Steward requests/Checkuser/2023-02

Please do not post any new comments on this page. This is a discussion archive first created in February 2023, although the comments contained were likely posted before and after this date. See current discussion.

Requests

OP7G0Y@zh.wikipedia

Status: Done

List of users: OP7G0Y (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

CU log
Discussion: w:zh:Wikipedia:傀儡調查/案件/OP7G0Y

Reason(s): The listed account has been speaking out for another user (生米一粒) on the local RFDR (request for removal of rights) page, which was only 10 hours since the account is created, yet there doesn't seem to be similarities between the two accounts. In the user's talk page, they claimed to have experience in the local AfD process despite being a new account, rendering it unlikely to be a clean start account (why would a clean-start reveal that it is an old user?). The user's overall behaviour supports suspicion that it is an undisclosed sockpuppet account, which is still against the rules. Other edits of the user also does not seem like a normal old user abiding to rules, yet not eligible for a simple block. A check is therefore requested, at least on the first listed account, to see if it is a sockpuppet account abused. I hope that a check against a single account can be allowed in this specific case. Thanks! --Luciferian Thomas 13:50, 31 January 2023 (UTC)

I feel like I've seen it somewhere.. Yes, if you're wondering who they are, you can check this account's CA right now. --Sotiale (talk) 12:36, 1 February 2023 (UTC)

Emil Adoj Darvishyanov@az.wikipedia

Status: Done

List of users: DragqueenLadySlim (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Emil Adoj Darvishyanov (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

CU log
Discussion: w:en:Example

Reason(s): These two users are participating in discussions. I doubt they are the same person. 1 2 - Onyeddi (talk) 16:02, 1 February 2023 (UTC)

Confirmed DragqueenLadySlim = Futurolog21
Declined Emil Adoj Darvishyanov - this looks like an edit conflict issue, not a sock. More evidence is required as what is presented is invalid. -- Amanda (she/her) 06:42, 2 February 2023 (UTC)

莒光號列車@zh.wikipedia, 莒光號列車@zh.wikiversity

Status: Done

List of users: 莒光號列車 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); 自強號列車 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); 區間快車 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); 區間車 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); 郵輪式列車 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); 鐵道1 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); 新自動門莒光號 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); 觀光號 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

CU log
Discussion: w:zh:Wikipedia:傀儡調查/案件/莒光號列車

Reason(s): Listed accounts are duckable sockpuppets of the main account 莒光號列車. As the user seems to be continuously creating sockpuppet accounts after autoblock expires in 24 hours, a w:zh:WP:CUP#1 check is requested to block underlying IPs to extend autoblock. Please also check if there are additional sleeper accounts editing in both zh.wikipedia and zh.wikiversity as the account group seems to have a tendency editing in both. --Luciferian Thomas 08:20, 2 February 2023 (UTC)

Adding two accounts according to reports on zh.wikiversity Administrators' Noticeboard. --Luciferian Thomas 09:05, 2 February 2023 (UTC)

Confirmed 郵輪式列車, 鐵道1, 新自動門莒光號, 自強號列車, 區間快車, 區間車, 莒光號列車, 觀光號

From a technical point of view. --Sotiale (talk) 09:45, 2 February 2023 (UTC)

Ləmann Quliyevaa@az.wikipedia

Status: Done

List of users: Ləmann Quliyevaa (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Əskərova Ləman (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Türkan Tağıyeva (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Mehdizadəç (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Rehimli.311 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

CU log
Discussion: Example

Reason(s): familiar user page, familiar activity, short time between registration dates. adding random hyperlinks. Bikar Orxan (talk) 16:24, 2 February 2023 (UTC)

Unlikely or Unrelated

Stale Türkan Tağıyeva

From a technical point of view. The behavioral patterns feel very similar, but they are distinct users, at least technically. There may be a possibility of co-editing. --Sotiale (talk) 13:44, 3 February 2023 (UTC)

Danyl Schiff@en.wikivoyage

Status: Done

List of users: Danyl Schiff (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); PedoCaryJaySmith (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Libertarianmoderate (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

CU log
Discussion: voy:en:Wikivoyage:CheckUser

Reason(s): For context, Libertarianmoderate is one of the English Wikivoyage's most disruptive LTAs. Their main subjects of interest include US politics, war zones in the Middle East (e.g. Syria, Yemen, Iraq), but was banned for homophobic vandalism (such as moving voy:LGBT travel to "Travel for men who like balls") and racism (such as moving voy:en:Middle East to "The Continent of Terrorism"). You can have a look at the various discussions relating to this user such as voy:en:User talk:Libertarianmoderate or voy:en:Wikivoyage:User_ban_nominations/Archive#User:Libertarianmoderate for some context.

Now, en.voy hasn't had many incidents of this user returning since 2019, but I wasn't active back then; I'd defer to those who have been active on the project during that time. I should reiterate that there have been some though, with some being way more obvious than others.

Fast forward to December 2022, and Danyl Schiff was created. At first, most of us thought this was a pretty ordinary user who just had some interest with the holocaust, and Shebba Farms, a destination in the Golan Heights (a disputed region in Israel). Most of us just carried on until normal, that was all until today, when PedoCaryJaySmith was created. The account is basically a vandalism-only account, and its only edit was adding an inappropriate image to voy:en:Phoenix. Later, this user started to overreact and then making an admin nomination; this admin nomination is similar to one that LibMod made in 2018. It's also worth noting that they like to use ALL CAPS, a trait of LibMod, and their userpage also begins with "[w]hat's up", similar to what LibMod does.

I'm happy to provide more evidence need it be. TIA, --SHB2000 (talk | contribs) 10:29, 6 February 2023 (UTC)

Confirmed Danyl Schiff, PedoCaryJaySmith, Camp Lejeune

From a technical point of view. --Sotiale (talk) 10:37, 6 February 2023 (UTC)

Gorbarond@rue.wikipedia

Status: Done

List of users: Gorbarond (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); 94.29.23.254 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Lytbel (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

CU log

Reason(s): Highly problematic edits in the project. The IP is a Russian IP. This request is necessary to find out how far this abuse goes. 𝐖𝐢𝐤𝐢𝐁𝐚𝐲𝐞𝐫 👤💬 08:18, 6 February 2023 (UTC)

Hi, WikiBayer. Revealing the relationship between IP and account is strictly prohibited. Basically it can investigate the relationship between accounts and declare the results, so I'm afraid I won't be able to proceed with this investigation unless there are other suspected accounts. --Sotiale (talk) 08:25, 6 February 2023 (UTC)

@Sotiale now User Lytbel --𝐖𝐢𝐤𝐢𝐁𝐚𝐲𝐞𝐫 👤💬

You've already blocked them, is there any reason to investigate? --Sotiale (talk) 10:30, 6 February 2023 (UTC)

@Sotiale It is to see if this is a major abuse of a single user, or of multiple users. 𝐖𝐢𝐤𝐢𝐁𝐚𝐲𝐞𝐫 👤💬 10:39, 6 February 2023 (UTC)

Unrelated Gorbarond and Lytbel

From a technical point of view. --Sotiale (talk) 10:56, 6 February 2023 (UTC)

Haha456852@zh.wikipedia

Status: Done

List of users: Haha456852 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Kent9801 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Alice0055 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); War1115 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Yes5566 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Laker69 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Bambam0088 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Molly971021 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

CU log
Discussion: zh:Wikipedia:傀儡調查/案件/Haha456852

Reason(s): All of the users listed above share similar naming patterns (letters+numbers). In addition, they all use visualize editor to perform edits such as adding random hyperlinks. Local users have speculated that these patterns indicate a strong possibility for the attempt to "earn" extend-confirm-user status. Please also check for sleepers since there are other users listed in the original request that also indicated such behavior, but I found them to be less likely to be socks of the main account listed in this request. Thanks in advance.

\int

（☎） 07:10, 8 February 2023 (UTC)

Group 1: Alice0055, Bambam0088, Chichizzz, Foodyme, GaryBao168, Isloolbai, Jennie0127, Scouringpad, Takatopa, Tony20201029, Wazisa, Yes5566, Zzyy2020y, 大預言家

Group 2: Kent9801, TongSW, Wclsylar

Their data is too confusing, so I only present them as groups; This is at least Possible, and listed the Likely ones. Be sure to check their contribs.
Please note that this is not declared Confirmed(many of them are confirmed though), just keep in mind that it is likely, please check their contribs.

Accounts that are not in groups have little relevance or Inconclusive.

--Sotiale (talk) 11:37, 8 February 2023 (UTC)

User:YVSREDDY@te.wikipedia

Status: Done

List of users: REDDY GARI VYASALU (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); రెడ్డి గారి వ్యాసాలు (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); YVSREDDY (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

Reason(s): The user has been blocked for five times so far. During and after the last two blocks, the user is suspected to have created the three user accounts, mentioned here. The user did not announce he created them. We wanted to confirm if these are socks. __Chaduvari (talk) 06:42, 11 February 2023 (UTC)

Unfortunately, the above two accounts(REDDY GARI VYASALU and రెడ్డి గారి వ్యాసాలు) are too old to investigate from their last activity. And I couldn't find any other evidence that YVSREDDY is socking now. --Sotiale (talk) 07:20, 11 February 2023 (UTC)

莒光號列車@zh.wikipedia,莒光號列車@zh.wikiversity

Status: Done

List of users: 環島之星 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); 觀光列車 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); 普通區間車 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); 鐵道2 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

CU log
Discussion: w:zh:Wikipedia:傀儡調查/案件/莒光號列車

Reason(s): c.f. Special:Permalink/24473062#莒光號列車@zh.wikipedia,莒光號列車@zh.wikiversity, continued sock abuse. IP block from last time did not stop behaviour, please check for sleeper accounts and implement measures according to w:zh:WP:CUP#1 on both sites. --Luciferian Thomas 01:04, 14 February 2023 (UTC)

Confirmed 鐵道2, 普通區間車, 環島之星, 觀光列車

From a technical point of view. --Sotiale (talk) 04:11, 14 February 2023 (UTC)

陋庵@zh.wikipedia

Status: Done

List of users: 唐一名 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Iphukthegurlandcuminsideher (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); 陋庵 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); 神明製作 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); 教士 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

CU log
Discussion: w:zh:Wikipedia:傀儡調查/案件/陋庵

Reason(s): The first four users have been suspected to be related and falsifying sources for pages, with significantly overlapping editing patterns and pages. The last user is additionally listed as they have created user pages of multiple of these users in the past. Would Sotiale, AmandaNP or any Steward (pinging the two familiar ones) please help handle this case ASAP as the users' data might go stale very soon. --Luciferian Thomas 02:10, 15 February 2023 (UTC)

Confirmed Group 1: Gg0000gg0000, 囧丹, 湯字首, 陋庵, Lesson1, Er54545555, 文宅, A010f06f5d5df5d55df55ew5ew3, 余誠

Confirmed Group 2: Q1C2W3T4, 神明製作, 力士會

Unrelated 教士

Stale Iphukthegurlandcuminsideher, 唐一名

Possible Group 1 and 2

Group 1 was found in the IP range allocated to public facilities, but was cross-checked with regular IPs.
But to be sure, I recommend checking their contribs before making a decision.

From a technical point of view. --Sotiale (talk) 02:52, 15 February 2023 (UTC)

Darader@en.wikinews

Status: Not done

List of users: Darader (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); CorinaOzf731 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

CU log

Reason(s): They edited within same time and they created contents of which is out of project scope --DRC-B5 (talk) 11:48, 15 February 2023 (UTC)

Not done. One is the usual spambot pattern, the other is passive spam or appears to be a self promotion. If an action is required, it can be requested locally, or spambot can request a lock from SRG. --Sotiale (talk) 12:08, 15 February 2023 (UTC)

Canon147@zh.wikipedia

Status: Done

List of users: Canon147 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); 南郡 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); X552 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Gorerggg (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); 林偉凡凡 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); 寬闊海洋關心您 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); 感冒小鯨魚 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

CU log
Discussion: zh:Wikipedia:傀儡調查/案件/Canon147#2023年2月12日

Reason(s): All of these editors have similar editing behavior when it comes to editing a notable politician in Taiwan, zh:黃珊珊: they all intended to beautify the politician's actions and removing content that could be considered negative, even if there were sufficient sources/evidence supporting such claim. Personally, I have come to the conclusion that the first four users can be ducked by editing behavior (first three by edit summary, editing method, and editing behavior while the fourth has an edit that mimics the first user listed). The community has also provided three other users that shows strong correlation in editing behavior, but I cannot find sufficient evidence to duck. Thanks in advance.

\int

（☎） 06:22, 16 February 2023 (UTC)

Doing... --Sotiale (talk) 07:03, 16 February 2023 (UTC)

Confirmed 寬闊海洋關心您, Canon147, 林偉凡凡, 感冒小鯨魚, 南郡, X552

Likely Gorerggg

From a technical point of view. --Sotiale (talk) 07:07, 16 February 2023 (UTC)

Ləmann Quliyevaa@az.wikipedia

Status: Done

List of users: Ləmann Quliyevaa (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Najafova (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

CU log
Discussion: Example

Reason(s): familiar user page, familiar activity, short time between registration dates. adding random hyperlinks. Bikar Orxan (talk) 16:24, 2 February 2023 (UTC)

Based on your recent request, it seems very likely that this investigation will yield similar results. Also, since Ləmann Quliyevaa has already been investigated, I don't think this will make much sense. Nonetheless, can you provide a reason why this investigation should be conducted? If it makes sense, the investigation may proceed, but if not, processing of this request does not seem appropriate. --Sotiale (talk) 13:30, 6 February 2023 (UTC)

Activities on such accounts have increased over the past month. Most of accounts are registered 1 year ago, in recent days new accounts are registered and have the same user page, similar activity. you can check their activity, most of edits got rolbacked but they continue. (just check last edits on azwiki) dont got any answer in their discussion page. I think that account will be used for "voice hunting". there is also a very small chance that is "revenge" from blocked user. Bikar Orxan (talk) 15:16, 6 February 2023 (UTC)

Look, all users have same user page, at least close register date and edits just for count. Not suspicious? Bikar Orxan (talk) 16:10, 6 February 2023 (UTC)

Thanks for the explanation. I mean, you can explain it to your local with whatever you find. As you saw in the previous request, since they are technically distinct, this checkuser tool is not enough to prove that they are the same user. It tells you if they are the same user based on the data they leave behind, it is not the tool to analyze their behavior pattern. So, if there is enough behavioral analysis and they match, it's more appropriate to ask local to block. The information that they don't match just confuses the admin. --Sotiale (talk) 13:10, 7 February 2023 (UTC)

The first version was that they were in a training, but checkuser could not determine that they belonged to the same İP. 2 account got used in voting after claiming 500 edit count. Admin still not sure about blocking. Bikar Orxan (talk) 14:06, 7 February 2023 (UTC)

May I ask what you mean by "The first version was that they were in a training"? I think I don't fully understand what you described. --Sotiale (talk) 11:39, 8 February 2023 (UTC)

At first we taught they was from education center, something like SMM training. All users got banned but, there are some new accounts with same activity. Bikar Orxan (talk) 13:21, 8 February 2023 (UTC)

To be honest, I don't quite understand what you are talking about. I think other steward colleagues probably do the same. Could you elaborate and explain the reason again from the beginning? Please explain again from the beginning, thanks. --Sotiale (talk) 12:09, 15 February 2023 (UTC)

I can see with where you are coming from, as if they are students in the same class. Therefore I ran the check based on that and your evidence. These two are Unrelated. It might be something coordinated online, but either way, CU will not be of use for you moving forward. -- Amanda (she/her) 20:02, 16 February 2023 (UTC)

Debutian @el.wikipedia

Status: Done

List of users: Debutian (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Literartus (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Panoria (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

CU log
Discussion: w:el:ΒΠ:μαριονέτα (el/WP page on Sockpuppetry), w:el:Βικιπαίδεια:Ψηφοθηρία (el/WP page on Canvassing).

Reason(s): User Debutian is SPA that created an article on a person called w:el:ΒΠ:Κωνσταντίνος Τσίγκρης. The article is a product of original research, and possibly a case of COI. The notability of the person is disputed, and there is a discussion on this subject in the talk page of the article, plus a discussion for deletion. New accounts Literartus and Panoria appeared out of the blue to the article's page [1] to support user Debutian opinion that Κωνσταντίνος Τσίγκρης is notable. Those two new users seem to be sock/meatpuppets of Debutian, who created the article. ǁǁǁ ǁ Chalk19 (talk) 10:42, 17 February 2023 (UTC)

Confirmed Panoria, Debutian, Literartus, Archliterature

From a technical point of view. --Sotiale (talk) 11:00, 17 February 2023 (UTC)

Frane1234@hr.wikipedia

Status: Done

List of users: Frane1234 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Ibolanca (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); UnipuML (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Kontic12 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Nstdr (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Anb 171 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); ZessRaiden (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Laura0817 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Tmilic (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); PretentiousJay (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

CU log

Reason(s): Dear checkusers! I am kindly requesting this check. It came to my attention that there is a very similar pattern between these SPA's in a short time period from January 15, 2023 till today. It is always the same case of one account creating a sociological theory themed machine translated article, only to abandon the account and never edit or publish with the same account again. Shortly after this always a new account comes up again only to create another sociological theory themed machine translated article again, to be abadoned and a new account coming up to do the same and so on, and so on... Only a small amount of the accounts has ever again edited after publishing a machine translated article, while the absolute majority of these accounts was instantly abandoned after publishing one machine translated. Another article was never created again by the same account, but in all cases it is always something sociological theories related. It is almost like someone is trying to artifically increasing something, such as the number of articles created, edit count with many articles or number of active users. I am also kindly asking you to check for sleeper accounts. Best regards, Dean72 (talk) 08:42, 21 February 2023 (UTC)

Doing... --Sotiale (talk) 09:03, 21 February 2023 (UTC)

Confirmed Group 1: PretentiousJay, Noa.modrusan, Ibolanca

Unrelated other accounts

Ibolanca is found in IPs assigned to public institutions.

The rest of the accounts do not match technical information.

It looks like co-editing at an educational institution; be careful when deciding actions locally.

From a technical point of view. --Sotiale (talk) 09:14, 21 February 2023 (UTC)

Χρήστης:Ιπποκράτης2020 @el.wikipedia

Status: Not done

List of users: 149.102.246.34 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); 149.102.246.30 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); 149.102.246.40 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

CU log
Discussion: w:el:Βικιπαίδεια:Διορθωπόλεμος (WP page on Edit warring)

Reason(s): User Ιπποκράτης it is confirmed user of this ip [2]. With the above similar ip's conducted edit warring [3] that ended with the other user being blocked. Also i was the recipient of a personal attack here [4] ΔώραΣτρουμπούκη (talk) 02:14, 22 February 2023 (UTC)

We cannot disclose the results of the relationship between IPs or between accounts and IPs according to the privacy related policy. And the 3 IPs you suggested are in the same ranges no matter who sees them, so the admin will be able to decide if necessary. --Sotiale (talk) 09:04, 22 February 2023 (UTC)

Santhosh Notagar@kn.wikipedia

Status: Done

List of users: Santhosh Notagar (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

CU log
Discussion: Hardware_donation_program/Santhosh_Notagar#Endorsements

Reason(s): the user claims that some of repeated/disruptive edits done on both knwiki and enwiki, are not done by them, this request is to verify that their account is compromised or not, ~aanzx ^✉_© 09:03, 27 February 2023 (UTC)

I checked for other reasons. There is nothing detecting a compromise (aka doesn't mean it isn't compromised). -- Amanda (she/her) 11:56, 27 February 2023 (UTC)

ASFERSA@ak.wikipedia

Status: Done

List of users: ASTREWEA (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); Deacba (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); GTREASE (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser); ASFERSA (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

CU log

Reason(s): Creating machine-translated spam articles about people from India. Very similar editing patters and somewhat similar usernames. Amir E. Aharoni (talk) 09:47, 28 February 2023 (UTC)

All locked, including other wikis(global); Deacba, Panatala re, ASADFad, HASXXC, ASFERSA, ASTREWEA, GTREASE, Wh+67. --Sotiale (talk) 10:16, 28 February 2023 (UTC)

@BRPever, علاء, Jasper Deng, and 1997kB: Dear fellow WD checkusers, they have some activity on wikidatawiki as well. You may want to investigate these if your time permits. --Sotiale (talk) 10:16, 28 February 2023 (UTC)

Thanks, @Sotiale. Just a question, because I don't often make requests here: was anything done to prevent it going forward? For example, blocking the IP addresses? Amir E. Aharoni (talk) 11:03, 28 February 2023 (UTC)

In general, such measures are executed when possible, but in this case, there are few possible measures because the IP ranges are distributed. They will abuse by using other IP ranges that are not easily predictable. --Sotiale (talk) 11:20, 28 February 2023 (UTC)