Steward requests/Checkuser/2021-08

Please do not post any new comments on this page. This is a discussion archive first created in August 2021, although the comments contained were likely posted before and after this date. See current discussion.

•  Confirmed Australian111, NewPersonHere, BokChoyBoi
• Unrelated BlueWhale65
• Stale Kolonahe

-- Amanda (aka DQ) 02:04, 1 August 2021 (UTC)

They created the same page, and the low quality of the content doesn't fully explain why you need a checkuser. Can you tell me why you need a checkuser for them? --Sotiale (talk) 12:06, 2 August 2021 (UTC)

Hello Sotiale. They also edited the same page, and 清橘 created a topic on my talk page, but I never send the CU notice to him. New users should n't find this page so quickly (only 5 mins). AnYiLin^Talk 02:37, 3 August 2021 (UTC)

I think block is possible with that kind of behavior pattern. But you didn't, so there must be a reason for requesting a checkuser. Please explain what the reason is. --Sotiale (talk) 11:43, 3 August 2021 (UTC)

Does block mean duck? Ok, I got it. But, 清橘 left a message on my talk page: I'm really sorry that I am a new user. Please tell me if I did something wrong and I will change it. Out of AGF, I would like to ask you to confirm further (as explained in the previous reply, I think he isn't a new user). AnYiLin^Talk 12:00, 3 August 2021 (UTC)

That explains why 清橘 is suspicious, but it doesn't explain whether TNT1123 has sockspuppet relationship. --Sotiale (talk) 12:38, 3 August 2021 (UTC)

After looking a little more at their deleted contributions, I found that they had the same interest on another page, and their edits were not clear to reveal the relationship between the 2 accounts, so I went ahead with the investigation. And they're Unrelated. No matching information. --Sotiale (talk) 12:38, 3 August 2021 (UTC)

Got it. Thank you very much. AnYiLin^Talk 14:37, 3 August 2021 (UTC)

First things first. I have to admit that I don't have the most perfect or flawless English, so any user who finds a grammar mistake or just a wrong translatiton, please feel free to fix it or contact with me to fix :)

I make this request to prove my innocence per the CheckUser policy. I do that because two of CheckUsers made a conclusion that User:Soner Turhan 0202 is my sockpuppet in 2016, and I still suffer from endless claims. I have made this request in the Turkish Wikipedia as well, but one of the CheckUsers (CU) was involved to the incident in 2016 (User:Elmacenderesi, who didn't share any opinion in the 2021 request), another CU (User:Uncitoyen) gave a "conclusion" which basically indicates "there was a IP crossing check 'before the request'" -nothing to prove my innocent or guilt-, and the other CU is basically ignoring the requests (User:Eldarion, as he does in the last four and a half years, as can be seen in the page histories). Therefore, I have no other chance to make this request to prove my innocence in here, even, I have reasonable doubts for the reliability, credibility, and capability of the CUs.

Everything starts with the CheckUser request made by User:Esc2003 in June 9, 2016 (the username in the title is my former username). What he/she claims is this:

Soner Turhan 0202 creates a new article by copying the content in the sandbox of Rapsar which he created for Altıparmak Gıda. Please take a look at the situation I mentioned in his request for adminship page, related with the Serhat (şarkıcı) article that Rapsar has created. Briefly, he creates an article of a person that is a friend of him, according to his claim. And then that article is being translated into approximately 10 languages and they are sent to Rapsar to create in various editions of Wikipedia, and he creates them. Among the articles of Soner Turhan 0202 has created, there is also Megahit-Uluslararası Akdeniz Şarkı Yarışması, which is related with Serhat. The same user creates another well-written article, TEB Aile Akademisi, translates into English and he creates the article in the English Wikipedia. It's interesting to see well-written articles from a user with the most of his contributions are just vandalism, and all of them are created in March 29, 2016. After all of them [creating articles], he/she sends a WikiLove message to Rapsar saying 'good job man' and for some reason, Rapsar reverts it. And Soner Turhan becomes silent after that. To think that all of those things are just 'good job man!' would be an over-good faithed assuming. We are facing with a meatpuppetry which contains commerce

— esc2003 (mesaj) 20:44, 9 Haziran 2016 (UTC)

As can be seen above, it is claimed that I am a subject of a "meatpuppetry" (that's important, he/she says that) case and User:Soner Turhan 0202 is my meatpuppet. The "commerce" or "paid-editing" part of the issue is not the subject of this request, so I am not going to say anything for that not to make it too long and more difficult to understand that it already is.

Anywat, in the request, it can be seen (well, a Google translate would help maybe, there's no reason to translate all the text) that I stay pretty calm, because I am basically aware of that I am not involved such an act. On the other hand, I had left my home country (Turkey) in January 28, 2016 (a gap in my contributions between January 28 and February 2 can easily be seen), stayed in another country for about 4 months, and left that country on June 1 (also a gap can be seen in my contributions between June 1-3). I can easily prove that trip, with my social media posts or even with a copy of my visa, anything you may like :) In the 2016 request, it's claimed that i was a subject of a "meatpuppetry" case, keep that in mind.

Back to the 2016 CU request, back in those times, my sandboxes were full of my works, some of them I worked for days, some for weeks which can easily be seen in the page histories. And they are not completed yet, I was still working on them. Soner Turhan 0202 registered in March 26, 2016 and he started to make edits on the very same day, pure vandalism. He was blocked for one day by User:Sakhalinio on that day. He returned in March 29 and the first thing he did was copying the contents of three uncompleted articles on my 3 sandboxes and creating them as articles. Right after that, he [sent a WikiLove message to me titled "good job man" that says "ohohh - good job" yazmış]. I was acting on that time and reverted that after 3 minutes. Of course I don't remember what I did exactly on those times, it's been 5 years, but I know that I wasnt't even aware of that Soner Turhan 0202 had copied my works and used them to create new articles. But how can I prove that I wasn't aware? As can be seen in here, on April 13, apprixomately 2 weeks later of them, I saw that they are created by him and I revised all three of them. Not on the same day, after a day, the same week. And as can be seen, I didn't just approve them, I made some contributions on them because they were unfinished basically.

At this point, I'd like to give some information about the devices that I was using back in that time. When I was in Turkey, I was using a desktop PC with a Windows XP OS. My web browser was Google Chrome. When I left my country, I grabbed a laptop that I have never used before. Its OS was Windows 8 or 10 (I don't remember that much) and my web browser was Google Chrome. During my time abroad, I had used that device, all the time. Therefore, that was the first time I changed my device to contribute on Wikipedia, after many years (can be some exceptions, but I was not even contributing on mobile devices back then, all of them can be checked and seen). After I return to Turkey, if I remember correct, I used my laptop and desktop together, for a while, and after a while, I stopped using the laptop and used my desktop that I had been using for all those years. Until the end of January 2017, I kept using that device, OS and web browser.

Let's go back to the 2016 CU request again. THe first contact of me and Soner Turhan 0202 had occured in March 29, 2016, as I mentioned. I wasn't in Turkey back then. But despite that fact, A CU, User:Sadrettin declares a "conclusion" stating "I was able to detect crossed IP addresses and other some technical datas", indicating me, Soner Turhan 0202 and another user named User:N.N P&S (his/her contributions). In that statement, "IP address" part is important, because I wasn't in Turkey back then. If I remember correct, I hadn't declare the country I was in (until the CU request in 2016). The country I was in is not a country that you prefer to reach by using a VPN (those add-ons have locations in Germany, the USA, Singapore etc but not Mexico). Therefore, I stated that there must be a mistake. Besides, not to mention that the CU request was made for a "meatpuppetry" case, not a "sockpuppetry" case.

Let's go back at Soner Turhan 0202. During his (I keep saying "he", because the user name is a male name) activities, he made pure vandalism. His edits can be seen easily, but the important part is his deleted articles. Just on the day he registered, he created approximately 40 articles titled "Soner Turhan" or referring to that (such as "S. Turhan")! He started doing that at 01:54 and continued until 02:28. Then he stopped creating articles and started to make edits at 04:01 (pure vandalism) and until 04:56, the vandalism continued (until he was blocked). If you just take a look at my contributions at those times, I started my activities on March 25, editing since 19:04 until 20:12, and on March 26 at 03:20, I make an edit. The time I became active again was at 18.48. Considering the time difference between Mexico and Turkey (8-9 hours), if I control both accounts, I must have stayed awake one whole day, contributing in my account and switching to my sockpuppet account and make vandalism, create 40 articles, and then again more vandalism for some reason. Since the 2016 CU request states "there are crossed IP addresses", I had to buy a VPN (because I suppose the other user is located in Turkey and I need to buy that to have a Turkish IP adress) and keep switching it on and off.

Now, I am going to mention of another interesting thing. Just 4 days before that CU request, on June 5, 2016, an anonymous user posts this on the village pump:

Title: Wikipedia user makes a score

I have a trading business in Istanbul. For the last few monts, a young guy keeps coming to our office and makes an offer to us about creating our Wikipedia page [...] Last week that guy visited us again and he showed some of his works [giving a link to one of my sandboxes]. He didn't seem so trustworthy so I decided it'd be better to write you. I'd like to order it from you, please inform me and give some information about the payment too.

Basically the anonymous user claims that I had been coming to Istanbul and my latest visit was on the last week. Well, when I was in the other side of the world (January 28-June 1, 2016), I was basically keep going to Turkey and visiting them and coming back :) It makes total sense... 4 days after that claim, the 2016 CU request were made. I have no idea or theory who that anonymous user is...

I'm back to the 2016 CU request again. On June 11, one of the CUs, User:Elmacenderesi makes his first comment on the case. I just want to copy some parts of his comment: "The CU activities I have done in the past, I have detected crossed IP addresses over and over again". Wait, what? Which detections? Where and when? "Over and over again"? Soner Turhan 0202 made edits only 2 days, how come there can be multiple crossed IP addreses? Elmacenderesi states that "even if you [not me, in general he refers, I guess] change your IP address, yoru computer, use VPN, we can understand, see and know that you have a sockpuppet". Wait, what again? So all of us basically are sockpuppets, because we change our device and IP address, yet, we are controlled by the same person. That comment is basically unacceptable. He continues: "If we come back to Rapsar, in his request for adminship discussion, he gives credit the comments are made about another users by anonymous sockpuppets. On the other hand, he removes the comments of anonymous sockpuppets in this CU request -whom we blocked-, he states that he is fighting against vandalism. Isn't that biassed?". I was not able to understand what he was referring by them, but I was able to while I was makine the 2021 CU request in the Turkish Wikipedia. He refers here:

Rapsar [my former user name], I say this pretty clear, you are one of the biggest provocateurs in here. On above, an anonymous sockpupet whose biggest honesty is his/her cowardness made a comment and you agree with that, that's who you are. You are part of a group that drives away the users, you know that too pretty well. Agree with the sockpuppet. Because that's your [plural] biggest honesty.

— e.c. 18:59, 8 Mart 2016 (UTC)

If a regular user makes that comment, those unacceptable words and claims, that user would be blocked immediately, or at least be warned. He didn't receive anything. And the same user, Elmacenderesi, states this in my request for CU discussion: "CU must be practiced by the users that doesn't have conflicts with the other users nor the users that doesn't look for weak spots of them".

Among of his other comments in my 2016 CU request, something else draws my attention: "I verified [the findings] to the global CUs" and then "I'll advice to the global CUs [again]". "Global CU" doesn't exist. Maybe he refers "stewards", but in any case, such a term doesn't exist.

Let's start with the VPN thing that he mentioned on the 2016 CU request. He comments that "I warned him about VPN using, he didn't even care". Let's take a look at his contributions between June 1 and June 16, 2016. Can we see any VPN warning made for me? Nop (I'll say why I gave those dates). That VPN warning has made in March 1, 2016 on the village pump. Is it possible that I haven't seen that? Totally yes. But anyway, since I have mentioned a few times, I was in a country that I literally didn't have to use VPN. Basically, I didn't have to. In Turkey, as many of you already know, there are many websites that are banned and we can't use them without using VPN. Even YouTube or Twitter was banned for a while, therefore, even if I had VPN (and I had during my time in Turkey obviously), it's pretty possible that I forgot it turned on and I edited like that. Why the hell would I even edit Wikipedia by using a VPN, and using my account anyway? I edit since 2009, 7 years back then, many people know me in person, I mean why would I try to hide my IP address but use the same account? :) If it's possible to check my IP addresses that I had used those times, it can be seen that even if I accidentally used VPN, I turned it off when I noticed. Someone please explain, if I use VPN when I use my sockpuppet account, why the hell would I use when I use my main account and just leave marks?

After those VPN talks (there's no way to prove it but back then, I didn't know that those add-ons are called "VPN", I was just using "Zenmate" without the knowledge, but there's no way to prove it and it's not even important), Elmacenderesi, posts a "conclusion" for the 2016 CU request. He claims that I used VPN on June 12-13 again ([my contributions). There is no logical explaination that he warns me for not using VPN, and the very next day, I use it again, and for two days! Just like that, to contribute Wikipedia, I use my semi-anonymous account and use a VPN! Is it possible that I forgot to turn it off? Totally. Maybe I was using Wikipedia and other banned website on the same time, who knows! But there is absolutely no reason nor logical explanation nor proof that I used VPN intentionally, and for my sockpuppet account.

Let's revise the "conclusion" of Elmacenderesi. He claims "spending the last few nights by revising my contributions carefully and making technical analysis by receiving support from the Foundation". But he basically fails to notice zero relevance between my contributions and Soner Turhan 0202's edits. After that, he states that "in meatpuppetry cases, it's pretty pretty rare to see crossed IP addresses between the main account and the vandal account, but there can be a coincidence". Wait. I thought there was a "multiple" crossed IP addresses? He stated that before, and now we are back at "meatpuppetry"? He continues: "I'd like all of you to know that we wouldn't block anyone by cheap comments of all the sockpuppets in here [the CU request] whom I know (we detected all of them)". He doesn't mention who they are. He also mentions that he revoked my revison check user rights.

In the second comment he made on June 18, he states that "[referring the revoking my revision check user rights] this action is not related by your VPN using. I don't recommend you to use VPN." So, VPN is not a problem, he "recommends" not to use. So, what was my fault? VPN usage, nop. Meatpuppetry? They said "multiple crossed IP addresses". Sockpuppetry? They mentioned on "meatpuppetry". So basically they don't even know how to blame me :) I tell you what to blame, just some accidental VPN using -which can easily be seen in the records-, that's all and that's not even a thing :)

Now, let's mention of another things, pass to another dimension :) On the 2016 CU request page, User:Toppolila makes a comment in June 12, 2016 and mentions of someone: User:Hakan Balamir. If we just take a look at his (again, male name) contributions. He had registered in March 18, 2016, and makes his first edit on that very day (similar to Soner Turhan 0202). The interesting part is that we just check the articles Hakan Balamir has created and bingo! Such as Soner Turhan 0202, he created many articles within minutes and they are all pure vandalism. He created 24 articles on that day and their names are "Soner Turhan" or variations of it! User:Vikiçizer's 6 hours of blocking didn't stop that user and he continued his vandal activities. Not only creating pages, but on the other edits and vandal activities, you can easily observe the same pattern with Soner Turhan 0202, blanking pages, adding meaningless content etc. A user, Toppolila, mentioned of that user but not a single attention was given to Hakan Balamir and CUs don't even bother themselves to check that user!. That user gets blocked several times, but despite all of them he doesn't stop and he keeps vandalise and vandalise. This user is Soner Turhan 0202, it's clear as a day. Even before my CU request, those two users were vandalising over and over again. So, the CUs say that Soner Turhan 0202 is my sockpuppet/meatpuppet (I don't know which one), but Hakan Balamir is not. If one of them is my evil account, the other one should be, clear as a day :)

Now, let's go forward a bit on time. In July 10, 2016, a few weeks after the creation of my CU request, User:II. Niveles creates a CU request for U:Hakan Balamir. Other users can be seen in there, II. Niveles shows the similar vandalism patterns between those users. Elmacenderesi closes this request as "possible" in August 15 and states that "there are no technical connections between them, but it can be possible that they made professional vandalism by using different IP addresses". Just check the edits please, they literally have the same vandalism patterns! What else do you need? Your responsibility as a CU is not only IP address checking, but checking the contribution patterns!

Now let's go back in time for a bit. In July 2, 2015, User:Supermæn makes a CU request about 5 user accounts and 12 anonymous users. What are the names of those users? User:Sonerturhan081994, User:Adsız081994, User:Sonerturhan00, User:Gsli soner and User:Sonerturhan156. I can't see their edits except Sonerturhan081994, because they are deleted, so we can just look at the articles they have created. I am not going to add them one by one, you can easily check them. All of them had created pure vandalizm articles, related with (!) football or "Soner Turhan". If you take a look of Sonerturhan081994's contributions, it can be seen that they start on July 2013. In his first contribution he adds "Soner Turhan", for example. This CU request was closed by Elmacenderesi in August 15, 2015 by "confirmed" and he states that "it's detected that those accounts are sockpuppets". So basically, this "Soner Turhan" thing goes back all the way to July 2013, 3 years before "my sockpuppet/meatpuppet" Soner Turhan 0202.

CU requests in chronological order are like this: Sonerturhan081994 (July 2015), Rapsar-Soner Turhan 0202 (July 2016) and Hakan Balamir (July 2016). All of those vandals have the same vandalism pattern and it starts back in 2013! All of them are connected, using similar names, makes similar vandalisms, they are all connected. Except one: Soner Turhan 0202. And that one is claimed is to be connected with me :) Just unbelievable. There is a person or persons makine a similar vandalism since 2013, all of those accounts and anonymous users are not connected with me, but Soner Turhan 0202 is. That's not even the end, another CU request comes on November 15, 2016, and that adds 4 other user accounts and 3 anonymous users. They're again all connected, but Soner Turhan 0202 not :) Why? Because he just copied the contents of my sandboxes :)

Now we fastforward to 2020. I just come across with a user, User:Parayla Madde Yazan PaRapsar ("Rapsar, the user writes articles for money"). I send a private message to Elmacenderesi on Telegram in March 4, 2020 so he can make a solution. After his recommendation, I make a CU request. I have no idea nor a theory who that person can be, as I stated there. After a few minutes, Elmacenderesi closes that CU request as "confirmed"and bingo! We see Hakan Balamir there. The user who has the same pattern with all those Soner Turhan accounts, but except the one: Soner Turhan 0202! Because that one is my sockpuppet/meatpuppet :) So basically, the last vandal account that I made a CU request, the vandal that damages my honour and my image, is just me :) The vandal or vandals that had been vandalising since 2013 are just connected with me, even damaging my own image or even my own anonymity is me! Any logic in that?

That was the translation of my recent CU request in the Turkish Wikipedia. And now, we even have new information related with the case.

After all the things I wrote, all the evidences I gave (even said that you can share my private information, IP addresses during those times, device information, anything), that request was closed by User:Uncitoyen stating "in the [CU] logs, I can see that Soner Turhan 0202's IP address had checked days before the 2016 CU request which was made in June 9, 2016 and right after that Nanahuatl's [Rapsar] IP address". He only mentions that, doesn't say that we are connected or doesn't prove my innicence. In his second comment, he states that "the first IP check was made in June 5, 4 days before the CU request".

Questions raising

• Who is the anonymous user that claimed "I visited their office"? Why the CUs ignore that?
• Who are the sockpuppets on my 2016 CU request? Elmacenderesi had stated that he knows them, he detected them. Who are they?
• How can I even have crossed IP's with someone in Turkey while I was in Mexico? Do you refer that we had crossed IP addresses when I accidentally used VPN? So I must have tens, hundreds of accounts.
• How come all of those CUs never consider tens of vandal accounts and anonymous users?
• Is it that easy to claim that someone has sockpuppets by just finding out a crossed IP?
• How can I have "multiple" crossed IP addresses while my claimed sockpuppet was only active for 2 days?
• How come I am not connected with all of those vandal accounts, if I am connected with one of them?
• The most important question: What if they, mostly Elmacenderesi just knew them and abused his rights? His aggresiveness ("provocateur part") can be noticed. There are other such attitudes but I prefer not to mention to stay in the issue.

What I request?

• I request that a CU checks all of the information and proves I give. That CU can feel free to share my private information (not current, historical information) publicly, on Wiki projects. I just want to prove my innocence and when it's proved, I can clearly say that this is a CU abuse, a clear abuse of Elmacenderesi. All those silence, all those avoidings, all those carelessness and ignoring... I have done hundreds of thousands contributions, contributed more than 80 FAs, FLs and GAs in total, created around 4.000 articles. And here I am trying to prove my innocence because this image has just stuck on me and I don't have any solution. Besides, this abuse is more than me, Nanahuatl, it has critical importance for Wiki projects, not just for me.

Regards.--Nanahuatl (talk) 09:36, 2 August 2021 (UTC)

CheckUser data is only held for 90 days RhinosF1 (talk) 09:38, 2 August 2021 (UTC)

Not done trwiki has its own CU. Stewards do not intervene on a project with an active CU. Closed. — regards, Revi 10:05, 2 August 2021 (UTC)

Also: If you allege abuse of CU privileges, you should go to OC, not SRCU. — regards, Revi 10:06, 2 August 2021 (UTC)

@-revi:, they basically ignore, there is no way to prove my innocence. What am I suppose to do?--Nanahuatl (talk) 10:11, 2 August 2021 (UTC)

• i am wondering that what is solution this situation? It look like catch-22. Satirdan kahraman (talk) 21:59, 2 August 2021 (UTC)

Doing... --Sotiale (talk) 13:27, 6 August 2021 (UTC)

• Accounts not yet blocked: Tomsns, Toms foundation, Luoshirou, Miss-Adagio, Tren Su Ben Su, Shancaiyu, Chaojisaiyeren, Blossom Blisly

Ummm... wouldn't it be more appropriate to just block them? :p --Sotiale (talk) 13:42, 6 August 2021 (UTC)

Doing... --Sotiale (talk) 12:56, 6 August 2021 (UTC)

•  Confirmed Group 1: Chantalleng, Haoshengfamily, Leexiaolu, Leeyitong, Liujialing, Lynnlimbr, Niuzaizai, Qingxiaolan, Rainieyangchenglin, Tongliya, Yuanbingyan, Zhechengjia, 李小冉, 玛丽莲梦, 天天要开心, Zoudonyu
•  Confirmed Group 2: Dabaobei, Aenieyi, Zhenshu
• Stale 董璇

---

•  Confirmed Group 1 and 2

It was an interesting jigsaw puzzle, but hidden accounts were found anyway. From a technical point of view. --Sotiale (talk) 13:23, 6 August 2021 (UTC)

Doing... --Sotiale (talk) 09:28, 9 August 2021 (UTC)

• No hidden accounts were found in the adjacent ranges they used.

But it is possible that they are active in other ranges. From a technical point of view. --Sotiale (talk) 09:35, 9 August 2021 (UTC)

thanks Jonathan5566 (talk) 12:46, 9 August 2021 (UTC)

I looked at the request contents of the user's rename queue before this investigation, but I could not find any evidence that this was a privacy problem, and the requester's claim is valid, so I publish the checkuser result as follows.

•  Confirmed Lorry Gundersen, Vanished user 2831328

From a technical point of view. --Sotiale (talk) 11:33, 10 August 2021 (UTC)

Doing... --Sotiale (talk) 11:38, 10 August 2021 (UTC)

• Unrelated all accounts except Eldanizmammadov and Viki-BSU (Both accounts are Stale)
• All accounts with technical information are seen as individual users.

From a technical point of view. --Sotiale (talk) 11:43, 10 August 2021 (UTC)

Not done. If you need the checkuser result of eswiki, please visit eswiki. Also, visit SRG if you need to lock their accounts. This is where you ask if you need a checkuser on a particular wiki. We can't help here as we can't do checkusers on the wiki where the local checkusers team exists; eswiki already has a local checkusers team. --Sotiale (talk) 00:21, 9 August 2021 (UTC)

@Jules*: I can't do checkuser operations directly in both wikis. If you want to lock their accounts, there is a more appropriate way. If they are widely known LTAs, posting them to SRG is encouraged. This can be handled by stewards who know their technical information or behavioral patterns, and can even ask for collaboration between the two wikis if necessary. How about my suggestion? --Sotiale (talk) 00:25, 9 August 2021 (UTC)

Hi @Sotiale: I was not sure it was the right process indeed. So the way to ask a comparison beetween data of two accounts operating (without overlaping) on two separate wikis is SRG, thanks. I will post there. Best, — Jules* ^Talk 08:11, 9 August 2021 (UTC)

Oh, I see. Then I mark this request as withdrawn. --Sotiale (talk) 09:25, 9 August 2021 (UTC)

--Jonathan5566 (talk) 03:03, 10 August 2021 (UTC)

Can not find the puppet confirm is LC99 and have not stale, sorry about that, withdraw--Jonathan5566 (talk) 07:15, 10 August 2021 (UTC)

Request withdrawn per requester. --Sotiale (talk) 11:34, 10 August 2021 (UTC)

Also the first election on that page was confirmed to include some sockpuppetry, so there is a good possibility that some of the other accounts are also socks. --Zabe (talk) 21:13, 11 August 2021 (UTC)

•  Confirmed Group 1: Buting.nukay, Dongi0919, Sabak5388
•  Confirmed Group 2: 海螺先生, K1.balakas, Kumud.pazik, Tokoabibi, 龍眼村長, Malataw
• Both groups are Likely to each other. -- Amanda (aka DQ) 04:35, 12 August 2021 (UTC)

• Unlikely Smaragda.karydi.fans, Emeraldmaria
• Stale Annamariabotsi

-- Amanda (aka DQ) 02:09, 13 August 2021 (UTC)

--Jonathan5566 (talk) 06:00, 13 August 2021 (UTC)

• Note: they added the same original research content to w:zh:勃列日涅夫. We also found a link on Zhihu (a website similar to Quora) that uses their edit as a reference. We prefer a CU to see if they are socks or not. Itcfangye (talk) 09:33, 13 August 2021 (UTC)

Doing... --Sotiale (talk) 12:48, 13 August 2021 (UTC)

•  Confirmed Group 1: 土豆泥泥, 土豆泥泥泥
• Possible 中国网络历史文化调查 and Group 1

---

• The IPs they used seems to be OP or VPN.

From a technical point of view. --Sotiale (talk) 12:57, 13 August 2021 (UTC)

Moved from zhwp. --DreamerBlue (talk) 12:30, 11 August 2021 (UTC)

• Since Sotiale granted me meta IPBE, it is easier to describe more about this case.

  The whole thing dates back to July 9th, when I recalled "there is an alliance between LTA QCHM, HMGY and Yage Wu" in local wiki.

  Yage Wu declined such an alliance at Uncyclopedia on the next day, stating that "My recent socks just impersonate QCHM".

  QCHM wrote on July 20th at Uncyclopedia describing themselves as "LTA at Zhwiki. First of 三幻神. Allied with HMGY and Yage Wu. (No, that's not true)". The word 三幻神 means "Three Unreal Gods" in Chinese.

  User 三幻神 was registered on July 26th and was soon considered a sock of QCHM and blocked. They made an unblock request saying "What did I do wrong?! I am innocent!!! Unblock me!!!!!".

  User 兩幻神 (which means "Two Unreal Gods" in Chinese) was registered and blocked on July 28th.

I suspect that 三幻神 is Yage Wu. Their reaction to being banned is unlike QCHM, but like Yage Wu. For example, Yage's sock 馬吃草但不吃飛蟲 (which impersonated QCHM) made an unblock request saying "I am not a sock of QCHM, nor HMGY". However, I cannot completely remove the possibility that 三幻神 is a different person who had no connection with the above and was not meant to abuse. Therefore, I made a CU request between them and Yage Wu's socks, hoping to find some clues. Itcfangye (talk) 08:40, 12 August 2021 (UTC)

三幻神 is also unlikely HMGY (who seldom uses Traditional Chinese except when quoting QCHM). Itcfangye (talk) 08:50, 12 August 2021 (UTC)

Well... I can tell you about two things;

1.  Confirmed 三幻神, 愛國愛港的維基人
2. Based on technical information, 三幻神 seems to be different from 馬吃草但不吃飛蟲

--Sotiale (talk) 13:25, 13 August 2021 (UTC)

Can you elaborate on what "miscellaneous" means? Because the expression is so broad, it is difficult to infer the rationale for suspecting that they are the same user. --Sotiale (talk) 13:01, 13 August 2021 (UTC)

Both preferred listing the actors/actresses who starred as an antagonist (反派) in a television drama article, e.g. Lee Kok Hin, "this is the first time 朱晨麗 starred as an antagonist", Stephen lee kh, "this is the 16th time after (15 tv dramas listed here) that 陳山聰 starred as an antagonist". It is a consensus in Zhwiki community that whether a character is an antagonist should not be described in these articles. Itcfangye (talk) 02:05, 14 August 2021 (UTC)

Another example worth noting: Lee Kok Hin, "this is the 9th time after (8 tv dramas listed here) that... starred as an antagonist.". Itcfangye (talk) 06:10, 15 August 2021 (UTC)

Doing... --Sotiale (talk) 12:17, 16 August 2021 (UTC)

•  Confirmed Group 1: 2001E68M, Lee Kok Hin
• Unrelated Stephen lee kh and Group 1

They(Stephen lee kh and Lee Kok Hin) are using normal IP ranges, obviously different users. --Sotiale (talk) 12:24, 16 August 2021 (UTC)

Doing... --Sotiale (talk) 12:13, 16 August 2021 (UTC)

•  Confirmed Vanness970927, Zhixian0508

Without doubt. --Sotiale (talk) 12:15, 16 August 2021 (UTC)

Doing... --Sotiale (talk) 13:54, 17 August 2021 (UTC)

•  Confirmed Group 1: Tunar.ee, Hazarday
• Unrelated Qadir 13 and Group 1

From a technical point of view. --Sotiale (talk) 13:58, 17 August 2021 (UTC)

I only found Kunga beer unblocked. -- Amanda (aka DQ) 04:13, 18 August 2021 (UTC)

I don't understand what you are asking. This is where you can request a checkuser, but it is not the place to determine sanctions against users. Please read the instructions above and request again. --Sotiale (talk) 13:52, 17 August 2021 (UTC)

We have a problem with the mentioned user on the Afrikaans Wikipedia and the Afrikaans community wants him removed, I happen to be the spokesman. I do not know your procedures or responsibilities but can a Checkuser please do what he has to do then. He has created at least 15 usernames to get past the blocking. Oesjaar (talk) 14:58, 17 August 2021 (UTC)

Oesjaar, do you have any examples of unblocked accounts that you believe are operated by the same person? The account you listed has already been blocked following a checkuser request. For everyone else, see Steward_requests/Checkuser/2021-06#Wwikix@af.wikipedia. GeneralNotability (talk) 15:12, 17 August 2021 (UTC)

What he does is to create a new user account and redirect it with a the user:mukdro. He does not create it on the Afrikaans Wikipedia because I put a welcome message in all new user accounts. The first thing I see is new red account (not a name or anything, sometimes just a bunch of letters) when he start to buggers around. Today he used Slanuski and Pietesie. Have a look at [2], you will notice him. Problem is last at 20:00 he tried his luck again... That is all I can give you. Regards. Oesjaar (talk) 16:25, 17 August 2021 (UTC)

PS I can't remember whether the Mukdro account was created on the Afrikaans Wikipedia or not... Oesjaar (talk) 16:52, 17 August 2021 (UTC)

Just blocked him as Lorzuutwuls. Regards. Oesjaar (talk) 19:38, 17 August 2021 (UTC)

There are sleepers here, I just do not have energy to go through the full list tonight. Will update some point tomorrow. -- Amanda (aka DQ) 03:49, 18 August 2021 (UTC)

@Oesjaar: I understand what your request is. At first, it was difficult to know what you were asking from just what you asked for(it's hard to guess what "remove" means, and only one account was presented). This is a space to process checkuser, and it exists to check whether the relationship between the user and other users technically exists and to prevent malicious behavior. You just need to present Mukdro, which you suggested first, and Lorzuutwuls, which you suggested later, together with the evidence. I've modified this request to be an example of a request. This request will be handled by Amanda soon, as she said she would. --Sotiale (talk) 08:51, 18 August 2021 (UTC)

The evidence is the account [[3]], it is impossible to copy the recent changes from the Afrikaans Wikipedia to this page as that is where the evidence (his activities) is. I do not care what you do with him as long as he cannot access the Afrikaans Wikipedia. This morning he appeared as Ticklemoe which we blocked, again. [4] Oesjaar (talk) 12:58, 18 August 2021 (UTC)

PS other names for the day: Egeboue, Cehdelahm

User Mukdro was created on the Afrikaans Wikipedia, just incase it might help. Oesjaar (talk) 16:55, 18 August 2021 (UTC)

So let's focus on af.wikipedia checking, right? --Liuxinyu970226 (talk) 23:32, 18 August 2021 (UTC)

Additional socks found: Derevi, Logteruna, Nosvandoer, Kletshes, Jondisie, Amr-jek -- Amanda (aka DQ) 03:17, 19 August 2021 (UTC)

@user Liuxinyu970226 is there a way to block the IP address of user:Mukdro if he's creating these accounts from the same device? Oesjaar have been requesting assistance from WikimediaZA chapter for months now regarding this issue and this platform is where we've directed him. I'm also worried about his well-being! If we need to escalate this to the WMF trust and safety team kindly let us know. Bobbyshabangu (talk) 18:11, 22 August 2021 (UTC)

Doing... --Sotiale (talk) 11:43, 19 August 2021 (UTC)

• Unrelated Conan1231, Kathy Ma Ma, Come Baby Baby

From a technical point of view. --Sotiale (talk) 11:50, 19 August 2021 (UTC)

•  Confirmed Trevorfok25, 河畔葵芳

From a technical point of view. --Sotiale (talk) 11:38, 19 August 2021 (UTC)

Are some of them be Yage Wu? Someone think that at least the last one would be. --Liuxinyu970226 (talk) 03:29, 30 July 2021 (UTC)

Added a user per request from local.--Lightyears_Talk 13:46, 30 July 2021 (UTC)

•  Confirmed 哈密瓜抽, 哈密爪抽, 哈密爪柚
• Unrelated Bu ai se kao de zhu
•  Additional information needed about how the other accounts are related before checks will be ran. Checkuser is not for a fishing expedition. There needs to be a behavioral connection.

-- Amanda (aka DQ) 17:54, 1 August 2021 (UTC)

@AmandaNP: About Sanhuanshen (三幻神), @MCC214: said that a zhwiki LTA zh:LTA:千村狐免 said on Uncyclopedia (link) that: I'm the famous Chinese Wikipedia spammer, and the leader of a recently appeared Sanhuanshen. After not more than 7 days of written of this sentence, someone registered 三幻神, what a coincidence thing this is happened. Note that the Sanhuanshen made a block review request, so we cannot handle it without CU results. --Liuxinyu970226 (talk) 23:44, 1 August 2021 (UTC)

May I request checking their sleepers, please? --Liuxinyu970226 (talk) 23:28, 2 August 2021 (UTC)

@AmandaNP:Bu ai se kao de zhu is the Pinyin form of 不爱思考的猪, which also close to another user called 不爱思考得猪（same pronunciation）, I wish zhwiki could be saved. | Pavlov2 (talk) 06:25, 8 August 2021 (UTC)

Itcfangye split the request into two cases by making a new request for 三幻神 below. --DreamerBlue (talk) 12:30, 11 August 2021 (UTC)

So the 三幻神 case is done, close it? Liuxinyu970226 (talk) 08:17, 15 August 2021 (UTC)

I think we can close it as withdrawn, since the rest ones have no contributions and their usernames are harmless. Itcfangye (talk) 17:27, 15 August 2021 (UTC)

I'd rather mark this discussion as done, for both this request and the 三幻神 request were solved, and there's been no update to local discussion for a week. --Super Wang (Chinese Wikimedian since 2009 | Greetings from Dalian) 01:56, 16 August 2021 (UTC)

@Oesjaar: I have taken additional measures for your well-being. This may work in the short term, but Mukdro may find a detour. So, if this user appears again, please let me or Amanda know immediately. --Sotiale (talk) 12:46, 21 August 2021 (UTC)

Merci! |Thanks! |Dankie! Ke a leboga! Oesjaar (talk) 12:57, 21 August 2021 (UTC)

@ Amanda (aka DQ) and Sotiale can you confirm if all these usernames belong to the same user or are coming from the same IP address? If so, is it possible to block the actually IP address where they are created from, @Oesjaar has confirmed to our social media chat that this user has created a new username again! Bobbyshabangu (talk) 18:18, 22 August 2021 (UTC)

@Kalogeropoulos: I want to tell you about two things. First, according to your request, this request is to investigate you and Skylax30. If this is not true, then Skylax30 should be excluded from above list. Second, you are asking for this investigation to prove your innocence. This is generally not allowed. The community may be asking us to investigate you if they have suspicion that you have committed an abusive behavior. If the community is suspicious of you and needs an investigation, I think the community will form an opinion and submit a request to us. --Sotiale (talk) 10:45, 22 August 2021 (UTC)

@Sotiale: Thanks a lot for your attention. Actually I 've asked community in Admin's Page for a CU either by Admins or Users. They didn't respond and in the mean time a user blocked in the past for puppetry is accussing me that I have conducted some kind of ip puppetry in order to offend him. I thing that is a serious accusation for an Admin. That's why I came here since community did not respond to my appeal. Of course you can exclude Skylax30 if you think that is inappropriate or out of rules.--Kalogeropoulos (talk) 11:11, 22 August 2021 (UTC)

@Kalogeropoulos: Anyone can make a claim, but what matters is what the community thinks about their claim. What I'm curious about is whether their claims are taken with credibility and are taken seriously. If that's not the case, your investigation is unnecessary, and I think the community's lack of opinion is equally explainable. --Sotiale (talk) 11:17, 22 August 2021 (UTC)

The CheckUser policy says that "some wikis allow an editor's IPs to be checked upon their request if, for example, there is a need to provide evidence of innocence against a sockpuppet allegation", I'm not sure if elwiki is one of them though. ~Styyx^{Talk? ^-^} 11:19, 22 August 2021 (UTC)

Unfortunately there is not such a policy Styyx. So I 've to bear serious personal attacks without any means of proving the opposite. So be it Sotiale thanks for your attention and your time. Thank you also Styyx --Kalogeropoulos (talk) 11:37, 22 August 2021 (UTC)

If the community doesn't take their claim seriously, I encourage you not to suffer the claims you think are false. If you think the user is attacking you without any proper evidence, request a block according to local policy. Then this request is marked not done.--Sotiale (talk) 12:03, 22 August 2021 (UTC)

I dont think they are Sotiale. They are--Kalogeropoulos (talk) 16:33, 22 August 2021 (UTC)

I'm not particularly seeing where the abuse of multiple accounts has come in. Yes, there may be use, but that's one edit to the userpage stating "MADS team". I obviously can't read Chinese sock puppetry policy, but the default checkuser policy requires some sort of suspected abuse of multiple accounts. And to be clear the actual abuse has to extend over both accounts, not just come from one of them. Can we please clarify this? -- Amanda (aka DQ) 04:29, 22 August 2021 (UTC)

Request withdrawn. My apologies for wasting your time. --Super Wang (Chinese Wikimedian since 2009 | Greetings from Dalian) 14:14, 22 August 2021 (UTC)

Please note this request wasn't locally discussed first, so I'm afraid there's no consensus of performing checkuser. --Super Wang (Chinese Wikimedian since 2009 | Greetings from Dalian) 23:50, 25 August 2021 (UTC)

Not done In case of zhwiki, unless the request is urgent enough to not go through HAM, it is customary to go through HAM. It does not appear to be an urgent case, so please go through local HAM before posting. --Sotiale (talk) 23:57, 25 August 2021 (UTC)

Doing... --Sotiale (talk) 13:37, 26 August 2021 (UTC)

•  Confirmed Tenseng rabbits, Tseng mimi, Tseng rabbits, Tseng rainbow, Tseng Sweet
• Unrelated 777 series

Hidden accounts of 777 series exist, but this will be further investigated tomorrow, because of my health. --Sotiale (talk) 14:07, 26 August 2021 (UTC)

•  Confirmed(777 series) Food2021, Foxnonolove, FacebookandYoutube777, Hkt48bug, 2021bullandcow, Ballouttheend, Seemydeathlove777, 888Music777, Jessicacool777, Liaolalala777, Foodlike777, 777tw888, Superboominschool777, Heart1111, 777school 777, Liveoflove, 122333444455555666666vvv

From a technical point of view. --Sotiale (talk) 12:47, 27 August 2021 (UTC)

Stale Data for comparison does not exist because too long has passed since the last edit of the two accounts being compared(Sectant and Cristina naegu). --Sotiale (talk) 23:46, 25 August 2021 (UTC)

@Sotiale: Checkusers from en.wiki detected the clones, they might know more about the past data. Tgeorgescu (talk) 09:38, 26 August 2021 (UTC)

@Tgeorgescu: They last appeared about 2 years ago. Most likely the old data is meaningless, or the checkuser team has deleted it. If you wish to proceed, it is better to ask the enwiki SPI, not here. Because the checkuser team can always ask us for data from rowiki if they need it. --Sotiale (talk) 13:35, 26 August 2021 (UTC)

Meanwhile the guy was blocked, so I am cancelling this request. -- Victor Blacus (talk) 11:44, 27 August 2021 (UTC)

Then, this is marked with withdrawn at the requester's will. --Sotiale (talk) 11:51, 27 August 2021 (UTC)

• Likely AFUHANWANSUI and Tonggood(ColorfulLuxury)

---

• They used OPs/VPN.

From a technical point of view. It seems that there was an effort to detour in its own way, but sadly, it doesn't seem to have been successful. --Sotiale (talk) 11:11, 29 August 2021 (UTC)

Doing... --Sotiale (talk) 11:57, 30 August 2021 (UTC)

•  Confirmed Xhdjfjcncmskksjfjd, Druoip, Goodmorninghihello

From a technical point of view. --Sotiale (talk) 12:01, 30 August 2021 (UTC)

@Nguyenhai314: Do we really need a CU? The duck test should be enough. Unnamed User^{Name me} 02:33, 30 August 2021 (UTC)

@NguoiDungKhongDinhDanh: Whatever. I think this case is related to an admin election and a globally locked user so check user is necessary to avoid mistakes. The rest is up to the CU. Nguyenhai314 (talk) 02:56, 30 August 2021 (UTC)

•  Confirmed Đ*t c*n m Đức Anh, Jurchen Racing Boy, Sinh tử hữu mệnh, Tôi là người King

From a technical point of view. All locked now.--Sotiale (talk) 12:09, 30 August 2021 (UTC)

Status:    Not done

List of users

Xhdjfjcncmskksjfjd (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

Goodmorninghihello (contr · deleted · block · log · block log · CA · guc · checkuser · lwcheckuser)

• CU log
• Discussion: w:zh:Wikipedia:元維基用戶查核請求#Xhdjfjcncmskksjfjd

Reason(s): Hello, supervisor! We found that the editing habits of the two users are extremely similar, and both are keen to participate in the editing war, but we found a lot of suspicious things, so we can't  It looks like a duck to me. We hope to determine whether they are the same person and other puppet accounts through technical means. AFUHANWANSUI (talk) 08:57, 29 August 2021 (UTC)

Not done. Don't bring anything here that hasn't been fully discussed in local HAM yet. --Sotiale (talk) 10:42, 29 August 2021 (UTC)

Yes, they're. All locked now. --Sotiale (talk) 07:26, 31 August 2021 (UTC)