Steward requests/Checkuser/2022-10

Please do not post any new comments on this page. This is a discussion archive first created in October 2022, although the comments contained were likely posted before and after this date. See current discussion.

•  Confirmed 賈大夫, Low Chi Sum, 子華神, 武能量, Ghost King Lui Yiu Yeung, 元朗國大總統, 東方不敗マスター・アジア, 神州第一刀, 吾自橫刀仰天笑，去留肝膽兩崑崙, 關耀歌, 抵智森, 奔雷虎耀揚, 雷雨洋, 曹子丹, 低智森

From a technical point of view. --Sotiale (talk) 11:34, 2 October 2022 (UTC)

All three are  Confirmed plus Adam-synagda. -- Amanda (she/her) 11:13, 8 October 2022 (UTC)

Thanks. ~Styyx^{Talk? ^-^} 11:15, 8 October 2022 (UTC)

大大大大大大大大大大大大大大大大大大 is wayyyyyy beyond stale. Please remember to check this before reporting. -- Amanda (she/her) 01:26, 9 October 2022 (UTC)

Sorry if I didn't mention it clearly, I was looking for Sotiale's past data since they did check for the account in March 2022. I think only they can help with me in this case. LuciferianThomas 01:28, 9 October 2022 (UTC)

Steward_requests/Checkuser/2022-03#LTA:Wen_Ng_Ng@zh.wikipedia. LuciferianThomas 01:31, 9 October 2022 (UTC)

• Unrelated Kurama8964 and Wen Ng Ng

There is one thing I would like to point out regarding this request. I dealt with this because there is no other option, but SRCU can in principle be handled by all stewards, and any steward's action should be available for review. Typically, this stale account investigation is a very exceptional case as no other steward can review it, and I should be held accountable for it. This is also true when ombuds review my actions. Of course, I know you've seen me find several block evaders that have been hiding for a long time. This was to make sure you don't feel uncomfortable, as I understand the situation on zhwiki, but in principle, acting like a local checkuser as a steward can create structural problems; I cannot be free from these criticisms regardless of my intentions. Therefore, please refrain from specifically requesting me as a processor on SRCU. And I ask that you only make these requests when it is really necessary. I hope for your generous understanding. --Sotiale (talk) 03:06, 9 October 2022 (UTC)

Understood, I only request for a specific CheckUser/Steward in the case of possibly stale data which has been checked before. LuciferianThomas 03:23, 9 October 2022 (UTC)

While close editing to each other on a huge amount of articles is a sign of sockpuppetry, it is not sufficient on it's own to warrant a check. The userpages I'm less concerned about because it editors showing off the articles they edit. I'm looking for editing the same small topic areas & similar edits. This is why we require diffs for CheckUser. Please provide more evidence before accusing long-term editors like this. -- Amanda (she/her) 10:24, 8 October 2022 (UTC)

Both accounts additionally shared highly similar edit summaries in a short time interval (with exact same wordings), both also attempted to remove deletion templates from the very same article with a gap of less than 5 hours. AFD users noticed their vast similarities in editing, and therefore requested for a check. LuciferianThomas 01:27, 9 October 2022 (UTC)

Please provide links to this so that we can review it. -- Amanda (she/her) 01:38, 9 October 2022 (UTC)

Editor Interaction (users both rarely use edit summaries apart from default ones or those one-click summaries provided with gadgets: [1] [2] [3], yet when they actually write their own edit summaries they almost use the same wordings: "參考英文wiki" lit. refer to English wiki, with clear mutual tendency to use edit summaries only in the exact same venues), Interaction Timeline. LuciferianThomas 01:53, 9 October 2022 (UTC)

Thank you for the links. I have taken a good amount of time to think this through, and I still don't see enough evidence to back up a sock accusation. Maybe they are collaborating, or learned off each other, but the only thing that comes close to me thinking they might be socks is the AfD issue (which is not linked). Either way though, that would not be enough on it's own on balance with the fact that they have 10k contribs each. There is even a point where one reverts the other. So at this point, this request is  Declined. -- Amanda (she/her) 14:59, 9 October 2022 (UTC)

If it's a duck block, then administrators need to be willing to stand behind their block and not be relying on CU. If it's not a duck, and does need CUing, then you have bigger problems than requesting a CU here (aka it's a bad block). Once you declare something a duck, CU should not have to get involved to verify. -- Amanda (she/her) 10:24, 8 October 2022 (UTC)

 Declined. -- Amanda (she/her) 14:59, 9 October 2022 (UTC)

Status:    Done

List of users

Abdul Wahild Kalam (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

黑夜暗梦 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

Yangbufu (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

• CU log
• Discussion: zh:Wikipedia:傀儡調查/案件/Abdul_Wahild_Kalam

Reason(s): All of these users listed strongly showed four similar traits: using mobile editing, edit articles that are related to the Pakistan Military, and using original translation (meaning those translated names are not verified by sources). The most interesting part is that they all somehow relate to an experienced patroller, User:Alexander_Windsor (I'll use AW for short when referring to this user). The first account created the page zh:莫哈末阿茲·可汗, which AW did some edit afterwards; the second account copied AW's original user infobox zh:Special:diff/73746897 and refilled the information that seems to mock what the original infobox are stating: an underage person that has some foreign background (by that I mean the type of editor that's not very common on zh.wiki: AW is, according to his user page, British, while 黑夜暗梦 is Pakistani); the third account did vandalism on AW's user page. All of these three account's behaviors are quite consistent, editing topics from past generals of the Pakistani army to Pakistani politicians to warships owned by Pakistan (well, some were bought from Britain).

Some other evidence can be found by cross-referencing their edits: editors have pointed out in local SPI that these accounts all misused parentheses, improper translations (like translating the word frigate into corvette (in Chinese) and vice versa, to put it simple in English), and potentially using alt accounts (yes, it's listed as one of the above three users) to vandalize user pages after the user requested to delete a page that is created by one of the other three accounts listed above.

I'm not trying to state that User:Alexander_Windsor is conducting sockpuppetry (if I do, I would've included above as one of the users requested to check). I'm simply stating what I have observed (and other members of the community), and I have found it reasonable to submit this check. Thanks in advanced. ${\displaystyle \int }$（☎） 06:12, 11 October 2022 (UTC)

Doing... --Sotiale (talk) 01:56, 12 October 2022 (UTC)

•  Confirmed 黑夜暗梦, 喵喵灵梦, Yangbufu, Abdul Wahild Kalam, Abdul Aziz Ghazi Amin, Yangfeilong

---

• They used VPN or proxies.

From a technical point of view. --Sotiale (talk) 02:04, 12 October 2022 (UTC)

Doing... --Sotiale (talk) 02:09, 12 October 2022 (UTC)

•  Confirmed Aftercrop, Andrewler, Calcit11, Hadysylmy, Adam-synagda

From a technical point of view. --Sotiale (talk) 02:09, 12 October 2022 (UTC)

Status:    Done

List of users

孟天皓 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

Jeomening (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

• CU log
• Discussion: zh:維基百科:傀儡調查/案件/孟天皓

Reason(s): After discovered Jeomening directly copied his/her common.js from 孟天皓, an indefinitely blocked user, an investigation has been initiated to find correlation between the two users. Both users showed a highly correlated editing behavior in draft namespace, explicitly shown here and here. Other correlations such as using Simplified Chinese and same version of Wikiplus from User:AnYiLin throughout also supports this possible claim of sock abuse. However, the article involved in the draft namespace are also edited and translate by other users in a similar manner; a duck is not very possible; a check is therefore requested. Thanks in advance. ${\displaystyle \int }$（☎） 17:51, 15 October 2022 (UTC)

Likely Using the same UA, on the same mobile network and VPN. -- Amanda (she/her) 01:27, 16 October 2022 (UTC)

Status:    Done

List of users

黃尺文 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

韓音江 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

黃光明 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

何德信 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

盧文化 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

何毴 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

虞文建 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

役天 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

• CU log
• Discussion: zh:維基百科:傀儡調查/案件/黃尺文

Reason(s): On 10/13, a user reported that the first four accounts (黃尺文, 韓音江, 黃光明, 何德信) and were ducked due to editing behavior. Shortly after, on 10/19, the same user has reported another group of accounts (盧文化, 何毴, 虞文建, 役天) that were ducked with the first group of accounts reported. All of these users (both group 1 and group 2) were blocked by admin due to vandalism; note that the second group of accounts is created after the users listed in the first group are locally blocked. A sleeper check is therefore requested to see if there are more accounts hidden. ${\displaystyle \int }$（☎） 03:45, 21 October 2022 (UTC)

•  Confirmed 黃光明, 韓音江, 何德信, 黃尺文, 讨共救国, 杖责任人摆布, 刘勇向, 虞文建, 盧文化, 林國建, 何毴
• Inconclusive 役天 (lack of data to compare)

---

• They used VPN.

From a technical point of view. --Sotiale (talk) 04:03, 21 October 2022 (UTC)

Status:    Done

List of users

Uni Emperor (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

Yulbi (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

打炮豬 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

Taiming2003 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

• CU log
• Discussion: zh:Wikipedia:傀儡調查/案件/Stalin_kzj

Reason(s): Please refer to previous checks Steward_requests/Checkuser/2022-05#Stalin_kzj@zh.wikipedia_2 and Steward_requests/Checkuser/2022-05#Stalin_kzj@zh.wikipedia_3 for comparison in this case as well since there are some account names appeared in the check result would be re-appearing in this request.

A request has been submitted regarding an LTA Stalin kzj using the above four sockpuppets (note that the first one is ducked by admin and only appears for comparison since the account is not stale). These accounts listed matches the editing behaviors that were outlined in zh:Wikipedia:持续出没的破坏者/User:Stalin_kzj: solely editing articles about zh:國立臺灣科技大學 and zh:國立中正大學, which local editors have found these behaviors relate to RWR02. There were common abuse filters triggered for these four accounts as well, indicating a strong correlation for potential sock abuse. A check is therefore requested; please also check for sleepers since these accounts are related to a local LTA; I personally figured a global lock would be plausible since these accounts are also active in other wikis (such as ja.wikipedia), if confirmed. Thanks in advance. ${\displaystyle \int }$（☎） 04:16, 25 October 2022 (UTC)

• Unrelated or Unlikely

From a technical point of view. They are more likely to be multiple users with the same purpose. It can't be seen that they are the same user from the data. --Sotiale (talk) 05:28, 25 October 2022 (UTC)

@Sotiale: Just acting as a follow-up: were any of the four users listed related to the previous check? By previous check I mean Steward_requests/Checkuser/2022-05#Stalin_kzj@zh.wikipedia_2 or Steward_requests/Checkuser/2022-05#Stalin_kzj@zh.wikipedia_3. Thanks for the clarification in advance. --${\displaystyle \int }$（☎） 06:45, 25 October 2022 (UTC)

As I recall, two of the above accounts were IPs assigned to public facilities. The ranges were not the same. --Sotiale (talk) 07:00, 25 October 2022 (UTC)

Status:    Done

List of users

Kuyfkuyf (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

Thdrth (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

• CU log
• Discussion: zh:Wikipedia:傀儡調查/案件/Kuyfkuyf

Reason(s): Both users vandalize on an ex-admin's (zh:User:Outlookxp) talk page; further information has been revealed that these users could use unregistered accounts (IPs, in short) to vandalize that same ex-admin's talk page. A sleeper check is therefore requested in accordance with the local policy zh:WP:CUP#1 (and possibly revealing more registered socks). Thanks in advance. ${\displaystyle \int }$（☎） 21:06, 26 October 2022 (UTC)

I looked at the talkpage but mostly these are proxies. Assuming vandalism users are the same user, then they probably created accounts by going to multiple proxies. This means it won't be meaningful, at least for the purpose of a sleeper investigation. If it is unclear whether they(listed accounts) are the same user and requires investigation, please explain this part again. --Sotiale (talk) 01:05, 27 October 2022 (UTC)

The original user who submitted this check claimed that these two users registered only 48 hours apart, and both of their first edit are vandalizing User:Outlookxp's talk page. These two users also revert Outlookxp's anti-vandalism edits (on their second edit), which I find it reasonable to submit this check since both users solely target Outlookxp's edits, but, given the limited edits made by two users, it's hard to duck based on editing pattern; I'm not quite sure about how the time frame played a role in this investigation, however. I hope this explanation clarifies a bit on the purpose of this check. --${\displaystyle \int }$（☎） 05:11, 27 October 2022 (UTC)

Another note: local admins have not blocked the first account yet; only the second account listed was blocked. --${\displaystyle \int }$（☎） 05:14, 27 October 2022 (UTC)

• Unrelated Kuyfkuyf and Thdrth

As expected, nothing was found. --Sotiale (talk) 11:59, 28 October 2022 (UTC)

•  Confirmed Kumarooooo and MandavasaiKumar

From a technical point of view. @Chaduvari: here you are. --Sotiale (talk) 11:56, 28 October 2022 (UTC)

@Sotiale, Thank you. __ Chaduvari (talk) 01:36, 29 October 2022 (UTC)