticed a disruptive IP user earlier today with highly similar editing patterns of the recently (temp)blocked user Q28, including system-gaming activities and disruptive editing in the Wikipedia and template namespaces. The IP's first edit is made when requests to ban the user at the local ANI is highest (on Jul 18, right before he was blocked), and the next edit is made three days later on Jul 21, showing possibilities of being blocked by autoblock which iirc lasts for 24 hours after the last block. While we understand it is not allowed to directly reveal the relationship between users and IPs, we would still like to ask for a check to see if Q28 has been editing logged-off in evasion of his block. Thank you. --LuciferianThomas 06:46, 24 July 2022 (UTC)

I am not User:Q28 's Sockpuppetry. My timetable is not the same as User:Q28. I often edit Wikimedia projects in the midnight and wee hours (UTC+8) ,i.e. 16:00~21:00 (UTC), But User:Q28 is lessly edit at the same time. --218.109.193.6 19:29, 25 July 2022 (UTC)

I created a doppelgänger account on English Wikipedia. You can check the user with User:Q28. --218.109.193.6 22:53, 25 July 2022 (UTC)

A simple question, even though I didn't deny the possibility of IP User knowing professional words of Wikipedia, but it's really impossible to happen in a new IP User did you know? And whatever we are not to check the relations between Q28 to you because that will make troubles in privacy question and the CheckUser Policy prohibit Stewards or CUer to check the relations between a user to an IP Addresss. (In fact, this is equivalent to leaking the privacy of Q28). BureibuNeko (talk) 13:39, 26 July 2022 (UTC)

It means that Stewards will be check Q28 and maybe confirm the question of you in tech, but they will never tell us the relations between Q28 to you for safety. They will check the sleepers of Q28 if they think this user needs a check. And please remember, tech info will never become a decisive factor in judging whether a user is a puppet. The judging need to be combined with many factors. BureibuNeko (talk) 13:49, 26 July 2022 (UTC)

I can barely understand your English, but I'll try to respond. It is not a first-time for checking if a user has abused IP socks during their block - it even is listed in w:zh:WP:CUP#1 as 檢查已封鎖的帳號所使用的IP，便於延長自動封鎖 (in English, checking a blocked user's IP to extend autoblock). CheckUsers obviously routinely checks underlying IPs to find sockpuppets, it is the direct revealing of a user's relationship with an IP that is prohibited. As Steward Sotiale previously states in response to zhwiki SPI clerk questions, [...] that revealing an account and IP (or range) relationship publicly and IP socking investigation are clearly different. General evidence in identifying matching abusive behavior is clearly investigated and provided, and thus a request on IP socking investigation is filed, and there are no problems with that. Stewards will have their way to respond to such IP socking investigations while also trying their best to fulfill requirements of the policies on privacy. LuciferianThomas 15:33, 26 July 2022 (UTC)

I mean that too. BureibuNeko (talk) 06:42, 27 July 2022 (UTC)

I'm putting it on hold for some review. --Sotiale (talk) 13:45, 26 July 2022 (UTC)

I am User:角色扮演对话's alternative accounts. --218.109.193.6 15:07, 26 July 2022 (UTC)

With high doubts of the IP's reply and the mismatch of contribution patterns of the respective users, the two suspected accounts are added to the request.--LuciferianThomas 15:43, 26 July 2022 (UTC)

It's my alternative accounts. I want to Clean start under a new name. I'm sorry for any inconvenience this may cause. Thank you. --角色扮演对话 (talk) 16:10, 26 July 2022 (UTC)

In view of the direct link between the discussion for this opinion and the outcome, i.e. the suspicion of indirect disclosure of other people's Ip addresses, I will seek the advice of the Ombuds commission.---WMLO (talk) 00:33, 27 July 2022 (UTC)

Not done See the statement above. There appears to be no need for investigation. --Sotiale (talk) 00:39, 27 July 2022 (UTC)

@Sotiale: Reopening request as per local sysop's request via off-wiki conversations, behavioral analysis finds the abusive behavior of suspected IPs being nothing like the claimed main account (角色扮演对话) but instead matches way closer to Q28's general behavior and activity. If a check is not available to clarify if Q28 has indeed abused IP sockpuppets, a check is requested between the newly listed accounts to check for their relationship. In regards to WMLO's question, OS can be requested on the SPI page after the case has closed, redacting the involved IP, yet either of them has created an account with the address in it, and therefore I don't know if that counts as self-revealed or not. --LuciferianThomas 02:14, 27 July 2022 (UTC)

218.109.193.6's contributions in Chinese Wikibooks is similar to my contributions in Chinese Wikibooks and Chinese Wikiversity, i.e. import pages in Chinese Wikipedia and use a template in the talk page with the page. --角色扮演对话 (talk) 04:39, 27 July 2022 (UTC)

 Support to checkuser of me and Q28 if this can prove that I am not a sockpuppetry of Q28. --角色扮演对话 (talk) 04:50, 27 July 2022 (UTC)

• There is no technical evidence that Q28 did IP socking.

From a technical point of view. --Sotiale (talk) 08:41, 27 July 2022 (UTC)