User:-revi/蟲蟲飛

23:53: 蟲蟲飛 logged in
23:59: IP posted something
00:00: 蟲蟲飛 logged in
00:07: IP posted request for undelete
00:15: 蟲蟲飛 logged in

Some other day, in a single IP
蟲蟲飛 (hereinafter CCF) edits a page.
moments after ^, she performs a logged action.
4 minutes after ^, an IP appears and do vandalism, and Abuse Filter automatically triggers and blocks the IP.
3 minutes after ^, she logs in as CCF.
from there, this IP is exclusively used by CCF all day long.
* There is no other activity from this IP, within the 90 days availability.

Some other day, in a single IP

CCF performs some action, earlier in the day.
Few hours (less than 6~12) after ^, with the same IP and UA (her device is unique enough), posts allegations about other admins.
* There are other activities on this IP, but their device informations and activity suggest they are unrelated.

Now, calculate how it is feasible for this kind of incidents occur multiple times, using the same IP, same UA, and within 90 days period. Occam's razor tells you the most logical answer to this is 'SHE IS SOCKING'.