Steward requests/Checkuser/2023-03

  Doing... --Sotiale (talk) 10:15, 2 March 2023 (UTC)

•   Confirmed Xzxtzlm, Libiminijie, 我喔我11

From a technical point of view. --Sotiale (talk) 10:17, 2 March 2023 (UTC)

•   Confirmed 兹多米克, 涂苏坡, Zelin Cham

---

•   Confirmed 维基中二群体代表

All locked. --Sotiale (talk) 10:19, 2 March 2023 (UTC)

•   Confirmed Eftcfsxa, Rana Abdullah vvv, Aydin Aman, Svcvsddvdcv, Aziz nurovich osmanyev, Salah Hulusi, Zakir aslanovich azizyev, Afvrd, Sczcgsvd, Aisin Batini, کیا ہے پہلے سے زیراستعمال

---

• This user is using proxies or VPN.

From a technical point of view. --Sotiale (talk) 10:24, 2 March 2023 (UTC)

Just that a revert war took place doesn't give us any clues for investigation. Please provide a full explanation of why they are suspected of being the same user. Thanks. --Sotiale (talk) 09:29, 27 February 2023 (UTC)

  Not done. If necessary, please explain the reason again and reqeust for it. Thanks. --Sotiale (talk) 10:34, 2 March 2023 (UTC)

•   Confirmed 绮星海, Stevenjiang89, 紗綱

---

•   Confirmed 絆愛0630(Group 1)

From a technical point of view. --Sotiale (talk) 10:33, 2 March 2023 (UTC)

•   Confirmed HBPEMD, Πελοπίδας, ΔώραΣτρουμπούκη

I don't know who you are, but it would have been better if you posted the request on your account. I generally don't accept requests from IP users. @FocalPoint, C messier, and Geraki: Hello, elwiki administrators. I think you might be interested in this puppet show. --Sotiale (talk) 10:56, 2 March 2023 (UTC)

Incidentally, please note that there is no mention of IPs as per policy, and no actual investigation has been conducted. --Sotiale (talk) 10:57, 2 March 2023 (UTC)

Is there anything you can provide to suggest that there would be more accounts involved? -- Amanda (she/her) 00:51, 25 February 2023 (UTC)

  Declined Zero follow up. -- Amanda (she/her) 02:44, 3 March 2023 (UTC)

Status:    Done

List of users

Vitsuha (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

一步一步一步 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

Gatheoryme (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

Ggplot2222 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

GFWrenmin (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

• CU log
• Discussion: zh:Wikipedia:傀儡調查/案件/Vitsuha, zh:Wikipedia:傀儡調查/案件/離心力青蛙

Reason(s): Combining two cases into one. The first, third and fourth account listed belong to the case "Vitsuha" while the fourth and fifth account belongs to the case "離心力青蛙." The second account is from previous SPI case for 離心力青蛙, which was ducked, and is presented for comparison.

Before I start the reasoning, I must say that it's quite fascinating that two users can come to different conclusions about if Ggplot2222 is a sock of Vitsuha or 離心力青蛙. For the side that Ggplot2222 is a sock of Vitsuha, the claim was "posting Vitsuha's created articles for speedy deletion," which accounts for most of Ggplot2222's contributions; on the other hand, another user argued that those requests for speedy delete matches with the behavior of 離心力青蛙 listed on the community's LTA page; the creation of such LTA page is aimed to ease editors for spotting potential 離心力青蛙 socks. The fifth account, in my opinion, resembles a strong correlation with 離心力青蛙's editing behavior, but I would side with Ggplot2222 is Vitsuha's sock at this moment. Please also check for sleepers as local admins have expressed their concerns about other accounts (like Gatheoryme, which I later added to the SPI case "Vitsuha") not spotted via communication platforms (Telegram). Thanks in advance. ${\displaystyle \int }$ （☎） 22:53, 4 March 2023 (UTC)

•   Confirmed Group 1: 一個人的聖經, Ggplot2222, Vitsuha, Gatheoryme, Davidamillerisaman
•   Likely Group 2: 一步一步一步 and 離心力青蛙
•   Unlikely GFWrenmin

---

•   Unrelated Group 1 and 2
• Group 1 used the IPs of public facilities in some cases, but it does not seem to be significantly related to the results.
• GFWrenmin used proxies and VPN.

From a technical point of view. --Sotiale (talk) 02:17, 5 March 2023 (UTC) }}

I took this on given that this has an impersonation angle.

•   Confirmed Bagida250, Mahathir rasuah, Mr Ling Liong, 马哈迪不会治国
•   Unlikely leaning   Unrelated Bagida520

Should Bagida250's edit be seen as an impersonation attempt, any steward would be willing to lock, we need the skill of local translators to see if this was an impersonation attempt. -- Amanda (she/her) 09:07, 6 March 2023 (UTC)

@AmandaNP: I would say that this case is probably sufficient for an impersonation lock as it was done by an LTA against users of similar editing patterns. --LuciferianThomas 10:51, 6 March 2023 (UTC)

  Done -- Amanda (she/her) 14:59, 6 March 2023 (UTC)

Please remember that it's the obligation of the user requesting the check to present relevant evidence as to why the accounts are related (usually using diffs). Especially since we have no Greek stewards who could translate for us, and therefore we rely on google translate. Simply starting to edit after another account is blocked is not sufficient grounds on it's own. -- Amanda (she/her) 09:19, 6 March 2023 (UTC)

@AmandaNP: thanks a lot for applying the policy. He just wanted to use you for his own personal reasons. It is clearly an attempt to violate privacy policy. ΔώραΣτρουμπούκη (talk) 18:04, 6 March 2023 (UTC)

Dear Amanda, diffs as per your request:

• User:Dim_loki w:el:Ειδικό:Συνεισφορές/Dim_loki, all contributions in the List of Prime Ministers of Greece, an article of special interest to ΔώραΣτρουμπούκη, 92 contributions in the last 500
• User:Vnousiou [5], contributions in an article of interest to ΔώραΣτρουμπούκη [6], as she has contributed to articles of several ministries of Greece.
• User:Alex.pantelios Diff in Municipality of Argostoli, in connection of ΔώραΣτρουμπούκη's general interest in Greek politics and municipalities, examples: municipality of Petritsi, Municipality of Kapetan Mitrousi
• User:Blake61 edit in an article about a Greek politician, in which she has had 10 contributions [7]
• User:Johnnom11111 removal of incriminating content for person in the typical and usual style of ΔώραΣτρουμπούκη - compare similar removals of incriminating content here and here
• User:Ggg1112222 Diff in municipality of Smynous, in connection of ΔώραΣτρουμπούκη's general interest in Greek politics and municipalities, examples shown above in section for Alex.pantelios
• User:Semantic1 rephrasing incriminating content for person, as per examples of similar removals of incriminating content by ΔώραΣτρουμπούκη shown above at the case of User:Johnnom11111

--FocalPoint (talk) 19:23, 6 March 2023 (UTC)

• I ran a cursory check on Ggg1112222 & Johnnom11111 -   Unrelated.   Declined on the rest due to lack of evidence other than editing the same topic area. -- Amanda (she/her) 23:34, 6 March 2023 (UTC)

Is it possible to duck through local admins? I don't really see the need to request for a check unless there are suspected sleepers. --${\displaystyle \int }$ （☎） 22:53, 4 March 2023 (UTC)

If action is needed because they are still creating accounts, or if you have reason to suspect that the pattern is hiding another account, I'd appreciate it. A bit more detailed explanation is needed for investigation. Thanks. --Sotiale (talk) 02:19, 5 March 2023 (UTC)

There is no need for check user info and this request is already denied on local Administrator's notice board. I believe this kind of over enthusiasm should be not entertained. --SM7^--talk-- 14:15, 5 March 2023 (UTC)

what do you mean by that? Means account should be created. Manish Panwar ^{(talk) |Contribs)} 14:51, 5 March 2023 (UTC)

Note: These account has been locked already. This request could be closed imo. Thanks. SCP-2000 12:59, 6 March 2023 (UTC)

  Done All users except the second one (which does not exist) are   Confirmed to one another. All sleepers found had already been locked.--BRP ^ever 02:23, 7 March 2023 (UTC)

• Revealing the relationship between IP and account is prohibited.   Confirmed Hokej fanúšik = Hockey444. --❄Mykola❄ 02:32, 10 March 2023 (UTC)

•   Confirmed Saeculums, Paho.mqtt, DeepLearningAI, ASPdotNET Core

From a technical point of view. --Sotiale (talk) 11:13, 10 March 2023 (UTC)

• Discussing with other clerks. --SCP-2000 10:52, 10 March 2023 (UTC)
• Withdrawn per zh:Special:Diff/76293916. Thanks. --SCP-2000 11:25, 10 March 2023 (UTC)

•   Confirmed 寶島之星莒光號觀光列車, 郵輪之星觀光列車, 台鐵莒光號列車, 觀光之星, 團體莒光號, 郵輪莒光號, 柴聯自強號, Kenny10800

From a technical point of view. --Sotiale (talk) 11:20, 10 March 2023 (UTC)

Global: 寶島之星莒光號觀光列車, 郵輪之星觀光列車, 台鐵莒光號列車, 觀光之星, 環島之星莒光號, 團體莒光號, 郵輪莒光號, 柴聯自強號, Kenny10800, 環島之星觀光列車. --Sotiale (talk) 11:23, 10 March 2023 (UTC)

Are there underlying IP ranges that can be blocked for this case and the one below? LuciferianThomas 12:23, 10 March 2023 (UTC)

Status:    Done

List of users

Vitsuha (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

Jacrjacr (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

• CU log
• Discussion: zh:Wikipedia:傀儡調查/案件/Vitsuha#2023年3月7日

Reason(s): Acting as a follow up for a previous check Steward_requests/Checkuser/2023-03#Vitsuha@zh.wikipedia. Local admins would also like to have the sleepers re-checked again since, quite self-explanatory given the users listed, there are possibilities that new socks were registered after the previous check was completed. Thanks in advance. ${\displaystyle \int }$ （☎） 04:37, 11 March 2023 (UTC)

There was no such thing. And coincidentally, for several reasons, no further action is required. I can't be specific, but an accidental action by your admin will prevent abuse by this user. --Sotiale (talk) 12:07, 11 March 2023 (UTC)

The user did evade the ban in December only, but has also been logged-out editing since at least August 2022. -- Amanda (she/her) 02:21, 14 March 2023 (UTC)

  Declined for the same reason I declined the last one on ΔώραΣτρουμπούκη. Evidence is required for a check. Simply blocking someone as a sock does not automatically justify a check. -- Amanda (she/her) 21:24, 13 March 2023 (UTC)

@AmandaNP: The administrator cited the fact that the user conducted edits on approximately the same timeframes with the user in question, use of
and punctuation. A  , which shows the name account from Stroubouki's profile, was used as an evidence of relationship between the two accounts during the original complaint of Erefnitis Alitheias (here ) for the account.NikosLikomitros (talk) 22:17, 13 March 2023 (UTC)

For now I have removed the evidence you have linked as it potentially falls under the Oversight policy. I will do the same on elwiki. Please do not repost until I get a response from meta oversighters and my fellow stewards. I'll review your checkuser case in due course - this is not an endorsement at this time. -- Amanda (she/her) 01:42, 14 March 2023 (UTC)

the same content here: https://el.wikipedia.org/wiki/Βικιπαίδεια:Υποψήφιοι_διαχειριστές/NikosLikomitros#Ερωτήσεις Number 4 ΔώραΣτρουμπούκη (talk) 02:33, 14 March 2023 (UTC)

and here from administrator Kalogeropoulos https://el.wikipedia.org/wiki/Βικιπαίδεια:Σημειωματάριο_διαχειριστών#Κατάχρηση_πολλαπλών_λογαριασμών_και_παραβίαση_φραγής

copied my facebook page!! ΔώραΣτρουμπούκη (talk) 02:38, 14 March 2023 (UTC)

Hello Amanda.

Keep also in mind that user:ΔώραΣτρουμπούκη was confirmed as utilizing sockpuppets here, with HBPEMD and Πελοπίδας being her puppets.

There is a reason she started writing both on your talk page as well as Sotiale's one claiming Violation of Privacy. She doesnt care about privacy but she really wants to avoid this checkuser because then the elwiki Administrators would have enough evidence to utilize a permablock on the wiki.Apart however from the evidence which NikosLikomitros provided, in the meantime she has been evading her 3-month long block by utilizing ip adresses such as 193.92.154.130 (same writing style, same hours which she usually contributes, same offensive tone). Finally, in the evidence provided by Nikos, she claimed that Erevnitis Alitheias and NikosLikomitros, are the elwiki admins lapdogs (translation of the greek word " τσιράκι"). If you could be so kind, please also consider the above when running the checkuser, and check for sleepers as well. Thank you Ιπποκράτης2020 (talk) 05:07, 14 March 2023 (UTC)

@AmandaNP, this is not a request of just one user, it is a request after discussion in Admin's NoticeBoard. There is actually serious evidence, as the user ΔώραΣτρουμπούκη has posted in her Facebook account a screenshot of another user's screen (GiannisZois), that no other user could have access to. You are hereby to proceed to checkuser. FocalPoint (talk) 05:20, 14 March 2023 (UTC)

Based on the additional evidence and explanations presented above, I conduct this investigation and present my findings as follows.

•   Confirmed GiannisZois, ΔώραΣτρουμπούκη, Λακωνικώς, HBPEMD, Πελοπίδας

From a technical point of view. I don't want any more drama. Actions against this user are all up to localwiki, so we are only conducting investigations according to the will of the community members. Therefore, please proceed with all discussions on elwiki. --Sotiale (talk) 05:33, 14 March 2023 (UTC)

Thank you Sotiale. Ιπποκράτης2020 (talk) 05:39, 14 March 2023 (UTC)

Everything but the first two users is   Stale, and you'll have better luck following the enwiki SPI to determine sock connections as 1) they edit there more 2) more people are familiar with this user on enwiki. -- Amanda (she/her) 00:23, 15 March 2023 (UTC)

•   Confirmed Xianghua-Xia, Infinitevows
•   Likely Buddhism given location, UA and edit similarities
•   Possilikely (a mix between possible and likely) Thomaswz19
•   Possible at best for Lcj940404, and they do have one other account - but it's clearly from not understanding how Wikipedia works and has no edits

-- Amanda (she/her) 00:15, 15 March 2023 (UTC)

@AmandaNP: can you also provide the other account for Lcj940404 for the community's reference? Thanks, LuciferianThomas 01:19, 15 March 2023 (UTC)

Looking at Lcj again, it does very much look like they are a sock. Missed that when I first went through. The other sock is Pidang. -- Amanda (she/her) 02:09, 15 March 2023 (UTC)

I wouldn't be allowed to identify if this was school edits because they are editing a school and I would be confirming location and school by doing so. That said, this appears more to be several people rather than an individual person. Each account has different UAs contradicting one another. That said, the following accounts are likely acting in coordination of some sort.

  Likely Alexchan9988, Laimanlemon, Bartchow23, Surerpanda & Harry the cool boy -- Amanda (she/her) 18:53, 19 March 2023 (UTC)

ar:İstifadəçi:Iskanderova15 and ar:İstifadəçi:Nurlan0807 make it pretty obvious that you are working with the same person. CU is not needed to identify this.   Declined -- Amanda (she/her) 18:33, 19 March 2023 (UTC)

how can i be sure about there are no more account from same person? Bikar Orxan (talk) 18:41, 19 March 2023 (UTC)

You didn't present any evidence that would indicate there are more accounts nor request a check for any more accounts. Should you provide evidence that there may be more accounts, we can look into that then. -- Amanda (she/her) 18:54, 19 March 2023 (UTC)

i don't know how to make request for "checking more accounts". Should they participate in discussions for being checked? Bikar Orxan (talk) 19:07, 19 March 2023 (UTC)

You would just say it like you have now. And basically you need something to indicate that there would be more than one. Something like both accounts using wiki-markup in their early edits, or multiple new users on one article being disruptive, but those are just examples - you can present anything that would show it. -- Amanda (she/her) 19:27, 19 March 2023 (UTC)

I don't have anything to show. If being "pretty obvious" not enough to check you can archive that request. Thanks Bikar Orxan (talk) 20:19, 19 March 2023 (UTC)

•   Confirmed Vanishboy and Foxy1219

---

• They have done non-login edits before.
• It is not possible to reveal what the pages were.

From a technical point of view. --Sotiale (talk) 07:47, 22 March 2023 (UTC)

Supplementary information from Xiplus: The block ID provided [in the unblock request email] directly indicates to HRMYJJ's block instead of an autoblock #. The unblock request email does not include a screenshot as evidence. LuciferianThomas 05:52, 23 March 2023 (UTC)

Checked on the basis that it's a cookie block.   Confirmed -- Amanda (she/her) 03:49, 24 March 2023 (UTC)

  Confirmed Mahour gaurav singh ji, Roshan kumar555, Gaurav mahaur, Deepti sharma pant ji.   No comment with respect to IP address(es). -- Amanda (she/her) 04:17, 24 March 2023 (UTC)

•   Unlikely Fredo764968 and Qby11425

From a technical point of view. --Sotiale (talk) 13:40, 27 March 2023 (UTC)

•   Unlikely Chunwai yau and 东吴德王严白虎
• Very   Possible 东吴德王严白虎 and Wiki3927

---

• They're using VPNs.
• It is recommended to conduct a contribution analysis for 东吴德王严白虎 first and then take action.

From a technical point of view. --Sotiale (talk) 01:08, 30 March 2023 (UTC)