Steward requests/Checkuser/2021-06

Please do not post any new comments on this page. This is a discussion archive first created in June 2021, although the comments contained were likely posted before and after this date. See current discussion.

• here is not the right place to do that--PAPAYAISNOTAFOOD#talk 06:36, 1 June 2021 (UTC)

Not done. Not the right place to request CU status. —MarcoAurelio (talk) 09:40, 1 June 2021 (UTC)

•  Confirmed Maqamedd, Zaur Ağayev, Gülər Hüseynova, Əsəd Mənsurlu
• Unrelated Ilkin 10, Lemanhasan

From a technical point of view. --Sotiale (talk) 13:53, 2 June 2021 (UTC)

•  Confirmed Fiblarit, Mukdro, 2a7835289a642, Redisals, Lois12jd, Daapoeland

From a technical point of view. --Sotiale (talk) 13:33, 2 June 2021 (UTC)

@Sotiale: Thank you. --Lefcentreright (talk) 13:47, 2 June 2021 (UTC)

• Withdrawn due to URGENT and SEVERE situation. Resubmitted below. Itcfangye (talk) 19:35, 31 May 2021 (UTC)

  Toggled. --Super Wang (Chinese Wikimedian since 2009 | Greetings from Dalian) 03:33, 3 June 2021 (UTC)

The whole group is Unrelated. -- Amanda (aka DQ) 10:03, 3 June 2021 (UTC)

Looking Operator873^talkconnect 23:28, 4 June 2021 (UTC)

@Billinghurst: Unfortunately, the only commonality appears to be they are wireless data IPs, but are spread across different provider companies. :/ Let me know if I can help in any way. Operator873^talkconnect 23:46, 4 June 2021 (UTC)

Thanks Operator873. I suppose that I will continue to try to bore them to death with blocking abuse filters.  — billinghurst sDrewth 23:49, 4 June 2021 (UTC)

PS: The troll-account usernames translate to "Ministry of Ustasha police in Split", "Greater Serbia", "Ustasha police in Zagreb" and "Split part of Greater Serbia". --Koreanovsky (Ča–Kaj–Što?!) 14:17, 4 June 2021 (UTC)

•  Confirmed(global) СПЛИТ ДЕО ВЕЛИКЕ СРБИЈЕ, УСТАШКА ПОЛИЦИЈА У ЗАГРЕБУ, ВЕЛИКА СРБИЈА, МИНИСТАРСТВО УСТАШКЕ ПОЛИЦИЈЕ У СПЛИТУ, СЛАВОЉУБ ТОМАНИЋ НАЈВЕЋИ УСТАША ИЗ ОБРЕНОВЦА, ПРАВОСЛАВНИ УСТАША, ЛЕПО УПАКОВАНИ ЉИГАВЦИ ИЗ ВИКИМЕДИЈА СРБИЈЕ, ЛЕПО УПАКОВАНА ГОВНА НА ВИКИПЕДИЈИ

--Sotiale (talk) 14:26, 4 June 2021 (UTC)

+2 account per zhwiki block log. --SCP-2000 08:57, 1 June 2021 (UTC)

+4. --SCP-2000 13:39, 2 June 2021 (UTC)

Late reply because I was busy. I looked at some accounts when this request was posted, most of them abused OPs, not specific ranges. That's why I couldn't take immediate action. --Sotiale (talk) 13:23, 2 June 2021 (UTC)

Also the following:

• 六虫飛 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
• 九地黄流乱注，聚万落 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
• 虫子与车子什么关系？ (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
• 牛牛飛 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)
• 北京市精神医院病友 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

--GZWDer (talk) 18:31, 4 June 2021 (UTC)

I blocked IPs corresponding to OPs/VPNs. However, this does not mean that further attacks can be prevented. I think they are still working together, not just one user. --Sotiale (talk) 05:23, 6 June 2021 (UTC)

Hi, I want to know that if 咩咩叫 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser) is an LTA account and if 蛆蛆飛 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser) belongs to anyone else (its registration log is different from others.) Thanks. --Easterlies (talk) 06:16, 6 June 2021 (UTC)

Sadly, I don't know. They do not use fake information, but the lack of characteristic data makes comparisons difficult. It is impossible to guess who it is. --Sotiale (talk) 06:30, 6 June 2021 (UTC)

• Sadly, if they are cooperative, then things will be difficult. I don't think we can resist a team led by at least a covert rollbacker. --海の向こうは敵だ！ 09:00, 6 June 2021 (UTC)

This seems part of #馬吃飛蟲但不吃哈密瓜@zh.wikipedia above.--GZWDer (talk) 18:28, 4 June 2021 (UTC)

Please refer to the above. --Sotiale (talk) 05:23, 6 June 2021 (UTC)

Requested by Kalogeropoulos. Moved. --Sotiale (talk) 12:27, 7 June 2021 (UTC)

•  Confirmed John07234, Eurofan2000
• Unlikely Άλαν13

From a technical point of view. --Sotiale (talk) 12:36, 7 June 2021 (UTC)

Thank you--Kalogeropoulos (talk) 17:53, 7 June 2021 (UTC)

Another one Busssssslover (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser), thanks. --AnYiLin^Talk 11:09, 7 June 2021 (UTC)

Another one 月光戰士 (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser), thanks. --AnYiLin^Talk 11:27, 7 June 2021 (UTC)

• All Unrelated.

From a technical point of view. --Sotiale (talk) 12:24, 7 June 2021 (UTC)

• Thank you. Result posted to local community. -- Little Thor (☎) 12:53, 7 June 2021 (UTC)

 Confirmed Acayastya & June 8, 2021. No Sleepers, no comment on the IP address. Both accounts locked. -- Amanda (aka DQ) 21:27, 10 June 2021 (UTC)

Please see my results at Steward_requests/Checkuser/2021-06#Acayastya@en.wikinews. CUs & Stewards will not connect IPs to accounts. -- Amanda (aka DQ) 13:32, 12 June 2021 (UTC)

I am not expecting any connection -- I just want accounts from the IP/the range be glocked. Is that something CU/Stweards can do, @AmandaNP:?
acagastya 02:32, 13 June 2021 (UTC)

@Acagastya: You can submit this request on SRG for global lock. This page is only for requesting checkuser. -- Little Thor (☎) 01:55, 14 June 2021 (UTC)

•  Confirmed G1: Trong Trong Fei Is socking!!, Trong Trong Fei Abuse multiple accounts!!, 餅餅飞
•  Confirmed G2: JhbFTFJYFjytfJY, OIUuysegfuN, OHULIhulihlhNJN, 蟲飛進鼻孔怎麼辦?

Well, I guess this is different from them. And I still can't find any meaningful information other than the groups mentioned above. --Sotiale (talk) 10:06, 17 June 2021 (UTC)

Please refer to the explanation below. --Sotiale (talk) 10:16, 17 June 2021 (UTC)

Sorry for the delay in processing than my usual speed. I'm going to handle all of this tomorrow, including the requests below. --Sotiale (talk) 13:21, 16 June 2021 (UTC)

• Likely 靠幹餒餒餒, 超可愛

From a technical point of view. --Sotiale (talk) 09:54, 17 June 2021 (UTC)

Not done. I don't think this means much. It makes sense if they can be distinguished, but recent investigations show that they aren't. Whether or not to be subject to global lock will have to be decided in SRG, but I don't think this will have to be looked into iteratively in SRCU. Since proxies that are exploited are also blocked with accounts in SRG, there is no reason to block proxies through SRCU method. --Sotiale (talk) 10:15, 17 June 2021 (UTC)

Comment @Acagastya: Are you requesting to check sleepers? Requests for locking accounts should be made at SRG; this page is solely for processing checkuser requests.

Also I'm not sure how this global lock request fits the current guideline. A local wiki block should be sufficient. -- Little Thor (☎) 22:22, 14 June 2021 (UTC)

May I ask why this check is necessary? It will help us process if you give us a reason, such as whether you think they are still creating or accumulating accounts. --Sotiale (talk) 13:24, 16 June 2021 (UTC)

This is a repeated pattern I have observed for quite long. A very very similar pattern of vandalism. But from different usernames. Knowing and blocking any from there, it will just help minimise vandalism.
acagastya 01:32, 17 June 2021 (UTC)

Done This is a very common spambot. Mark as 'done' because other stews have already processed it through a different route. These common spambots are more suitable for SRG, not SRCU. --Sotiale (talk) 09:57, 17 June 2021 (UTC)

Doing... --Sotiale (talk) 10:03, 19 June 2021 (UTC)

•  Confirmed Group 1: Foodlike777, 777tw888, Superboominschool777, Heart1111, 777school 777, Liveoflove, 122333444455555666666vvv, 8food1ccc, Coolcoolcool1213, Seethebillin74, Deathandwiki886, Theand222
•  Confirmed Group 2: BayPJ, Lieng51

---

• Unrelated Group 1 and 2
• Group 1 and 2 are completely separate from the technical information(they used regular ISPs, not OPs or VPN). So I think they are not the same user.

From a technical point of view. --Sotiale (talk) 10:23, 19 June 2021 (UTC)

Additionally, the ranges used by group 1 are very crowded. Please note that undiscovered sleepers may exist. --Sotiale (talk) 10:25, 19 June 2021 (UTC)

Doing... --Sotiale (talk) 10:28, 19 June 2021 (UTC)

•  Confirmed Group 1: Sising5, Mcb114
• Likely Mimimimimi2021 and Group 1
• Unlikely Parkayalu and Group 1

From a technical point of view. --Sotiale (talk) 10:40, 19 June 2021 (UTC)

Can you explain why they are not ducks? And do you think they evaded blocking? Please explain these parts in detail. --Sotiale (talk) 13:00, 22 June 2021 (UTC)

• @Sotiale: Last week, a group of Taiwanese fans of its bus service were blocked after they tried to restore contents removed by local admins. After that, they stated in a Facebook post that they will abuse by removing similar contents to force such contents be restored. We would like to check the relationships between the "removers" (User 1 - User 4) with the "adders" (User 5 and Steward_requests/Checkuser/2021-06#SCANIA_K380@zh.wikipedia). Itcfangye (talk) 17:43, 22 June 2021 (UTC)

  Yes, they are playing good hand/bad hand and we would like to check for sleepers. -Mys_721tx (talk) 22:47, 22 June 2021 (UTC)

  Adding 13cccc. -Mys_721tx (talk) 07:20, 24 June 2021 (UTC)

Doing... --Sotiale (talk) 09:16, 24 June 2021 (UTC)

•  Confirmed Group 1: Uykyuvbn465, Czxvcvfds, Dvgdfsgfdg, Vfdbbngf94926
•  Confirmed Group 2: 13cccc, RBS-2000
• Unrelated 向鈞

---

• Unrelated Group 1 and 2

@Mys 721tx, Itcfangye, and Cmsth11126a02: From a technical point of view. --Sotiale (talk) 09:51, 24 June 2021 (UTC)

Forwarded the results. Thanks! -Mys_721tx (talk) 10:03, 24 June 2021 (UTC)

The relation between them is Possible. Ruslik (talk) 06:32, 24 June 2021 (UTC)

Doing... --Sotiale (talk) 09:12, 24 June 2021 (UTC)

•  Confirmed BNSF DJ, EnLarissais

@Chalk19: --Sotiale (talk) 09:15, 24 June 2021 (UTC)

•  Confirmed Ejmoog, Ejsoon, Hexiamonds

@Sayonzei: --Sotiale (talk) 13:14, 24 June 2021 (UTC)

Doing... --Sotiale (talk) 05:06, 26 June 2021 (UTC)

•  Confirmed Group 1: QuaestorGaius, NikiphorosP
• Unlikely QuintusHaterius and Group 1
• Unrelated LuciusVinicius, Greek Rebel

---

• In the case of user Greek Rebel, non-login editing is often found, but I cannot judge whether this is a mistake or not. All I can reveal is that it is not an account.

From a technical point of view. --Sotiale (talk) 05:24, 26 June 2021 (UTC)

@Kalogeropoulos: Could you please provide reasons as to why you think so? In order for me to conduct an investigation, I need reasons for your thinking. --Sotiale (talk) 04:59, 26 June 2021 (UTC)

It is not only about !voting in the request for adminship. All three accounts were used in same articles, or same articles talk pages, and Admin noticeboard sections. The first two seem to be relatively new, contributing on and off, but with deep knowledge about users and previous disputes on elwiki, and have same way of working and talking with the third user. Geraki ^T_L 05:14, 26 June 2021 (UTC)

Doing... --Sotiale (talk) 05:28, 26 June 2021 (UTC)

•  Confirmed Group 1: 12 παρά 5, Lippe 31, Διαμεσολαβητής, Metal Vang
•  Confirmed Group 2: Μίμης Βάζος, Ξάδελφος, Παύλου Γ., Toz 8, Loo Mag, Λ34
• Unrelated Skylax30

---

• Likely Group 1 and 2

From a technical point of view. Their IP ranges are so wide that there may be accounts that haven't been discovered yet. They are technically confirmed, but I want you to comprehensively consider their editing patterns when you block. --Sotiale (talk) 06:23, 26 June 2021 (UTC)

Thanks a lot, I'll do--Kalogeropoulos (talk) 10:43, 26 June 2021 (UTC)

@SCP-2000: forgot to change the project in H3, fixed now.
acagastya 02:31, 22 June 2021 (UTC)

I wonder if there's a reason it's better to be dealt with here than at SRG. You might be able to find and deal with more in this case at SRG rather than here. However, if you have a reason why this checkuser should be handled in enwikinews, it should be handled here. --Sotiale (talk) 13:07, 22 June 2021 (UTC)

To request gban/glock, I should know how many accounts originate from that IP. Once I know, I can then request on SRG. Unless SRG also involves checking IPs for other accounts.
acagastya 02:19, 25 June 2021 (UTC)

In general, in the case of spambots or xwiki spams, stewards handle the IPs used by the accounts and other spam accounts shared by the IPs associated with the account. Therefore, there is no need to obtain a list of accounts here, unless in the case of an LTA that requires detailed technical analysis. --Sotiale (talk) 05:03, 26 June 2021 (UTC)

Given the similar nature of the spam and in an attempt to prevent crosswiki abuse I did run the check. All relevant accounts have been locked and a proxy range has already been blocked. Not going to go into detail further as it would be pointless. -- Amanda (aka DQ) 22:07, 29 June 2021 (UTC)

The requested accounts have already been investigated above, with one exception, and technical results have been obtained. Please indicate which account the account you requested should be compared to. It is difficult to comprehensively cover all accounts that have already been investigated. --Sotiale (talk) 11:08, 27 June 2021 (UTC)

Mightberightorwrong is the account I request to be compared with the other two. I removed one. --C messier (talk) 13:55, 27 June 2021 (UTC)

All three accounts are Unrelated. -- Amanda (aka DQ) 22:23, 29 June 2021 (UTC)

• In fact, local would more like to have their IPs blocked if needed, the relationship between them seems duckable. Itcfangye (talk) 12:15, 29 June 2021 (UTC)

• Vandalism-only accounts do not meet the threshold for requiring CU. Autoblocks will do the work they need to do, unless you have evidence of more accounts. -- Amanda (aka DQ) 21:54, 29 June 2021 (UTC)