**Steps to replicate the issue** (include links if applicable):
Unsure of the exact steps, but would likely revolve around creating an account where the username being used hits an abuse filter pattern and is then logged.
**What happens?**:
The AbuseFilter entry shows the performer as an account, but the action as shown in the CheckUser tool is marked as being performed by the IP address that created the account.
**What should have happened instead?**:
The log should be consistent between what is shown in the AbuseFilter log and also what is shown in CheckUser, as the CheckUser tool would already show the IP if the performer was the newly created account.
**Software version** (skip for WMF-hosted wikis like Wikipedia):
English Wikipedia
**Other information** (browser name/version, screenshots, etc.):
I found this on the English Wikipedia. The example I found was https://en.wikipedia.org/wiki/Special:AbuseLog/35622396 (I found this while running CheckUser on the account for https://en.wikipedia.org/wiki/Wikipedia:Sockpuppet_investigations/Oli2000s). The account creation log entry appears before the AbuseFilter log entry in the CheckUser results which suggests that the account was created before the AbuseFilter log entry was sent to CheckUser.