Wikipedia:Sockpuppet investigations/Atlantic12/Archive


Atlantic12

Atlantic12 (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

15 January 2017

Suspected sockpuppets


  • User compare report Auto-generated every hour.
  • Editor interaction utility

For the past several months, some incredibly suspicious stuff has been happening at People's Mujahedin of Iran (PMOI), prompting EdJohnston's recent page protection. A massive edit war has transpired, with Pahlevun (and the odd page-watcher) essentially alone in the face of what appears to be a coordinated effort to censor unflattering material about the PMOI by Atlantic12, Citieslife, Tigereconomy, Carpe765, 36Balloons, Newcomer1, NickRovinsky, Saleh Hamedi, and TheDreamBoat—all single-purpose accounts with only a handful of edits unrelated to Iran or the PMOI between them.

  • Four of these accounts were created in late 2016, sometimes only days apart: Newcomer1 was created on August 15, NickRovinsky was created on October 10, Saleh Hamedi was created on December 19, and TheDreamBoat was created on December 20.
  • The remaining five accounts have been around much longer, all dating from late 2013. Does this mean they are innocent of any wrongdoing? Perhaps, but for accounts that so closely share the same interests and POV, it is striking that they were all created within days of each other, over a period of less than one month: Atlantic12 was created on October 23, Citieslife was created on November 8, Tigereconomy was created on November 15, Carpe765 was created on November 20, and 36Balloon was created on November 22.
  • All of the accounts have simple, one-sentence userpages, with the exceptions of Citieslife (updated last July), Newcomer1, and TheDreamBoat—which are still fairly bare-bones. This proves little in isolation, but it may not be a coincidence that Atlantic12, Tigereconomy, Carpe765, and Newcomer1 open with famous quotes (Machiavelli, Confucius, Latin saying, and Burke, respectively).
  • All of the accounts seem to format citations identically, but some slip-up and add a bare URL on occasion. Make of that what you will.
  • The most peculiar feature uniting many of these accounts, from both 2013 and 2016, is the insistence that any statement relying on a single source—whatever the quality—can be arbitrarily deleted. Consider the following edit summaries:
    • "Removed section, it is largely based on single source. WP: UNDUE given based on one person's account"; "Assume good faith. Removed section, it is largely based on single source. WP: UNDUE given based on one person's account"; "Removed section, it is largely based on single source. Single source or one person's account, does not give weight to this topic"; "One individual's claim cannot be used to verify"; "Unable to verify claim based on single source"; "Extraordinary claims need extraordinary sources - these claims are based largely on a single source"; "Largely based on a single source"—Atlantic12
    • "Removed information that is based on single source - not enough to verify"—Citieslife
    • "Claim requires additional high-quality sources in order to verify WP:EXTRAORDINARY"—36Balloons
    • "The section was deleted since it was based primarily on a single source, while making very serious claims. Accuracy and neutrality is disputed because only a single source is used"—Newcomer1
    • "MEK and the Israeli-Palestinian Conflict section is based on a single source. This information is not verifiable"; "Removed material of section that cannot be verified. It is based on single source"—NickRovinsky
      • Note that Atlantic12, Citieslife, and NickRovinsky write "based on single source" instead of "based on a single source."
  • Carpe765 and Saleh Hamedi are determined to scrub any references to "Marxism": "Infobox not necessary to include. Internal link to Marxism article under Foundation gives readers source to learn more"—Carpe765; "Removed another reference to Marxism in infobox"—Saleh Hamedi

The final point I would like to emphasize is the obvious coordination between these accounts. Just take a quick glance at People's Mujahedin of Iran's edit history for the two days prior to EdJohnston's January 14 intervention: Saleh Hamedi deletes huge swathes of content at 16:05 on January 12, but is reverted by Pahlevun at 16:26, only for TheDreamBoat to reinstate the deletions at 16:30—with a further paragraph expunged by Citieslife at 19:59. Denarivs restores the page at 10:02 on January 13, prompting an encore performance by Saleh Hamedi at 12:20. Yet this is only the tip of the iceberg, with similar edits stretching back months. Perhaps the only sin here is meatpuppetry—possibly by individuals directly affiliated with the PMOI itself—but I'd take the odds that there are at least some socks in my list.TheTimesAreAChanging (talk) 11:33, 15 January 2017 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments

  • Group 1 – the following accounts are  Confirmed to each other:
  • Group 2 – the following accounts are  Confirmed to each other and Red X Unrelated to Group 1:
  • TheDreamBoat is Red X Unrelated.
  • Blocked and tagged the Group 1 accounts. Blocked without tags the Group 2 accounts.--Bbb23 (talk) 15:57, 15 January 2017 (UTC)[reply]
  •  Clerk note: Tagged group 2. GABgab 18:14, 15 January 2017 (UTC)[reply]
  • Close. King of ♥ ♦ ♣ ♠ 04:55, 18 January 2017 (UTC)[reply]

26 July 2017

Suspected sockpuppets


  • User compare report Auto-generated every hour.
  • Editor interaction utility

People's Mujahedin of Iran has been one of the biggest sock farms in recent memory, with eight (8) socks working together to censor negative information about the group being exposed and checkuser blocked following an SPI filed by yours truly last January. Anyone responding to this request would benefit from reviewing that case. Interestingly, while I had assumed that all of the accounts were being operated by Atlantic12, it turned out that there were two technically unrelated (but still clearly coordinated) groups of socks—one operated by Atlantic12 and another operated by Newcomer1. For the purposes of this SPI, I am assuming that the most likely master of the accounts listed above, if they are indeed socks, is Newcomer1, but I recommend comparing them to both groups listed in the previous SPI.

So, why do I suspect that there are additional socks still at large? Let's start with BulkData, who I consider the more likely sock. The biggest tell uniting both of the indeffed sock teams was their insistence that any statement relying on a single source—whatever the quality—can be arbitrarily deleted. Consider the following edit summaries:

  • "Removed section, it is largely based on single source. WP: UNDUE given based on one person's account"; "Assume good faith. Removed section, it is largely based on single source. WP: UNDUE given based on one person's account"; "Removed section, it is largely based on single source. Single source or one person's account, does not give weight to this topic"; "One individual's claim cannot be used to verify"; "Unable to verify claim based on single source"; "Extraordinary claims need extraordinary sources - these claims are based largely on a single source"; "Largely based on a single source"—Atlantic12
  • "The section was deleted since it was based primarily on a single source, while making very serious claims. Accuracy and neutrality is disputed because only a single source is used"—Newcomer1
  • "MEK and the Israeli-Palestinian Conflict section is based on a single source. This information is not verifiable"; "Removed material of section that cannot be verified. It is based on single source"—Newcomer 1 confirmed sockpuppet NickRovinsky.

Now compare that to BulkData:

  • "Removed, not verifiable by multiple reliable sources WP:NOTNP WP:V"; "not verifiable by multiple reliable sources WP:NOTNP WP:V See Talk"; "not verifiable by multiple reliable sources WP:NOTNP - See Talk"—BulkData

BulkData was created in 2016, during the same rough time period as the other Newcomer1 socks: Newcomer1 was created on August 15, NickRovinsky was created on October 10, BulkData was created on October 21, and Saleh Hamedi was created on December 19. The Atlantic12 socks, by contrast, originated in October–November 2013.

DirectAttrition appears to suffer from much the same problem, using an alphabet soup of policies to deem well-sourced content "unverifiable," although this account tends to soften the language rather than delete the source outright:

  • "Cannot be verified by source given. Wikipedia:ORIGINAL Revised text for NPOV and verifiability"; "Cannot be verified by source given. Wikipedia:ORIGINAL Revised text for NPOV and verifiability"; "Revised text for NPOV and verifiability Wikipedia:ORIGINAL"—DirectAttrition

As I recall, I considered including DirectAttrition in the previous SPI but decided not to because that was the only account dating from 2014 (rather than 2013 or 2016) and because DirectAttrition seemed to have a somewhat wider range of interests than most of the others. In light of the above, I consider the similarities clear enough to justify a check.

There is also at least one other account editing People's Mujahedin of Iran that I consider shady, given the massive sockpuppet attacks of the recent past, but without solid evidence I don't think it would be appropriate to relay my speculation here. Let's just say that I do not know of any other article in which such a disproportionate number of its editors (including its confirmed sockpuppets) have userpages with inspirational quotes from famous people (DirectAttrition included). Then again, there are coincidences, and even if other sock– or meatpuppetry is ongoing, I may not fully understand it. TheTimesAreAChanging (talk) 23:15, 26 July 2017 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.


Clerk, CheckUser, and/or patrolling admin comments

24 March 2018

Suspected sockpuppets

  • User compare report Auto-generated every hour.
  • Editor interaction utility

I am asking to check whether London Hall (talk · contribs) is technically related to any of the users proved to be in three suckpuppet clusters of User:Atlantic12, User:Newcomer1 and User:DirectAttrition. The other two IPs mentioned above are suspected to be linked to these three users.

Background

The article People's Mujahedin of Iran (PMOI) has been subject to technically-proved coordinated effort twice, in January and July 2017. At least 11 accounts, possibly run by individuals directly affiliated with the PMOI itself, tried to censor unflattering material about the organization. (Please see the reports filed by User:TheTimesAreAChanging here: Wikipedia:Sockpuppet investigations/Atlantic12/Archive) Back in January 2017, User:EdJohnston said: Due to concern about possible socking, I've placed the article under extended confirmed protection for one year. Several new accounts with no other interests and good knowledge of Wikipedia have sprung up to defend the group that is the subject of the article. This seems like too much of a coincidence. Now it seems that we are witnessing the third endeavor.

Evidence 1, similar editing style and history

The user in question, London Hall, makes the very first edit at 17:41, 12 June 2016, creating an article, which seems too sophisticated for a newbie. Plus, the user was created in the same year the users User:Newcomer1, User:NickRovinsky, User:Saleh Hamedi were created. London Hall goes on hiatus until 2018, making the second edit, which still seems done by an experienced user at 15:03, 14 February 2018. (Similar to User:Atlantic12, created in 2013 and on hiatus until 2016; User:Detente 1, created in 2015 and on hiatus until 2017). After a while of editing noumerous articles, London Hall becomes extensively interested in one specific article, People's Mujahedin of Iran. This activity history is similar to those of DirectAttrition and BulkData. London Hall starts making minor edits on random articles, in a hurry to increase the number of his/her edits within a short period of time, in order to become an extended confirmed user (example: [1], [2], [3], [4], [5], [6], [7], [8], [9]) An almost identical editing style applies to User:BulkData (example: [10], [11], [12], [13], [14], [15]) and to User:DirectAttrition (example: [16], [17], [18], [19], [20]) On 19 February 2018, out of the blue, in a suspected hounding, London Hall tries to taunt me in two consecutive edits (I stood in the way of the suckpuppets to purge the article in 2017, leading to blatant personal attacks against me) by reverting an edit that I did on 2 February 2018 and tagging an article I created. Is this a coincidence? Maybe, but when I did not react, London Hall initiated a topic in the talkpage two days later on 21 February. On the same day, it appears to User:Jytdog that London Hall is having a conflict of interest and being paid to edit, however London Hall denies this.

Last but not the least, London Hall follows the same techniques used by User:Saleh Hamedi (here) to justify removing the content. Engaging in edit war, while transforming discussions in the talkpage to a war of attrition unrelated to the edits made, in order to pretend following conduct policies, as well as slowing me down. Please consider comparing them.

Evidence 2, similar userpages

London Hall once had a simple, one-sentence userpage, just like User:Citieslife, User:Carpe765, User:Tigereconomy, User:Atlantic12. Most importantly, the similarity between these two userpages is intersting:

  • "I'm a recently retired Middle Eastern history professor. Taking up Wikipedia as a new hobby."—London Hall
  • "Born Iranian, living and working as a history teacher in London. Travel a lot for work purposes. I Love history..."—Newcomer1
Evidence 2.5, same self-described background

User:Newcomer1 is self-described "Born Iranian" and living in London, "London Hall" has a username with the word "London" and is also very interested in articles somehow related to Iran (e.g. Iranian National Commission for UNESCO, Bandari music, Aran va Bidgol, Moalagh Bridge, Farrokhroo Parsa, Zahra Bahrami, Soraya Manutchehri).

Evidence 3, similar remarks
  • London Hall has stated that PMOI is "Iranian regime's main opposition" (a bogus, by the way), the term known sockpuppets have occasionally used before in the discussions, examples: Saleh Hamedi and NickRovinsky.
  • London Hall's edit summaries suggest that anything he deems violating NPOV —whatever the quality— can be arbitrarily deleted: "addressing NPOV per Talk page", "NPOV reference/statement", "NPOV", "NPOV", "NPOV", "Removing NPOV per Talk Page discussion"

Consider the following edit summaries, among others:

  • "Does not follow NPOV"—NickRovinsky
  • "section violates NPOV guidelines"—36Balloons
  • "Removed material that does not follow NPOV guidelines"—Tigereconomy
Evidence 4, same edits and sensivity to the same content
  1. London Hall is determined to scrub the word "violent" from the lead, done by TheDreamBoat and DirectAttrition before.
  2. London Hall wants the same content removed that was previously a goal for the suckpuppets, example: Citieslife and NickRovinsky
  3. London Hall removes this, done before by Saleh Hamedi and NickRovinsky among others.

I could wait more for London Hall to make more edits, showing much more similar activities and behaviour with the suckpuppets, however, I think these are enough to justify a CheckUser. Regards. Pahlevun (talk) 10:17, 24 March 2018 (UTC)[reply]

Update

Please consider that

  1. London Hall has linked a discussion dating back to September 2016 that I had with another user in another article, when he was inactive.
  2. The user seems to have a memory of the article history when London Hall was inactive, stating "Brustopher also has a long history of attacking this page". Brustopher's most recent edit on the article was on 23 June 2016‎, when these suspected sockpuppets that were never investigated and blocked engaged in an edit war:
  • Silvio artemis (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • SupaEdita (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • WorldAlive (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • 172.56.21.38 (talk+ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))

—Pahlevun (talk) 16:20, 13 April 2018 (UTC)[reply]

All I had to do was look at the article's history; not difficult. London Hall (talk) 16:31, 13 April 2018 (UTC)[reply]
I have made thousands of edits since September 2016 and you have stalked me back to the date. Seems difficult to me. Pahlevun (talk) 16:44, 13 April 2018 (UTC)[reply]
All I had to do was look at some of the Iranian Regime's opposition political parties to see that other editors have also had issues with you when trying to bring some neutrality to the pages. You seem to edit heavily in favor of the Iranian Regime and attack any Wiki page that presents some kind of political opposition to it. Do you have a COI in favor of the Iranian Regime? London Hall (talk) 18:37, 13 April 2018 (UTC)[reply]
Update 2

Another evidence just popped up with what London Hall wrote above:

  • "After a little investigation I found that at least 1 user Pahlevun... I've actually avoided labelling Pahlevun or anyone else for that matter as regime agents..."—Saleh Hamedi
  • "if you look at only the month of November and December 2016, you can see over 190 edits by the users "pahlevun"... obviously doing the job for who ever is behind the demonization campaign" and "Noticing the fact that "pahlevun"... have an agenda to abuse Wikipedia on behalf of the Iran's tyrannical regime, and to demonize the opposition groups that are standing up to the dictatorship"—NickRovinsky

—Pahlevun (talk) 19:41, 13 April 2018 (UTC)[reply]

You may have missed a few more, but here’s another one from (TheStrayDog / Amir Muhammad1), a (member of Wiki Iran Project): “I'm not sure but i guess he is a part of Iranian governments or military board and he is not "Neutral" (WP:Neutral) in some cases, because he is only editing and focusing on Iranian governmental and military related article that some of them even don't have any article in Persian!” London Hall (talk) 19:08, 15 April 2018 (UTC)[reply]
By linking a diff dating back to 28 July 2016, you are confessing that I was right about you. I never accused User:TheStrayDog of being a sockpuppet, nor a single-purpose account, and I believe that he is a constructive user and here to contribute to the encyclopedia. For the record, he was a newcomer, and I was sort of a biter, we disputed over a few edits which evetually was resolved and ended to this and this. Pahlevun (talk) 20:19, 15 April 2018 (UTC)[reply]

Comments by other users

This is laughable. User:Pahlevun has monopolised the page [People's Mujahedin of Iran], and because I've tried to edit it, he's now accused me of sockpupetry. The article has some obvious NPOV issues, so I started a list of proposed changes on the article's Talk page. All evidence is there. Use:Pahlevun won't let anyone come near the article, even though it contains problems. London Hall (talk) 10:43, 24 March 2018 (UTC)[reply]

The behavioral evidence presented by Pahlevun under "Evidence 3" and "Evidence 4" is very compelling. I would like to know why London Hall repeats the same false claim of the confirmed sockpuppets that the PMOI is "the Iranian regime's main opposition," and why he repeatedly made identical edits and removed the same sourced material.TheTimesAreAChanging (talk) 20:45, 26 March 2018 (UTC)[reply]
The details of the debate are included in article's Talk page (I noted this above), but to save you time here are some references that a quick Google search produced on this group being considered one of the Iranian Regime's political oppositions:[21][22][23][24] Also found that the Iranian Regime is funneling money into Western academia/press to push their POV, which includes the Brooking Institution (one of the sources used to back up some of the most negative parts of the article). London Hall (talk) 16:59, 29 March 2018 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

  •  Clerk declined - Unless I'm mistaken, all socks are now stale. Sro23 (talk) 21:36, 6 April 2018 (UTC)[reply]
  • Regardless the user is now blocked for unrelated reasons. Closing. Sro23 (talk) 22:28, 13 May 2018 (UTC)[reply]

20 November 2018

Suspected sockpuppets

  • Stefka Bulgaria (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • 85.50.34.220 (talk+ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
  • Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

From the very first days I came across the user, I was doubtful if he was really making his first edit in Wikipedia, on 18 December 2017. Checking his editing pattern shows that at the beginning he used to edit Kazakhstan-related articles but then he made sharp shift on 23 May 2018 towards MEK articles, just like the users reported here. He's very much dedicated to clean the history of MEK and on one occasion he made six reverts in less than one day (It was a manual page protection, since he reverted most of the new changes!!!). To be more accurate, I think the following items are showing he belongs to this sock farm:

  • On 14 January 2017, EdJohnston "placed the article under extended confirmed protection for one year...due to concern about possible socking". The protection was expected to end on 14 January 2018. Having begun editing on 18 December 2017, less than one month to the protection coming to its end, Stefka Bulgaria did a great deal of edits probably to become an extended confirmed (he made 100 edits in less than one week with the 100th edit being on 24 December 2017. It's very interesting that the "newbie" made 50 edits in less than two days by making a mixture of major and minor edits in between). But, the protection would automatically expire even before Stefka Bulgaria become a 30 days user, hence another probability is that the primary edits were done to pretend as if he’s a new user unrelated to this sockfarm, who are all interested in MEK and MEK-related articles, and instead is interested in Kazakhstan-related articles (see this image from Kazakhstan on his user page). Pahlevun showed same attempt by other members of this farm for becoming an extended confirmed user within a short time. Just some probabilities, I'm making.
  • The user was registered just some months after the last groups of the editors were blocked.
  • He shares almost same POV as other editors, just like their edits, his edits are censoring “unflattering material about the PMOI” and he has just “only a handful of edits unrelated to Iran or the PMOI between them” (the quotes belong to TheTimesAreAChanging).
  • Like other users, he uses long edit summaries: “Despite the subject of the article being controversial, this is not controverislal infomation. As noted, it resumes when/how/why, which is arguably the most important aspect of the organization's background. Please refrain from disruptive editing”, “a means to slander, Khomeini (no Iran) used the term "hpocrites" to describe this group after they came in direct conflict with the clerics. The MEK also used other slander to describe Khomeini and the clerics, but this should not be included here, as also this should not be included here” and etc. Compare these long edit summaries with [25], [26] and [27].
  • Accusing the editors holding different view than his with vandalism, while there's actually no vandalism: [28]- Tigereconomy, [29]-NickRovinsky, [30]-Stefka Bulgaria, [31]-Stefka Bulgaria, [32]-Stefka Bulgaria, [33]-Stefka Bulgaria.
  • They are all dedicated to move “Marxism” from the infobox: [34]- Tigereconomy, [35]-Stefka Bulgaria, [36]-Stefka Bulgaria
  • He tried very much to remove the word 'violent' from the lead (See [37], [38], [39]). Compare it with a similar behavior by TheDreamBoat and DirectAttrition.
  • Comparing the time cards may give us more insights (for example compare Stefka Bulgaria's time card with that of London Hall).
  • As for the IP, I think [40], [41] shows they're interconnected.

What ever it is, I don't think these similarities and presence of this user with "no other interests and good knowledge of Wikipedia have sprung up to defend" the MEK group is not just accidental. Mhhossein talk 17:02, 20 November 2018 (UTC)[reply]

  • Update: The user has began to edit articles unrelated to MEK exactly after the this request was drafted. I think it's too much of a coincidence to see edits like [42], [43], [44], [45], [46] and etc. This editing behavior by the user is just unprecedented. --Mhhossein talk 07:02, 25 November 2018 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

This case is  Stale. CU declined.--Bbb23 (talk) 18:22, 20 November 2018 (UTC)[reply]

  • Nothing is happening here. Closing. Bbb23 (talk) 19:11, 24 December 2018 (UTC)[reply]
Retrieved from "https://en.wikipedia.org/w/index.php?title=Wikipedia:Sockpuppet_investigations/Atlantic12/Archive&oldid=1072187589"