Steward requests/Checkuser/2021-11

Requests

Adenqa@zh.wikipedia

How about explaining a little more specifically? For example, they say they haven't been active for a long time. --Sotiale (talk) 11:05, 4 November 2021 (UTC)
  •   Confirmed Adb889, A16898, Adenqa

From a technical point of view. --Sotiale (talk) 11:08, 4 November 2021 (UTC)

星晨傳@zh.wikipedia

  Doing... --Sotiale (talk) 10:46, 4 November 2021 (UTC)
  •   Confirmed 星晚芝, 星晨傳, 星早之, 星早芝, 吹早風, 吹風風

From a technical point of view. --Sotiale (talk) 11:02, 4 November 2021 (UTC)

Mozgović@hr.wikipedia

  • {{likely}}  Confirmed Mozgović and Lordluka99

@Neptune, the Mystic: From a technical point of view. If the behavior patterns are similar, yes, combined with the technical information, they are very likely the same user. No, they're same user, as far as I understand. Fixed. And I guess I know they don't like you.. ;) --Sotiale (talk) 07:40, 7 November 2021 (UTC)

RWEI.C@zh.wikipedia

  • Recently-registered RWEI.C only made a vote in AfD discussions. We would like to know if there is sockpuppetry behavior involved. Itcfangye (talk) 07:34, 7 November 2021 (UTC)
  •   Unrelated RWEI.C and normalwriter

From a technical point of view. --Sotiale (talk) 08:07, 7 November 2021 (UTC)

試看看@zh.wikipedia

  •   Confirmed Group 1: 試看看, 清清清

  •   Likely Group 1 and 不要亂風 accounts group

From a technical point of view. --Sotiale (talk) 09:50, 7 November 2021 (UTC)

吴迪先@zh.wikipedia

  •   Confirmed Group 1: LiuTaoRan, 邓大小平, 吴迪先, 静听丶灬伊人, Nicolas Coge, 城北栀花关, ユナちゃん, 糖糖の乐儿, Tantalum Monoxide, ᝰᝰᝰ

  •   Confirmed Group 1 and Huami666 accounts group(2021-10)
  • They used Op/VPNs.

From a technical point of view. --Sotiale (talk) 10:02, 7 November 2021 (UTC)

Pi967970@zh.wikipedia

From a technical point of view. --Sotiale (talk) 10:17, 7 November 2021 (UTC)

Pi967970@zh.wikipedia

  Not done. No reason is given as to why they are suspected of being the same user. I can't find anything in the description above for investigation. Explain in detail and request again if this investigation is necessary. --Sotiale (talk) 07:13, 7 November 2021 (UTC)
Same edit pattern on the addition of categories in articles of football athletes, universities, etc. Pi967970 was registered right after Un34803481 was blocked. Sleeper check is also request due to the nature of this LTA. Itcfangye (talk) 07:34, 7 November 2021 (UTC)

吴迪先@zh.wikipedia

  Not done. No reason or evidence is given as to why they are suspected of being the same user. I can't find anything in the description above for investigation; In addition to claiming to be LTA, please explain why you suspect their conduct. Explain in detail and request again if this investigation is necessary. --Sotiale (talk) 07:17, 7 November 2021 (UTC)
  • 吴迪先 is confirmed to be zh:LTA:TTG locally by their edit pattern in w:zh:邓小平 (and several related articles). A sleeper check is requested. Itcfangye (talk) 07:34, 7 November 2021 (UTC)

試看看@zh.wikipedia

  Not done. No reason is given as to why they are suspected of being the same user. I can't find anything in the description above for investigation. Explain in detail and request again if this investigation is necessary. --Sotiale (talk) 07:12, 7 November 2021 (UTC)
  Note: I'm already asking for nearly a year so that I don't look for diffs on their behavior patterns or evidence myself, but it is constantly being ignored. I once again request that the user forwarding the request fully explain the rationale or evidence for the investigation. --Sotiale (talk) 07:27, 7 November 2021 (UTC)

@Sotiale:: Same edit pattern in w:zh:溫昇豪 (see w:zh:Special:Diff/67688280/67785681 & w:zh:Special:Diff/68235554/68352774). Local admins seem to be busy recently and a sleeper check would be needed for this LTA. Itcfangye (talk) 07:34, 7 November 2021 (UTC)

TIGER96881@el.wikipedia

  •   Confirmed TIGER96881 and Patata504

From a technical point of view. This is a technical analysis only and does not include an analysis of behavior pattern. They shared the same IP, and each edit was so close that it took less than 10 min. It's a meat case with the same purpose or real socking. --Sotiale (talk) 10:57, 9 November 2021 (UTC)

Dowrythubnuy@en.wikivoyage

  •   Confirmed Mlekftrgh and Dowrythubnuy

  •   Confirmed on sowiki: Midiigarah33, Marjutybhhb, Newmoniccc3, Hodaneeey76, Dowrythubnuy, Randomastwritter, Mdnwusrwithhhd, Abwaanrmrke, Hgutjutre, Iskuulkaban

From a technical point of view. Whether or not to block them on localwiki is up to localwiki to decide. We generally don't get involved unless it's related to xwiki abuse. However, this is a possible xwiki abuse.. But I have no plan to investigate separately. --Sotiale (talk) 11:45, 10 November 2021 (UTC)

Thanks Sotiale :). Was just unsure about how blocks work, since I've seen some CUs use a {{checkuserblock}} reason as the block reason, but I'm not familiar with how CU investigations work. SHB2000 (talk | contribs) 11:55, 10 November 2021 (UTC)
@Sotiale Just interested should there be any blocks on sowp? There isn't a local community per say, last sysop edit is almost a year ago, and they are doing overlaps edit on this. This is same pattern as per envoy. Camouflaged Mirage (talk) 12:20, 10 November 2021 (UTC)

Ian 1975@el.wikipedia

  •   Unrelated Ian 1975 and Πτυχιούχος

From a technical point of view. --Sotiale (talk) 09:00, 11 November 2021 (UTC)

Gareth Nato, LOFTER 1108@zh.wikipedia

  Doing... --Sotiale (talk) 09:39, 14 November 2021 (UTC)
  •   Confirmed Group 1: 72狗48猪24狼, Lance2021, Gareth Nato, Valentine 117, Ndolav33, LOFTER 1108

  •   Confirmed James Dirant accounts group (2021-10)
  • They used VPN.

From a technical point of view. --Sotiale (talk) 09:55, 14 November 2021 (UTC)

The Beijing Love@zh.wikipedia

  Doing... --Sotiale (talk) 09:58, 14 November 2021 (UTC)
  •   Confirmed Group 1: The Beijing Love, 名無しピープー, えんぴつ と消しゴム

  •   Confirmed 卵 卵 美跳羽(==黄身 白身 赤身) accounts group

From a technical point of view. --Sotiale (talk) 10:09, 14 November 2021 (UTC)

黃麒倫@zh.wikipedia

  • It should be noted that they were writing different Taiwanese athletes, so we are uncertain if this is a coincidence. Their main similarity is that they link their userpages to the article they wrote. Itcfangye (talk) 15:26, 14 November 2021 (UTC)
  Doing... --Sotiale (talk) 10:44, 15 November 2021 (UTC)

  Unlikely 黃麒倫 and Yaofbi

From a technical point of view. --Sotiale (talk) 10:48, 15 November 2021 (UTC)

鹹濕仔001號@zh-yue.wikipedia

  Doing... --Sotiale (talk) 10:50, 15 November 2021 (UTC)
  • All but the third account have expired data, so investigation is not possible.
  • The third account appears to be a different user from the one who often creates inappropriate accounts on zh_yuewiki.

--Sotiale (talk) 10:55, 15 November 2021 (UTC)

@Sotiale:Thank you. There are three newly blocked LTA users (user name: 最愛餃肌基, 淫賤魔人 and 吟賤猩猩). Will it be possible to preform the investigation just to confirm that the third account is a different user? Thank you for your time. ——Z423x5c6 (talk) 11:23, 15 November 2021 (UTC)
@Z423x5c6: The accounts you presented are the LTA you are referring to, and this is a different user than the 3rd account above. Block 呻賤, it is an account that has not yet been blocked. --Sotiale (talk) 13:24, 15 November 2021 (UTC)
@Sotiale: I see. Thank you~ ——Z423x5c6 (talk) 14:03, 15 November 2021 (UTC)

Tailuoatm@zh.wikipedia

  In progress... --Martin Urbanec (talk) 23:12, 17 November 2021 (UTC)
  Unlikely @Itcfangye: Based on technical evidence, I think it is unlikely those two accounts are operated by a single individual. Behavioral evidence not included in my investigation. --Martin Urbanec (talk) 00:18, 18 November 2021 (UTC)
Thanks a lot!--LightyearsTalk 04:55, 18 November 2021 (UTC)

Mensusa accounts @ oldwikisouce

Hi Liuxinyu970226. There are 108 Mensusa Accounts since August 22 2021 listed in abuse filter log on oldwikisource (see link above as well). Do you mean I should transfer them per copy & paste to this page? -jkb- 11:15, 14 November 2021 (UTC)
I think listing 2 or 3 of them is enough, but it depends on stewards. Itcfangye (talk) 15:22, 14 November 2021 (UTC)
But that is what I exactly didn't want to do: I don't search for sleepers or something like that, as far as I could see no one of these accounts has some edits. I guess the accounts have been registered by one user or user group and I would like to know if they come from one IP or IP range or a certain organization. In this case we would have no 108 accounts but 108 socks. However I named above some 6 more accounts but I think more than six should be examined. -jkb- 17:18, 14 November 2021 (UTC)
Hello @-jkb-, it's unlikely 108 accounts are created from a single IP (because of the 6 account limit, it's not possible to create more than 6 accounts from a single IP in 24 hours). I'm not sure CU is proportional here: new accounts are almost free, and as long as no actual abuse (in form of edits, etc.) happens, this looks pretty harmless to me?
For a possible explanation of what's happening, there's a shop of that name -- maybe naive spam(bot) attempts? Wouldn't line up with exactly zero edit attempts (at least as far as spamblacklist/abusefilter is concerned), but maybe their intention is to spam lists like Special:ListUsers?
If you want to prevent usernames of this pattern, I can likely add it to title blacklist for you – but note that if that happens, they might easily change their username pattern, at which point not only will the account creation continue, but you will no longer be able to detect them  . Martin Urbanec (talk) 00:20, 15 November 2021 (UTC)

Nope. I wasn't talking about a single IP, but also an IP range or a company, organization, etc. And someone who creates accounts in this way will always find an alternative IP. I think this account system is very strange and unusual. But obviously I'm not alone. By a chance I found two of these accounts that are globally closed: LesiaMensusa and FrekbyfMensusa. @Bsadowski1: can you help with some more details? Thanks. -jkb- 10:57, 15 November 2021 (UTC)

@-jkb- Regardless how I think about this, I can't find a single reason to do a CU investigation here. In your request, you say "So far there has been no abuse or harm" – and as you're certainly aware, checkuser may be only used to limit disruption of the project. If there's no disruption...there's no reason to CU either. I'm sorry, but I don't see compelling reasons to retrieve the CU information at this point. Thank you for your understanding.   Not done. Martin Urbanec (talk) 23:10, 17 November 2021 (UTC)

By the way, @ Martin Urbanec, MensUSA would be conceivable. -jkb- 11:34, 15 November 2021 (UTC)

@Bsadowski1:, could you have a look at this please? I think it might be useful to know why the two (above mentioned) Mensusa accounts have been globally blocked by you. In fact, I suspect that it is not necessarily a person but a small group of people who might belong to a company (such as MensUSA Company). The matteris strange, and that reinforces my suspicion: new accounts were registered almost every day, sometimes several, but after I switched the filter from "log only" to "disallow" on November 15th, no new accounts were registered. One or very few persons. -jkb-

@Bsadowski1:, ping with signature once more -jkb- 18:13, 17 November 2021 (UTC)

Babygogolove@zh.wikipedia

  Comment@Doubletwolove: commented locally that they don't know Babygogolove. --Liuxinyu970226 (talk) 03:42, 19 November 2021 (UTC)
  Unlikely The three users are geographically very wide apart from each other, and given the lack of proxies (no one has IPBE), I think it is unlikely they're controlled by one person. --Martin Urbanec (talk) 09:48, 19 November 2021 (UTC)
Could they be MEAT or not?--Cmsth11126a02 (talk) 10:32, 19 November 2021 (UTC)

Tajkula@hr.wikipedia

  In progress... --Martin Urbanec (talk) 09:19, 19 November 2021 (UTC)

  Inconclusive using solely hrwiki technical data. I found no evidence of socking, but there are very few entries about the other users in the database. Meta CU will likely be needed – I'll ask Meta CUs to help here.   On hold until they have some time to check. --Martin Urbanec (talk) 09:32, 19 November 2021 (UTC)

  Unlikely I talked about this with one of the meta.wikimedia.org checkusers. The final conclusion is that the users are not related. --Martin Urbanec (talk) 18:36, 19 November 2021 (UTC)

Προαναφερθέντας@el.wikipedia

Hello Ah3kal. Do you have any list of recent accounts to compare with? Thanks, —MarcoAurelio (talk) 16:55, 20 November 2021 (UTC)
Hi, please compare with user "Πτυχιούχος". Geraki TL 17:05, 20 November 2021 (UTC)
The following accounts appear to be related each other at a technical level:
  • Προαναφερθέντας
  • Ζωστορέτης
  • Zenevenpa
  • Anri de A
  • Sintro F
  • Τζισβεδές
  • Μετααναθεωρητικός
  • Πτυχιούχος
  • Μαύρος Βράχος
  • Ποδοσφαιρόφιλος
Some accounts are blocked, but I didn't checked for how long. Before blocking or taking any action please verify whether behavioural or other evidence confirm the above findings.
Thank you, —MarcoAurelio (talk) 18:08, 20 November 2021 (UTC)
Thank you MarcoAurelio and sorry for the initial mess up in the application. —Ah3kal (talk) 20:52, 20 November 2021 (UTC)

Windows Tips 2021 Micrososft@elwiki

  Doing... --Sotiale (talk) 11:27, 21 November 2021 (UTC)
  •   Confirmed Windows Tips 2021 Micrososft, Microsoft Windows Facts, WindowsFacts, Facts Windows, Windows11 2021, Windows11 Microsoft, MICROSOFT WINDOWS - 2021, Windows micrososft
  •   Stale Windows tips 2021, Windows Tips

From a techncal point of view. --Sotiale (talk) 11:32, 21 November 2021 (UTC)

Brewnora@zh.wikipedia

  Doing... --Sotiale (talk) 13:47, 24 November 2021 (UTC)

From a technical point of view. --Sotiale (talk) 13:50, 24 November 2021 (UTC)

ArticCynda@en.wikivoyage

  •   Confirmed Luke904, Luke906, ArticCynda

From a technical point of view. --Sotiale (talk) 01:50, 28 November 2021 (UTC)

Thank you :) SHB2000 (talk | contribs) 05:57, 28 November 2021 (UTC)

Hung1101@zh.wikipedia

  Comment There are other accounts suspected by local admins that are used by Hung1101: User:人八有, User:何燈燈, User:大魚天, User:258613r8, User:Dflort, and User:陳又魚. -- ) 08:48, 28 November 2021 (UTC)
  •   Confirmed Group 1: Jane202102, Mys721bx, 258613r8, Dflort, 陳又魚, 人八有, 黃耳陳, 黃大太, Csx2021, Faro20, Charlotte202104, Ast2021, Csx17, Att26, Delta837765, Mys721dx, 大魚天, 何燈燈
  •   Confirmed Group 2: Hung1101, 港璨

  •   Unrelated Group 1 and 2

From a technical point of view. --Sotiale (talk) 10:22, 28 November 2021 (UTC)