Wikipedia:Sockpuppet investigations/ByteOr/Archive


ByteOr

ByteOr (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

14 October 2022

Suspected sockpuppets

  • Brennieor (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • 170.150.22.138 (talk+ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
  • 96.44.24.124 (talk+ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
  • 70.113.48.196 (talk+ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
  • 89.106.105.131 (talk+ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
  • Raideuro69 (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Ravage the wiki (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Tools: Editor interaction utility • Interaction Timeline • SPI Tools

Was created on the same day and both accounts have similar userboxes. Only check on the user account, not the IPs. Magnatyrannus (talk | contribs) 02:11, 14 October 2022 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
  • Thanks to the editor for writing this up; I was busy. This is an LTA--oh it might be this one, well known for their total lack of sense. BTW I ran CU already, but couldn't find anything I could do anything with--someone who knows this guy a bit better, and knows more about proxies etc., can likely get more info esp. out of the Ravage/Raid accounts. Drmies (talk) 03:13, 14 October 2022 (UTC)[reply]
    @Drmies, I have a feeling that Screendeemer is part of this farm, considering their similar userboxes and editing patterns. Magnatyrannus (talk | contribs) 22:31, 15 October 2022 (UTC)[reply]
Trolling and trollfeeding --Blablubbs (talk) 11:00, 14 October 2022 (UTC)[reply]
The following discussion has been closed. Please do not modify it.
  • Actually that’s not me or the other editor at all. We are two completely different vandals. Checkuser didn’t give you anything because it is so inefficient at catching socks it’s unreal. Date creation is the only evidence that is supportive. If you really want it to be more effective make Wikipedia’s JavaScript engine log pretty much everything about the user’s browser (even hardware identifiers) so it can be easier to identify but you guys are unpaid so that will never happen. IPs all are residential so all you can do to prevent the “proxying” is to ban actual ISPs from editing the site. Basically fuck off with this bullshit and get an actual hobby. Brennieor (talk) 03:29, 14 October 2022 (UTC)[reply]
    @Brennieor: Funny, Wikipedia seems to work just fine despite your contentions. Psiĥedelisto (talk • contribs) please always ping! 07:25, 14 October 2022 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

  • I blocked Brennieor based on their comment here, and then ran a check on them and ByteOr. Brennieor matches a bunch of previously blocked accounts. ByteOr is using proxies, but seems obviously connected to Brennieor. Not sure who the original master is, but I also didn't really bother looking into it much because I don't think it matters. Didn't see any obvious sleepers. Ravage the wiki and Raideuro69 seem to be on proxy and look consistent with each other, and could be connected to the other two, but I'm not as certain with regard to that connection. --Blablubbs (talk) 07:45, 14 October 2022 (UTC)[reply]
  • The accounts and proxies have been blocked. I am not going to spend too much time deciding how to tag and classify obvious throwaway troll socks. Closing. Thanks, Spicy (talk) 14:10, 14 October 2022 (UTC)[reply]
  • Screendeemer is already blocked, and while they are (as I see know) the same person as User:Bagourt, does it matter? They're editing from a range I blocked months ago already for racist trolling--but racists, trolls, and socks are a dime a dozen. Let's move on. Drmies (talk) 00:27, 16 October 2022 (UTC)[reply]
    No, but I was just pointing out their similar edit overlap. Magnatyrannus (talk | contribs) 00:32, 16 October 2022 (UTC)[reply]

15 October 2022

Suspected sockpuppets

  • 73.205.107.144 (talk+ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
  • Tools: Editor interaction utility • Interaction Timeline • SPI Tools

Reinstated a possible socks' edits on the pol article. Magnatyrannus (talk | contribs) 22:35, 15 October 2022 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

No evidence on socking, and no comment on IP editors. Drmies (talk) 00:24, 16 October 2022 (UTC)[reply]

  • There is evidence that the reported IP is likely connected to the 4 IPs in the previous report. A block would be supported by WP:NOP, however, I don't think this same IP will be used again. I think CUs should take note of the IPs reported in this case, and also the ones that CU might have shown for the registered accounts. Closing without action. MarioGom (talk) 12:38, 16 October 2022 (UTC)[reply]

30 October 2022

Suspected sockpuppets

  • 103.180.250.1 (talk+ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
  • Tools: Editor interaction utility • Interaction Timeline • SPI Tools

Reinstated an edit of Brennieor's on the Algonquin Highlands article, which I later reverted. Magnatyrannus (talk | contribs) 18:37, 30 October 2022 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

  • Likely a proxy, unlikely to be re-used. Closing without action. MarioGom (talk) 19:37, 30 October 2022 (UTC)[reply]

14 November 2022

Suspected sockpuppets

  • Alohaidled (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Tools: Editor interaction utility • Interaction Timeline • SPI Tools

Incredibly similar targets and MO to this LTA's obvious vandalism socks and proxies: right-wing topics, Chris Chan, and Turning Red. They vandalize in all of these topics using proxies and accounts, while also making accounts to "constructively" edit in those topics.

Overlap includes Talk:Kiwi Farms, see Brennieor, ByteOr, and Alohaidled. And obvious vandalism sock AimMegs.

AimMegs is referencing Chris Chan in their vandalism. Alohaidled also references Chris Chan in this edit. wizzito | say hello! 05:58, 14 November 2022 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Here's a recent sock that a CU or admin could compare to: Geartmarlo (talk · contribs · deleted contribs · nuke contribs · logs · filter log · block user · block log). Also notice their style of nonsensical-sounding usernames. wizzito | say hello! 06:01, 14 November 2022 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

  •  Confirmed to a number of previous socks.  Blocked without tags, closing. Alohaidled is technically the oldest account, but I'm not sure if this is worth a move. No objections if a clerk wants to move, though. --Blablubbs (talk) 09:23, 14 November 2022 (UTC)[reply]

19 November 2022

Suspected sockpuppets

  • MacaquePeacetime (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Tools: Editor interaction utility • Interaction Timeline • SPI Tools

First edit upon registering was to restore a version of the article Epik written by a prior sock. See this diff by a prior sock versus this edit by MacaquePeacetime.

See also this RfC, which is similar to a prior RfC from a prior sock (though the articles are different). Aoi (青い) (talk) 21:01, 19 November 2022 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

  • That's them.  Blocked without tags, closing. --Blablubbs (talk) 21:11, 19 November 2022 (UTC)[reply]

01 December 2022

Suspected sockpuppets

  • GhoulBlacken (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) ( Clerk note: original case name)
  • Gummerbe (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) ( Clerk note: original case name)

Behavioral similarity couldn't be more obvious. Exact same vandalism on the exact same set of pages. All accounts have already been blocked. wp:CheckUser requested to check for sleepers as many of these accounts remain dormant for days or months before editing. I've listed the accounts that I could find, but I'm sure there are more. Thank you! Someone who's wrong on the internet (talk) 23:40, 1 December 2022 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

  •  Inconclusive because of the use of proxies. I sampled a few accounts to check, and I'm actually seeing relatively strong evidence they may be using proxies of the P2P variety. It's going to be pretty difficult to use CheckUser to detect additional accounts because of this. Fortunately, their behavior so far seems pretty juvenile and easy to identify. Mz7 (talk) 08:15, 2 December 2022 (UTC)[reply]
  •  Tagged as proven, moved to the oldest account, closing. MarioGom (talk) 16:16, 2 December 2022 (UTC)[reply]
  • After discussing offline with a few clerks, the sockmaster of this group appears to be Wikipedia:Sockpuppet investigations/ByteOr.  Clerk assistance requested: Please merge this case under ByteOr and consider either retagging the accounts or removing the tags per WP:DENY. Mz7 (talk) 19:54, 4 December 2022 (UTC)[reply]
  •  Clerk note: Merged and socks re-tagged. Closing. Sro23 (talk) 03:46, 5 December 2022 (UTC)[reply]

01 December 2022

Suspected sockpuppets

  • Zelimkhan Khasanov (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) ( Clerk note: originally filed under this user)
  • Tools: Editor interaction utility • Interaction Timeline • SPI Tools

The SPA account definitely created by a sockmuster. The account's purpose is to delete the article and nothing else. This attention to one particular article and the reasoning for deletion are too good and too suspicious for a newly created account. I think the user is working for some PR/spam agency and is angry that they didn't get paid for this job, but someone else. I mean this AfD: https://en.wikipedia.org/wiki/Wikipedia:Articles_for_deletion/Elie_Khouri_(2nd_nomination). I think the CU will show a bunch of connected accounts. 多少 战场 龙 (talk) 13:09, 1 December 2022 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

  • @多少 战场 龙: do you have any evidence, a possible sockmaster, or anything at all? Or are you just looking for some salmon? DatGuyTalkContribs 17:08, 1 December 2022 (UTC)[reply]
  • I edit conflicted with DatGuy, but I see no point in holding this open waiting a response from the filer. If the filer had evidence of who the master is, they would have said so. Closing. I recommend a clerk determine whether this report should be archived or deleted. Datguy, if you disagree with my closure, feel free to reopen it. Bbb23 (talk) 17:13, 1 December 2022 (UTC)[reply]
    No quarrel, but I'd also like to note with no particular distinction Lanabdeir (talk · contribs). DatGuyTalkContribs 17:14, 1 December 2022 (UTC)[reply]
  •  On hold - Given the checkuser block, I'm reopening this to determine if we should merge it. Girth Summit: is this confirmed to Wikipedia:Sockpuppet investigations/ByteOr? MarioGom (talk) 16:05, 2 December 2022 (UTC)[reply]
    Thanks for the ping - I hadn't realised this was at SPI, I came across this from a different angle. I'd call the account exceedingly  Likely to the other accounts, and to some recently oversighted LOUTSOCK trolling. Too likely for me to AGF with a new SPA arriving straight at AfD. Girth Summit (blether) 16:42, 2 December 2022 (UTC)[reply]
    @Girth Summit: noting Special:AbuseLog/33966102. DatGuyTalkContribs 17:31, 2 December 2022 (UTC)[reply]
    So it could be two different people editing from the same IPv6 /64 range (and flipping back and forth - one used it, then the other, then the first, then the other again), I guess - but then, assuming that was ByteOr who tried to comment here - how did they know about this discussion? They haven't been pinged here, as far as I can see; I didn't tag the account, or ping them when I blocked. Kind of make me more convinced that the account is ByteOr, or directly connected to them. Girth Summit (blether) 18:01, 2 December 2022 (UTC)[reply]
  • Moved, closing. MarioGom (talk) 08:53, 8 December 2022 (UTC)[reply]

19 December 2022

Suspected sockpuppets

  • 2001:d08:e2:4f53:ca4:3270:441d:cb8 (talk+ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
  • 194.88.251.223 (talk+ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
  • 187.172.149.116 (talk+ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
  • 180.75.97.177 (talk+ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
  • 98.109.187.61 (talk+ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
  • 88.213.222.247 (talk+ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
  • Tools: Editor interaction utility • Interaction Timeline • SPI Tools

These IPs have attacked Sandra Oh with vandalism related to their disapproval of Turning Red, a Canadian film. These edits follow closely in a time period and all contained the same vandalism pattern that disparaged the film. The edits include: [1], [2], [3], [4], [5], [6], [7], [8].

Some (but not all) of these IPs have already been blocked by ScottishFinnishRadish for vandalism.

As for why the IPs are connected to this master, several users (including User:GutsyFunk, Gummerbe, GurlSilly, and Gurlysind) who are confirmed as a sockpuppets of ByteOr previously hit the page up with this same vandalism pattern. Previous attempts at checkuser have resulted in confirmed proxy use, just as these IPs appear to have been used as proxies to conduct vandalism on the page of a living person. — Red-tailed hawk (nest) 05:15, 19 December 2022 (UTC)[reply]

(Fix ping to ScottishFinnishRadish). — Red-tailed hawk (nest) 05:15, 19 December 2022 (UTC)[reply]
Is this moot at this point or... — Red-tailed hawk (nest) 02:44, 21 December 2022 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

  • These are residential proxies, but there's nothing else to do here. no Closing without action. MarioGom (talk) 22:23, 21 December 2022 (UTC)[reply]

20 January 2023

Suspected sockpuppets

  • Billion Moser (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • VanderMomera85 (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Pablo el amazing (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Marangonisonexxx (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Tools: Editor interaction utility • Interaction Timeline • SPI Tools

These accounts have engaged in similar pre-attack editing patterns to previous sleeper accounts. Trying not to reveal too much per WP:BEANS. Bsadowski1 blocked a whole bunch of these about an hour ago so hopefully the connection will be readily apparent to him. If not, feel free to email me about it. Someone who's wrong on the internet (talk) 21:54, 20 January 2023 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

  • The editing pattern plus the technical evidence I looked at makes me confident enough to block the lot. No tags per DENY. Closing. firefly ( t · c ) 22:12, 20 January 2023 (UTC)[reply]

21 January 2023

Suspected sockpuppets

  • MarietteisEpic (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Guilhermeekki (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Qu4rd4rd (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Tools: Editor interaction utility • Interaction Timeline • SPI Tools

Moved from WP:AIV (reported by Someone who's wrong on the internet) – no specific evidence has been provided, but the description and list of other accounts at #20 January 2023 is telling enough. That said, even if there is no connection to ByteOr, these three accounts are so similar to each other and so clearly being prepared for multi-account disruption that I'll block them regardless. Requesting checkuser to detect other sleepers. ~ ToBeFree (talk) 00:22, 21 January 2023 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

  • See comments in case below - I've checked all these accounts, and blocked/requested locks for any sleepers I found. Closing. Girth Summit (blether) 13:43, 21 January 2023 (UTC)[reply]

21 January 2023

Suspected sockpuppets

  • PEZZOLOWGO (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Adenonette (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Satomirnatia (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • 布萨多夫斯基的噩梦 (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Pietercoster0 (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Brunin dat well (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Life by the Jessop (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • MatsudadO (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Jelenaigra (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Callaghanxx (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Laern Herpol (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Tools: Editor interaction utility • Interaction Timeline • SPI Tools

WP:DUCK. Moved from WP:AIV per above. Someone who's wrong on the internet (talk) 00:24, 21 January 2023 (UTC)[reply]

Found some more puppets. Someone who's wrong on the internet (talk) 00:46, 21 January 2023 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

I will note that MatsudadO does not appear to be globally locked nor locally blocked at the moment, and they've had some interesting edits. Might be worth taking a look at that one in particular. — Red-tailed hawk (nest) 06:48, 21 January 2023 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

  • Blocked in silence, awaiting checkuser sleeper check. ~ ToBeFree (talk) 00:27, 21 January 2023 (UTC)[reply]
  • See case below - I've checked all of these, and blocked/requested locks for any sleepers I found. Closing. Girth Summit (blether) 13:44, 21 January 2023 (UTC)[reply]

21 January 2023

Suspected sockpuppets

  • Matadinho SoCalZ (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Discoverebert45 (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Billing3843 (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • 2405:201:c001:d017:3873:4b21:bba7:3ab (talk+ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
  • Gouldraest (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • LaNaDaMa (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Rosalindeer5 (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Schindh1emcharty (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Mazda kosec (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Julian Naaffi (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Kerstinar0 (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Maria Valensquez (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Karavas66 (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Ryananslamol (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Life by the Jessop (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Clarkalla98 (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Heather Under The Weather (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Tools: Editor interaction utility • Interaction Timeline • SPI Tools

Please see the page history of User talk:Tamzin. All appear to be socks of ByteOr, and they are generally globally locked, but I am logging them here (1) for posterity sake and (2) for use in a sleeper check, as ByteOr seems to have sleepers galore. — Red-tailed hawk (nest) 06:46, 21 January 2023 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

  •  In progress - they are using proxies. The following accounts can be considered  Confirmed to some of the socks above, and will be blocked as sleepers:
  • There are some other accounts that might be them, but the behaviour makes me think not. Will block without tags and request locks for the above. Girth Summit (blether) 13:39, 21 January 2023 (UTC)[reply]
  • Blocked, locks requsted, including one for Brunin dat well which appeared to be unlocked. Closing. Girth Summit (blether) 13:42, 21 January 2023 (UTC)[reply]

22 January 2023

Suspected sockpuppets

  • 176.112.146.116 (talk+ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
  • AntiCompositeNumberNeverShows (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • AntiCompositeNumberGlobalRangebansDontWork (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Landichocuso (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Petrovicennymy (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Alexander Atsco (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • FourmentTimes8 (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Kaundartnealmi (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Cummin Skrat (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Not Another Believer (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Ancistupid (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Muezzin was a standing (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • 反合成数 (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Tools: Editor interaction utility • Interaction Timeline • SPI Tools

Please see the content of the oversighted edits on Kampung Boy (TV series) and Talk:Kampung Boy (TV series) for evidence of socking.

I am requesting checkuser on the accounts listed above to check for sleepers; the last time that a sockfarm/proxynet was used by ByteOr, we discovered some sleepers, and I see no reason why this will be different. — Red-tailed hawk (nest) 22:15, 22 January 2023 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

21 January 2023

Suspected sockpuppets

  • Bennet43 (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Tools: Editor interaction utility • Interaction Timeline • SPI Tools

A number of obvious ByteOr socks were tagged by Drmies as part of this sock farm. Perhaps the SPIs should be merged. Someone who's wrong on the internet (talk) 20:22, 21 January 2023 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.
  • Thanks for providing this info; this is helpful for overall threat management on my part to know that this is likely one existing, known troll using many socks (including both the created users we saw as well as IP edits), rather than a coordinated campaign involving multiple humans. I appreciate the diligent follow-up. Lizthegrey (talk) 00:22, 24 January 2023 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

  • ByteOr and Bennet43 share a pool of proxies (and hence their socks look very similar on occasion), but I'm very confident they aren't the same. --Blablubbs (talk) 20:26, 21 January 2023 (UTC)[reply]
    • Blablubbs, one of the two agrees with you--but personally I don't really care, they're all the same, certainly from a moral point of view. I appreciate your more careful observation, though. Drmies (talk) 22:35, 21 January 2023 (UTC)[reply]
      • I spend a significant amount of time delineating Bennet43 behavioral fingerprint and tracking its accounts. So I'm interested in improving the tags if possible. Bennet43 is a long-term UPE group, dating back to at least 2013. ByteOr is a relatively recent troll. Both are known to use the same type of proxy networks, which I can see based on logged-out editing, but also seems consistent with CU observations. Even if there is a slight chance that someone involved in Bennet43 also does trolling on the side, I think these are functionally different personas, and we should track them separately. Is there any objection to re-tagging these as suspected to ByteOr, without prejudice of you taking note of the technical similarities here or on cuwiki? I don't really care about the presence or absence of ByteOr tags, just about keeping Bennet43's with a relatively low amount of noise. MarioGom (talk) 10:05, 22 January 2023 (UTC)[reply]
  • I've untagged the accounts. Closing. Thanks, Spicy (talk) 02:23, 25 January 2023 (UTC)[reply]

23 January 2023

Suspected sockpuppets

  • H3llb3nd3r6772 (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Tools: Editor interaction utility • Interaction Timeline • SPI Tools

WP:DUCK. Not elaborating on-wiki per WP:BEANS. Email me if you have any questions. Someone who's wrong on the internet (talk) 08:06, 23 January 2023 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Clerk, CheckUser, and/or patrolling admin comments

  • I do not think this account is related - they lack various tells that other ByteOr sleeper accounts have had. I think we should be careful in our zeal to find accounts here lest we end up going on fishing trips. Closing without action. firefly ( t · c ) 11:54, 23 January 2023 (UTC)[reply]

21 May 2023

Suspected sockpuppets

  • SquareInARoundHole (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) ( Clerk note: originally filed under this user)
  • Love The Andes (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
  • Tools: Editor interaction utility • Interaction Timeline • SPI Tools

Brand new SPA that is contributing only to Liz Fong-Jones, Charity Majors, and created honeycomb.io; given that Square created Liz Fong-Jones and has a history of socking related articles, would like a check to see if it's them. Note my COI, etc. Lizthegrey (talk) 16:25, 21 May 2023 (UTC)[reply]

See also: discussion at Wikipedia:Articles for deletion/Charity Majors (tagging @Adler3 and @Aoidh who expressed concern about Andes as well) Lizthegrey (talk) 16:26, 21 May 2023 (UTC)[reply]

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Hello, I was summoned by Liz the Grey to bring the discussion here. I want to say that the edits by Love the Andes were constructive and my vote in the earlier discussion has changed to redirect. Adler3 (talk) 19:10, 21 May 2023 (UTC)[reply]

Dear Admin, I have highlighted the behavior evidence between Liz the Grey and Love the Andes in my earlier post showing they are close collaborators, as it is the question here. Adler3 (talk) 01:55, 22 May 2023 (UTC)[reply]
You want a new SPI request to ask for that. Lizthegrey (talk) 02:01, 22 May 2023 (UTC)[reply]
Why are you leading me to start the investigation of you? Adler3 (talk) 02:03, 22 May 2023 (UTC)[reply]
You raised concerns about my behaviour in connection with another user's. I'm directing you to the appropriate place to follow up on that, according to policy, so that we can keep that discussion out of the AfD and other article/talkspace. Lizthegrey (talk) 02:09, 22 May 2023 (UTC)[reply]

Clerk, CheckUser, and/or patrolling admin comments

  •  In progress - -- RoySmith (talk) 00:13, 22 May 2023 (UTC)[reply]
  • Ostensibly Red X Unrelated, but I'm reasonably sure there's some proxy use going on, so  Inconclusive might be a better call. I'd suggest working this one purely on the behavioral evidence. -- RoySmith (talk) 00:44, 22 May 2023 (UTC)[reply]
  • Moved filing to correct case, closing. Thanks, Spicy (talk) 22:03, 5 June 2023 (UTC)[reply]
Retrieved from "https://en.wikipedia.org/w/index.php?title=Wikipedia:Sockpuppet_investigations/ByteOr/Archive&oldid=1158729333"